292 / 364
DANONE
REGISTRATION DOCUMENT 2015
Corporate Governance
6.4 Internal control and risk management
292
DANgo to be used by those in the various functions and allows
the framework to be enhanced through best operating practices;
•
in addition to DANgo, an intranet site for Danone's internal con-
trollers and communities set up on the Danone Social Network
present all the documents useful for internal control and contribute
to the sharing of experiences and best practices in the area of
internal control. These documents may also be accessed by all
Danone employees and are updated regularly;
•
the writing and distribution of internal control guidelines, which
were reviewed in 2015.
Risk identification and assessment
Every company faces internal and external risks that may hinder the
achievement of its objectives. The principal risks to which Danone
believes it is exposed as of the date of this Registration Document
are described in section 2.7
Risk Factors
.
Danone has established a system for identifying and managing
risks based on two distinct systematic risk identification processes.
Operational risks
The first process for risk identification and management focuses
on operational risks related to the company's current activity and
deficiencies identified by the internal control review (through the
self-assessment and testing of control indicators, see section
Internal
Control Department
above). A local standardized mapping of these
deficiencies (Internal Control Deficiencies Impact Mapping) at the
level of each operating unit makes it possible to classify them based
on two categories qualifying (i) their potential financial impact on the
company and (ii) the expected difficulty in resolving the deficiency
under consideration. This mapping may then be used at different
levels of the organization (management committee of the operating
unit, region, division, function, etc.) as a prioritization tool for action
plans to be implemented in order to reduce the identified risk.
Strategic risks
The second risk identification and management process focuses
on strategic risks and takes the form of a risk mapping hierarchy
based on their likelihood of occurrence and their estimated impact
on the Company.
Methodology
This risk mapping is prepared and updated semi-annually by the
Company Finance Department. The following methodology is used:
•
identification of the risks and weaknesses considered strategic
and/or structural of all activities of the subsidiaries covered;
•
consolidation of the risks identified as material by Division and
integration of systemic risks not perceptible at the subsidiary level;
•
consolidation of the major risks of the Divisions at the Company
level and integration of systemic risks not perceptible at the
Division level;
•
ranking of risks based on their likelihood of occurrence and
estimated financial impact, at the level of a country, a Division
or the Company;
•
determination of preventive or corrective actions, which may be
local or global depending on the case.
Risk monitoring
For each Division, the most significant risks are reviewed twice
a year by the Division managers and Danone's Finance Control
Director, who is also responsible for internal control, at special
meetings attended by the general manager and finance director
of each Division.
A review of the most significant risks is also presented twice a year
by Danone's Finance Control Director to the Chief Executive Officer
and the Chief Financial Officer. A mapping of Danone's major risks
is assessed during these meetings, risk owners are systematically
designated, and risk mitigation plans are reviewed and assessed.
This work serves as the basis for the presentationsmade to Danone's
Executive Committee and Audit Committee.
Other elements of the Danone's organization that contribute to
risk identification and analysis
The existence of procedures – regarding themonitoring of competition,
training, risk prevention and protection, etc. – and the initiatives taken
by specialized departments – such as the Environment Department
and the Quality and Safety Department for food – contribute to the
identification and analysis of risks.
The Safety Department also helps to identify threats against Danone's
employees and assets.
In addition, the Crisis Management Department uses information
made available by the risk maps established at each Division level to
identify potential crises and prepare the affected entities accordingly,
ensuring that an appropriate response is provided for all crises,
even if the related risk was not previously identified.
The identification and reporting of risks is also facilitated by the
relatively low number of reporting levels within the Group, short
decision-making channels and input from the operating units in
strategic discussions. In addition, the Compliance Committee,
a quarterly cross-functional committee led by the Compliance
Department since 2015, was set up to deal with compliance issues.
Since 2006, various central functions that collaborate on the quality
of the control environment participate in this process.
Control activities
Control activities are intended to ensure the application of the
standards, procedures and recommendations that contribute to
the implementation of General Management's policies.
All the subsidiaries integrated into the DANgo scope use an annual
self-assessment process. The largest of them follow amore detailed
internal control reviewmethodology that includes information flows,
control points and tests conducted by management:
•
the IT application that hosts the DANgo system allows subsid-
iaries to perform self-assessments and determine whether they
are compliant with Danone's internal control framework. It also
makes it possible to monitor any action plan that may be needed;
•
the results of the subsidiaries' DANgo self-assessment campaign
are sent periodically to the Internal Control Department, which
analyzes them and sends relevant summaries to the various
stakeholders. Appropriate action plans are put in place by the
entities under the supervision of the Internal Control Department
with a goal of continuous improvement and internal audits are
subsequently carried out to validate that corrective measures
have indeed been taken.
In addition, the performances and results of each operating unit
in the area of internal control are regularly and systematically
monitored by the entities' Management Committees.