Carrefour - 2017 Registration Document

MANAGEMENT’S DISCUSSION AND ANALYSIS AS OF DECEMBER 31, 2017 Internal control system 2017 REGISTRATION DOCUMENT | CARREFOUR 4. 208 Guidance and monitoring of the internal 4.8.2.3.2 control system Continuous monitoring Continuous monitoring is organised so that incidents can be pre-empted or detected as rapidly as possible. Management plays a long-term daily role in the effective implementation of the internal control system. Specifically, it establishes corrective action plans and reports to the Group’s Executive Management on significant malfunctions when necessary. Periodic monitoring Periodic monitoring takes place through managers and operatives, country internal controllers and the Group Internal Audit Department: managers and operatives check that the internal control system ● is working correctly, identify the main risk incidents, draw up action plans and ensure that the internal control system is appropriate in view of the Group’s objectives; the country internal controllers periodically check that control ● activities are being properly implemented and that they are effective against risks. Control activities are defined and implemented by process managers, coordinated by internal controllers who report to members of the Country Executive Committee and to the Country Executive Director. Coordination by the internal controllers ensures consistency in control activity methodology and guarantees comprehensive coverage of all risks across all processes; the Group Internal audit department provides the Country ● Executive management teams, the Accounts Committee and the Group’s Executive Management with the findings of their engagement and their recommendations. Furthermore, the Statutory Auditors report on any significant internal control failings they have identified during their engagement concerning the procedures relating to the preparation and processing of accounting and financial information. Each Country Executive Director has established a formal annual self-assessment process: the process uses standard tools that focus on existing ● frameworks and are based on an internal control risk analysis for each activity and on the identification of key control points; the results of the internal control self-assessment covering asset ● risks are centralised periodically at Group internal audit level; one of the Group Internal Audit Department’s objectives in ● implementing actions is the quantitative measurement, through scoring systems, of the divergence between the self-assessment and the level of internal control determined on the basis of its work. Monitoring these divergences makes it possible to gauge the quality of the country’s internal control self-assessment. Guidance and supervision of the internal control system involve the monitoring, by the country internal controllers, of the action plans relating to the internal control self-assessment and risk mapping processes and of the recommendations of the Group Internal Audit Department. The monitoring of action plans covering asset risks is centralised periodically at the level of the Group Internal Audit Department. As an additional step in the guidance and supervision system, the Country Executive Director signs a letter of affirmation on the internal control system, confirming his or her appropriation of and responsibility for internal control in terms of reporting and correcting deficiencies. The Group’s Executive Management supervises the internal control system in particular by reviewing the minutes of meetings of the following bodies and departments: Group Ethics Committee; ● Group Investment Committee; ● Data Security Committee; ● IT Request Management Committee; ● financial committees that guide the Group’s financial policy; ● Antigaspi Committee; ● Group Information Systems Department; ● Group Internal Audit Department; ● Group Risks & Compliance Department; ● any other ad hoc committee meeting convened according to ● the needs identified by the Group’s Executive Management. Lastly, the Accounts Committee established by the Board of Directors monitors the effectiveness of the internal control and risk management systems. Its role is described above.