Vodafone 2016 Annual Report Download - page 54

Board committees (continued)
This year, the Group implemented an integrated assurance mapping
process to improve the coordination of assurance activities across
the Group and to provide a framework that allowed a comprehensive
assessment of the assurance and compliance activities for the
Group’s signicant risks. The mapping process was piloted in the UK and
Irish operating companies before being rolled out to all business units
during the second half of the 2016 nancial year.
We reviewed the process by which the Group evaluated its control
environment. Our work here was driven primarily by the Group
Audit Director’s reports on the effectiveness of internal controls,
signicant identied frauds and any identied fraud that involved
management or employees with a signicant role in internal controls.
Oversight of the Group’s compliance activities in relation to section 404
of the US Sarbanes-Oxley Act also falls within the Committee’s remit.
The Committee has completed its review of the effectiveness of the
Group’s system of internal control, including risk management, during
the year and up to the date of this Annual Report, in accordance with the
requirements of the Guidance on Risk Management, Internal Control
and related Financial and Business Reporting published by the FRC.
It conrms that no signicant failings or weaknesses were identied
in the review for the 2016 nancial year and allowed us to provide
positive assurance to the Board to assist them in making the statements
required by the 2014 UK Corporate Governance Code. Where areas for
improvement were identied, processes are in place to ensure that the
necessary action is taken and that progress is monitored.
Internal audit
Monitoring and review of the scope, extent and effectiveness of the
activity of the Group Internal Audit department is an agenda item
at each Committee meeting. We approve the annual audit plan prior
to the start of each nancial year and receive updates from the Group
Audit Director on audit activities, progress against the approved Group
audit plan, the results of any unsatisfactory audits and the action plans
to address these areas. I play a major role in setting the Group Audit
Director’s annual objectives and we meet regularly to discuss the
team’s activities and any signicant issues arising from their work.
Compliance with section 404 of the US Sarbanes-Oxley Act
The Committee takes an active role in monitoring the
Group’s compliance activities in respect of section 404 of the
US Sarbanes-Oxley Act, receiving reports from management in the
year covering:
a nancial control governance;
a changes to the section 404 programme, including scoping,
the development of a standard controls framework and the
development of a quality assurance programme; and
a the enhancement of the wider control environment in response
to ongoing business developments.
The external auditor reported the status of their work in relation to this
matter in each of their reports to the Committee.
Compliance activities
The Committee is responsible for the oversight of the
Group’s compliance programme and held a number of deep dive
sessions on compliance-related matters in the year. These focused on:
a changes to the control environment, including the creation
of two new management controls governance committees and
a redened nance operating model providing greater clarity of roles
and responsibilities;
a updates to the Group’s Code of Conduct, which is reviewed every
three years;
a the results from the annual Policy Compliance Review which tests
the extent to which local markets and Group entities are compliant
with our high risk policies;
a the results from our “Doing What’s Right” employee awareness and
e-learning programmes and other measures designed to assess the
culture of the organisation;
a the results of the use of “Speak Up” channels in place to enable
employees to raise concerns about possible irregularities
in nancial reporting or other issues and the outputs of any resulting
investigations; and
a the methodology for fraud reporting and investigations into
known or suspected fraudulent activities by both third parties
and employees.
Nick Land
On behalf of the Audit and Risk Committee
17 May 2016
Vodafone Group Plc
Annual Report 2016
52