102 / 266
102 2014 Registration Document
Corporate governance
3
Internal control
In operational terms, the Group Risk and Compliance department
coordinates and leads a network of Risk Prevention directors present
in all Group countries. During 2011, Carrefour communicated a Risk
Prevention Charter which defines the scope of action, the role and
responsibilities of the country-level Risk Prevention units, and the ethical
rules they must follow.
In each country where the Group operates, a Risk Prevention department
is responsible for the security of the Company’s tangible and intangible
assets and ensures the safety of persons present on its sites. It is tasked
with implementing the human, organisational and technical resources
necessary to manage both accidental and intentional risks (natural
disasters, malicious acts, theft etc.).
The safety of persons and property is one of the essential elements of
the risk management system, ensuring:
■
protection suitable for the Group’s clients, employees, service providers
and sites;
■
regulatory compliance of sites throughout the country where the Group
does business;
■
protection and enhancement of the Company’s image and reputation.
The prevention policy relies on risk mapping, loss analysis and identification
of emerging risks as part of its ongoing oversight and specific studies.
The Risk and Compliance department prepares a consolidated annual
report on the risk prevention function at Group level, with benchmarks
between management and performance indicators for the function in
each country, in terms of loss, workforce, resources and action plans.
An alarm and crisis management system is set up by each country
executive director through a formalized crisis management organization
that deals with the major scenarios likely to affect the continuity of
operations.
For the past several years, the Group’s insurance strategy has focused
on providing the best possible protection for people and property.
The Group’s insurance strategy is primarily based on identifying insurable
risks through a regular review of existing and emerging risks, in close
collaboration with operational managers, the various Carrefour group
departments involved and outside specialists.
The Group’s Insurance department is responsible for covering insurable
risks for the entities when national legislation permits it. It is in charge
of the subscription and centralised management of insurance policies.
◗
E. Control activities covering these risks
Control activities are designed to ensure that the necessary measures
are taken in order to reduce exposure to the strategic, operational and
asset risks – likely to affect the achievement of the Group’s objectives.
Control activities take place throughout the organization, at every level
and in every function, including prevention and detection controls, manual
and IT controls and hierarchical controls.
The Group’s regulatory framework is aimed at covering asset risks and
include:
■
accounting and financial risks;
■
risks associated with the safety and security of property and people;
■
risks to the continuity, integrity, confidentiality and security of information
systems;
■
contractual obligation, compliance and communication risks.
Control activities are defined and implemented by process managers,
coordinated by internal controllers who report to members of the
Country Executive Committee and to the country executive director.
Coordination of the internal controllers ensures that control activities are
methodologically consistent and that risks are comprehensively covered
throughout all processes.
Details of internal-control procedures relating to the preparation and
processing of accounting and financial information for the corporate
and Consolidated Financial Statements are provided in Section 3.6.2.
◗
F. Guidance and monitoring of the internal-
control system and risk management system
◗
Continuous monitoring
Continuous monitoring is organized so that incidents can be pre-empted
or detected as rapidly as possible. The framework plays a long-term
daily role in the effective implementation of the internal-control system.
Specifically, it establishes corrective action plans and reports to general
management on significant malfunctions when necessary.
◗
Periodic monitoring
Periodic monitoring takes place through managers and operatives, internal
country controllers and the Group Internal Audit department:
■
managers and operatives check that the internal-control and risk-
management system is functioning correctly, identify the main risk
incidents, draw up action plans and ensure that the control and risk-
management system is appropriate for the Company’s objectives;
■
the internal country controllers periodically check that control activities
are being properly implemented and that they are effective against risks;
■
the Group Internal Audit department provides the country executive
directors and Group general management with the results of their
assignments and their recommendations.
In addition, the operational effectiveness of internal control relevant to
the preparation of the financial information is subject to audit work by
the auditors, which report their conclusions and recommendations to the
country executive directors and Group general management.