126 / 302
Corporate governance
Internal control
The Group risks and compliance department prepares a consolidated
E. Guidance and monitoring of the internal
annual report on the risk prevention function at Group level, with
control system and risk management system
benchmarks between management and performance indicators for the
Continuous monitoring
function in each country, in terms of loss, workforce, resources and
action plans.
Continuous monitoring is organised so that incidents can be
pre-empted or detected as rapidly as possible. The framework plays a
An alarm and crisis management system is set up by each country
long-term daily role in the effective implementation of the internal
executive director through a formalized crisis management
control and risk management system. Specifically, it establishes
organization that deals with the major scenarios likely to affect the
corrective action plans and reports to general management on
continuity of operations.
significant malfunctions when necessary.
For the past several years, the Group’s insurance strategy has focused
Periodic monitoring
on providing the best possible protection for people and property.
Periodic monitoring takes place through managers and operatives,
The Group’s insurance strategy is primarily based on identifying
internal country controllers and the Group internal audit department:
insurable risks through a regular review of existing and emerging risks,
in close collaboration with operational managers, the various Carrefour
managers and operatives check that the internal-control and
●
group departments involved and outside specialists.
risk-management system is functioning correctly, identify the main
risk incidents, draw up action plans and ensure that the internal
The Group’s insurance department is responsible for covering
control and risk-management system is appropriate for the Group’s
insurable risks for the entities when national legislation permits it. It is
objectives;
in charge of the subscription and centralised management of
insurance policies.
the internal country controllers periodically check that control
●
activities are being properly implemented and that they are effective
D. Control activities covering these risks
against risks;
the Group internal audit department provides the country executive
●
Control activities are designed to ensure that the necessary measures
directors and Group general management with the results of their
are taken in order to reduce exposure to the strategic, operational and
assignments and their recommendations.
asset risks likely to affect the achievement of the Group’s objectives.
In addition, the operational effectiveness of internal control relevant to
Control activities take place throughout the organisation, at every level
the preparation of the financial information is subject to audit work by
and in every function, including prevention and detection controls,
the auditors, which report their conclusions and recommendations to
manual and IT controls and hierarchical controls.
the country executive directors and Group general management.
The Group’s regulatory framework is aimed at covering asset risks and
Each Country executive director has established a formal annual
include:
self-assessment process:
accounting and financial risks;
●
which uses standard tools that focus on existing frameworks and are
●
risks associated with the safety and security of property and people;
●
based on an internal control risk analysis for each activity and on
risks to the continuity, integrity, confidentiality and security of
●
identification of key control points;
information systems;
the results of the internal-control self-assessment covering asset
●
contractual obligation, compliance and communication risks.
●
risks are centralised periodically at Group internal audit level;
Control activities are defined and implemented by process managers,
one of the Group internal audit department’s objectives in
●
coordinated by internal controllers who report to members of the
implementing actions is the quantitative measurement, through
Country Executive Committee and to the Country executive director.
scoring systems, of the divergence between the self-assessment and
Coordination of the internal controllers ensures that control activities
the level of internal control determined on the basis of its work.
are methodologically consistent and that risks are comprehensively
Monitoring these divergences allows the quality of the country’s
covered throughout all processes.
internal-control self-assessment to be gauged.
Details of internal-control procedures relating to the preparation and Guidance and supervision of internal control and risk management
processing of accounting and financial information for the Corporate system entails internal country controllers’ monitoring of action plans
and Consolidated Financial Statements are provided in section
3.6.2.2 relating to the internal control self-assessment and risk mapping
of the present chapter.
processes and of the recommendations of the Group internal audit
department. The results of the internal control self-assessment
covering asset risks are centralised periodically at Group internal audit
level.
126
2015 REGISTRATION DOCUMENT