Corporate Governance

Internal Control

The board is responsible for the group's system of internal control and for reviewing its effectiveness. There is an ongoing process for identifying, evaluating and managing the significant risks faced by the group and this has been in place for the year under review and up to the date of approval of the annual report and accounts. Strategic, financial, commercial, operational, social, environmental and ethical risks fall within the scope of this process. The process is designed to manage rather than eliminate the risk of failure to achieve business and can only provide reasonable, not absolute, assurance, against material misstatement or loss. During the financial year, material joint ventures have been dealt with as part of the group for the purposes of applying the guidance. Associates have not been dealt with as part of the group for this purpose.

The group's risk management process is intended to be comprehensive, systematic and continuous, and based on constant monitoring of business risk. The key features of the process include the following:

The main risks facing the group are identified and recorded in the strategic risk register together with the control mechanisms applicable to each risk. These are collated from risk registers maintained by individual businesses.
There is clear allocation of management responsibility for risk identification, recording, analysis and control.
The audit committee generally meets four times each year and reviews the effectiveness of the systems which are in place and reports to the board.
A risk management forum, chaired by the group finance controller, has been established with formal terms of reference comprising of senior management from key disciplines and operating companies. It advises and assists operational managing directors and the board in the implementation of the risk management process and monitors risk on behalf of the board. It reports to the audit committee.
Business units are required to report annually on principal business risks and the operation of control mechanisms.
The group audit and business services department provides objective assurance and advice on risk management and control, and monitors the risk management process.
Comprehensive and well defined control policies are formally set out in the company's policies and procedures manual.

The board confirms that it has reviewed the effectiveness of the system of internal control. It has received the reports of the audit committee and has conducted a formal annual review covering all controls including financial, operational and compliance controls and risk management, in accordance with the Internal Control: Guidance for Directors on the Combined Code issued in September 1999.