registration document France Telecom 2009 - Orange.com

14 INTERNAL
administrative and management bodies and senior management
CONTROL AND RISK MANAGEMENT
14.3.2 Internal control systems
Identifying major risks
Each Group Operations Division (France, Poland, Spain, United
Kingdom, EME, AMEA, Business) identifi es the major risks for
its scope, at least once a year. The identifi cation of the risks,
completed by a description of actions plans designed to hedge
these risks, makes up the risk map of each Division.
Changes in the list of these risks and monitoring of the
implementation of the action plans are examined in internal
control reviews and in an annual examination by the Risk
Committee.
Detecting and handling internal fraud
Detecting cases of fraud is the responsibility of management,
assisted by tools that detect anomalies for the highest risks.
An whistle-blowing policy , pursuant to the Sarbanes-Oxley
law, is in place and includes the recommendations published
by the CNIL. This mechanism allows any employee to report,
via a dedicated email address, any actions that may constitute
infractions or fraud, especially in the areas of accounting, internal
control and audit. The procedure defi ned ensures confi dential
and independent treatment of the alerts, guaranteeing
protection for the employees.
When fraud is strongly suspected, investigations are generally
entrusted to specialists, in particular to General Control.
Results from investigations have indicated three priority areas
for implementing actions to prevent fraud: contracts, fi nancial
fl ows and possible management failures.
Generally, the investigative departments are responsible for
establishing the facts. With respect to internal Company
matters, it is left to management to decide on penalties.
In all cases found, the legal, civil or criminal consequences are
considered after an opinion from the legal department.
Development of internal control selfassessment
Self-assessment is a program initiated by the Group Internal
Control department, carried out by certain operating units
to assess the quality of their operations with regards to the
Group’s internal control. This program centers on a formalized,
standardized procedure enabling management to identify and
take responsibility for the improvements that need to be made
in terms of internal control and to take the corrective action. It
includes a prior phase of risk identifi cation and analysis at the
local level.
The internal audits ensure that the process and the action plans
implemented are effective.
Financial internal control procedures
The fi nancial internal control procedures are based on a
set of specifi c procedures on how accounting and fi nancial
information is prepared and processed (see Section 14.3.3
Internal control procedures relating to the preparation and
processing of accounting and fi nancial information) and on the
internal control procedures implemented under the Sarbanes-
Oxley law (see Section 14.3.4 Summary of work on internal
control implemented under Section 404 of the Sarbanes-Oxley
Law)
Internal control reviews
Internal control reviews provide annual, general checks on the
proper implementation of the internal control system by the
entities, with a review of the conclusions from the previous
year’s efforts and the objectives for the current year.
These reviews are presented by entity management to the
corresponding Executive Director, as well as to the Group
Internal Control department, Audit and Risk Management
department and the Fraud Prevention and Revenue Assurance
department.
They cover the following topics:
■ governance;
■ risk management;
■ preventing, detecting and handling fraud;
■ the internal control system, especially fi nancial controls;
■ the audit program and cross-divisional projects (quality,
process improvement, etc.).
They include the fi ndings of the internal audit, those by the
Statutory Auditors, a follow-up on the Statutory Auditors’
recommendations, and a judgment about the year’s auditing
programs.
14.3.3 Specific internal control
procedures for the preparation
and processing of accounting
and financial information
The internal control of accounting and fi nancial information is
organized on the following bases:
■ the Disclosure Committee (see Section 14.2.5 Group
governance committees);
■ the Group’s accounting and controlling function (see
Section 14.3.1.2 Main functions involved in steering internal
control);
■ unifi ed accounting and management reporting;
■ the accounting standards and methods common to the
entire Group.
306
2009 REGISTRATION DOCUMENT / FRANCE TELECOM