TomTom 2008 Annual Report Download - page 42

40 / RISK MANAGEMENT AND INTERNAL CONTROL REPORT
The Management Board confirms that it is responsible
for risk management, internal control, integrity and
compliance systems and has reviewed the operational
effectiveness of these systems. The Board believes that
the company maintains an adequate and effective system
of risk management and internal control that complies
with the Dutch Code of Corporate Governance and suits
our business needs and structure.
Internal control systems are designed to manage, rather
than eliminate, the risk of failure to achieve business
objectives, and can provide reasonable, but not absolute,
assurance against material misstatement or loss. As
such, the controls are subject to regular review as the
business evolves and changes.
The company views the careful management of risk as a
key management activity. The Board reviews the
effectiveness of the systems of internal control relative to
strategic, financial, operational and compliance risks. The
Board discusses risk management and internal controls
with the Supervisory Board on at least a quarterly basis.
We embed risk management into periodic planning and
internal control mechanisms. A top-down approach is
followed, whereby we identify the major risks that could
affect our business and our preparedness should these
problems arise.
The above however does not imply that we can provide
certainty as to the realisation of business and financial
strategic objectives, nor can the followed approach to
internal control over financial reporting be expected to
prevent or detect all misstatements, errors, fraud or
violation of law or regulations. As such, the controls are
subject to regular review as the business evolves and
changes.
The key features of the systems of internal control are as
follow.
1. Clearly defined lines of accountability and delegation
of authority are in place, together with comprehensive
reporting and analysis against approved budgets.
2. We minimise our operating risk by ensuring that the
appropriate infrastructure, controls, systems and
people are in place throughout the businesses. Key
policies employed in managing operating risk include
segregation of duties, authorisation of transactions,
monitoring, and financial and management reporting.
3. Centralised treasury operations manage the
investment of cash balances and exposure to
currency transaction risks. Treasury policies, risk
limits and monitoring procedures that are approved
annually by the Supervisory Board.
4. A Code of Conduct and a Code of Ethics is accessible
to staff via our intranet site. The Code of Conduct is also
available on the TomTom website (www.tomtom.com).
Assurance on compliance with systems of internal
control, and on their effectiveness, is obtained through
management reviews, control self assessment, internal
audits and testing of certain aspects of the internal
financial control systems by the external auditors during
the course of their audit.
During 2008 we made the following changes to our
internal control systems, which we believe have led to
improvements in our control environment:
• implementation of a new organisational Group
structure consisting of four business units and two
supporting centres
• formation of a Shared Technologies centre, determining
the long-term shared technologies roadmap for driving
the engineering resources across all business units
• restructuring Tele Atlas from a regional to centralised
organisation
• implementation of a new Enterprise Resource
Planning system for the TomTom PND and WORK
business units
• launch of a new financial planning and reporting system;
• adoption of a new help desk system to track
customer returns and to support the return material
authorisation process, and
• integration of the Tele Atlas insurance contracts into
the Group Corporate Insurance portfolio and
implementation of changes to improve coverage and
to identify and mitigate additional areas of risk.
INTERNAL CONTROL OVER FINANCIAL REPORTING
Internal control over financial reporting is a process
designed to provide reasonable, but not absolute,
assurance regarding the reliability of management and
financial reporting, in accordance with generally accepted
accounting principles. Controls over financial reporting
policies and procedures include controls to ensure that:
• commitments and expenditures are appropriately
authorised by management
• records are maintained which accurately and fairly
reflect transactions
• any unauthorised acquisition, use or disposal of the
company’s assets that could have a material effect on
our financial statements would be detected on a
timely basis, and
• transactions are recorded as required to permit the
preparation of financial statements.
Due to inherent limitations, internal controls over financial
reporting may not prevent or detect misstatements. Risk
management and control systems provide reasonable
assurance that the financial reporting does not contain any
material inaccuracies. No material weaknesses were
identified during the year. These systems are deemed to
have functioned properly during the year under review, and
there is currently no indication they will not continue to do
so in the forthcoming period.
STATEMENT WITHIN THE MEANING OF ARTICLE 5:25C (2) (C)
FINANCIAL MARKETS SUPERVISION ACT
The Management Board states that, to the best of their
knowledge,
• the annual Financial Statements give a true and fair
view of the assets, liabilities, financial position and
profit or loss and the undertakings included in the
consolidation taken as a whole, and
• the management report includes a fair review of the
development and performance of the business and the
position of the company and the undertakings included
in the consolidation taken as a whole, together with a
description of the principal risks and uncertainties that
the company faces.
Harold Goddijn, CEO
Marina Wyatt, CFO
Alain De Taeye, member of the Management Board
23 February 2009