103 / 266
103
2014 Registration Document
Corporate governance
3
Internal control
Each country executive director has established a formal annual self-
assessment process:
■
which uses standard tools that focus on existing frameworks and
are based on an internal-control risk analysis for each activity and on
identification of key control points;
■
the results of the internal-control self-assessment covering asset risks
are centralized periodically at Group Internal Audit level;
■
one of the Group Internal Audit department’s objectives in implementing
actions is the quantitative measurement, through scoring systems,
of the divergence between the self-assessment and the level of
internal control determined on the basis of its work. Monitoring these
divergences allows the quality of the country’s internal-control self-
assessment to be gauged.
Guidance and supervision of internal control entails internal country
controllers’ monitoring of action plans relating to the internal-control self-
assessment and risk mapping processes and of the recommendations of
the Group Internal Audit department. The results of the internal-control
self-assessment covering asset risks are centralized periodically at Group
Internal Audit level.
The final result of the supervision and guidance system is a letter of
affirmation on risk management and internal control signed by the
country executive director and the, confirming their appropriation of
and responsibility for internal control in terms of reporting and correcting
deficiencies.
Group general management supervises the internal-control and risk-
management system in particular through the minutes of meetings of
the following bodies and departments:
■
the Ethics Committee;
■
the Group Investment Committee;
■
the IT Request Management Committee;
■
Financial committees that guide the Group’s financial policy;
■
the Information Systems Governance department;
■
the Group Internal Audit department;
■
any other
ad hoc
committee meeting convened according to the needs
identified by general management.
Lastly, the performance of the internal-control supervision and guidance
system for accounting and financial risks is presented regularly to the
Accounts Committee.
3.6.1.2
Entities and individuals involved
in internal control and risk
management
◗
A.
At Group level
Group general management
is responsible for the internal-control and
risk-management systems. It is also tasked with designing, implementing
and supervising the internal-control and risk-management systems suited
to the size of the Group, its activity and its organization.
It initiates any corrective actions necessary to rectify an identified
malfunction and to maintain a situation within the limits of acceptable
risk. It ensures that these actions are successfully implemented.
General management performs its duties, in relation to the internal-control
and risk-management systems, which also include defining the roles and
responsibilities in that regard in the Group.
Group general management has created the following structure:
■
the
Group Finance department
is responsible for:
■
maintaining the reliability of financial and accounting information,
■
controlling accounting and financial risks,
■
measuring Group performance and budget control,
■
fofollowing Group investment procedure;
■
the
Group Legal department
is responsible for:
■
the governance policy for legal services,
■
establishing the governance policy of Group subsidiaries,
■
managing the Group’s legal risks;
■
the
Group Risks & Compliance department
is responsible for:
■
identifying, analysing, evaluating and treating risks within the Group
in support of the country executive directors,
■
company-wide risk prevention policy,
■
managing risks associated with the safety and security of property
and people,
■
leading the Groupe ethic system,
■
coordinating the Group crisis-management system;
■
the
Group Property department
is responsible for:
■
establishing the Group’s property policy,
■
managing risks relating to building security;
■
the G
roup Quality department
is responsible for:
■
establishing product quality, health and safety policy within the
Group,
■
managing product safety risks,
■
coordinating crisis management relating to product safety risks;
■
the
Group Human Resources department
is responsible for:
■
establishing human resources security policy within the Group,
■
coordinating social risk management;
■
the
Group Information Systems Governance department
is
responsible for:
■
establishing the information systems management policy within
the Group,
■
managing risks relating to the continuity, integrity, confidentiality
and security of information systems;
■
the
Group Insurance department
is responsible for setting up
insurance to cover the Group’s insurable assets as effectively as
possible and according to available capacity on the market, pursuant
to Group insurance policies. It works with the Risks & Compliance in
transferring of a portion of the risks to the insurance market.