32 / 364
Overview of activities, risk factors
2.7 Risk factors
DANONE
REGISTRATION DOCUMENT 2015
32
RISK IDENTIFICATION
RISK MONITORING AND MANAGEMENT
Information systems
Danone is increasingly dependent upon common infrastructures
and information technology applications for all its business
activities. The main risks are related to the availability of infor-
mation technology services and the confidentiality and integrity
of data. Any failure of these infrastructures, applications or
data communication networks, any interruption linked to the
failure of security of data centers or networks as well as any
accidental or intentional loss of data and any use of data by
third parties, could block or slow down production or sales,
delay or taint certain decisions and, more generally, have an
adverse effect on Danone's activities and results.
In addition, most of the former Numico subsidiaries, as well as
the more recently acquired Unimilk group's companies, rely
on different information systems, specific to certain subsidia-
ries, which may increase the complexity of the monitoring and
management of these risks by Danone.
Danone's policy is to consolidate data centers. In particular,
Danone's central applications are hosted in a highly-secured
data center managed by IBM.
In addition, Danone is developing and implementing specific
information systems (Themis, Artemis, etc.) in its subsidiaries
to optimize and streamline information technology investment
while promoting global synergies and reducing risks. The
former Numico and Unimilk subsidiaries are gradually bene-
fitting from the implementation of Themis, Danone's integrated
information system.
Internal control deficiency
The risk of an internal control deficiency is mainly associated
with (i) reliability of financial information, (ii) compliance with
the applicable laws, regulations and internal policies, and (iii)
efficiency and effectiveness of internal processes, including
those related to the protection of the Company's assets.
If Danone's internal control systems were to experience defi-
ciencies or prove to be inadequate, particularly in the area of
fraud, the quality of its financial information, the ability of its
executives to take the correct decisions and, more generally,
its results, could be adversely affected.
Danone has implemented an internal control system, which is
described in section 6.4
Internal control and risk management
.
Regardless of how adequate it may be, this system can only
provide reasonable assurance and not an absolute guarantee
with respect to the achievement of the company's objectives,
given the limitations inherent in any control process. While
Danone cannot fully exclude the risk of an internal control
failure, the performance level and widespread deployment of
its five internal control components (Control environment, Risk
identification and assessment, Control activities, Information
and communication, and Continuous monitoring) reduce
Danone's exposure to this risk (see section 6.4
Internal control
and risk management
).
Similarly, Danone cannot exclude all risks associated with fraud.
However, the risk profile of its activities and the existence of a
widely disseminated anti-fraud program that covers all aspects
for reducing the risk of fraud or the potential impact of any
fraud (awareness, prevention, detection, investigation, penalty,
reporting and continuous improvements of the internal control
system) (see section 6.4
Internal control and risk management
)
limit Danone's exposure to this risk.
Insurance coverage deficiency
Danone's insurance coverage could be insufficient and/or
Danone could be unable to renew its insurance programs on
acceptable terms, which could have an adverse effect on its
financial situation and results.
See section
Insurance and risk coverage
hereafter.