Annual Report 2012 - Fingrid

are carried out and verified within the company comprehensively,
effectively, and in accordance with the objectives
set by the Board. The objectives, methods, roles and responsibilities
related to the company’s internal control and risk
management are described in the documents approved by
the company’s Board of Directors.
The Board of Directors of the company is responsible for the
internal control and risk management system and approves
the related principles. The Board of Directors decides on the
corporate strategy and action plan and monitors their implementation.
The executive management defines the principles,
which govern the operations, for the approval of the
Board of Directors, and the executive management enforces
these principles. The audit committee of the Board of Directors
obtains an annual report of the foremost risks pertaining
to the company’s operations and of their management.
The CEO assisted by the executive management group is responsible
for the practical implementation of the company’s
risk management.
The heads of functions own the risks pertaining to the operation
of their area of responsibility and are responsible
for identifying, assessing and controlling the risks, for the
functioning of controls, and for reporting the risks and nonconformities.
Fingrid Oyj’s Board of Directors discusses and approves the
annual budget of the Group, giving those who sign documents
the right to act within the limits of the budget and
decisions in order to conclude agreements. All individual
capital investments decisions which are crucial in terms of
the company’s business or have a cost effect in excess of
10 million euros, and all annual capital investment programmes
in excess of 10 million euros are approved by the
Board of Directors of Fingrid Oyj. Fingrid Oyj’s Board of Directors
approves possible capital investments in excess of 2
million euros outside the budget. After being processed by
the Board of Directors and after being approved, the procurements
can be accepted in accordance with the company’s
acceptance authority if the project has been subjected
to competitive tendering in accordance with Fingrid’s procurement
instructions.
The company’s internal audit examines risk management
and internal control as a party independent of the functions
and processes. The internal auditor monitors issues such as
adherence to the guidelines of the company, acts and official
regulations, and reports his findings to the audit committee.
A comprehensive audit plan has been approved for internal
audit for 2011 to 2013, with the plan to be updated annually.
The audit committee of the Board of Directors examines
the functioning of internal control and reports to the Board
of Directors. The company’s internal audit has been outsourced
to an independent external party. As part of internal
control, internal audit audited processes related to Fingrid’s
balance services, financing, occupational safety, and
comprehensive risk management in 2012.
Operative risk management is based on an annual risk analysis
carried out in connection with the drawing up of action
plans. The heads of the units are responsible for the
identification, reporting and risk management measures of
the operative risks in their respective areas of responsibility.
Responsible persons in each function attend to the implementation
and follow-up of risk management in their areas
of responsibility. The company applies a comprehensive
risk management system, which is being developed further.
The company’s financial administration is specialised in coordinating,
supporting and monitoring the implementation
of risk management in the various functions. The risk management
specialists also advice the various functions whenever
necessary in the planning and implementation of risk
management measures, and the specialists devise risk management
practices and procedures. Moreover, the company’s
support functions - legal department, human resources
management, and communications - support the corporate
functions with their expertise in the implementation of
risk management.
The financial administration of the Group is responsible for
the control structures relating to the financial reporting process.
The external auditor of the company together with the
controllers of the financial function assesses the foremost financial
reporting risks of the main processes.
The CEO is responsible for risk management related to the
corporate-level strategic goals. The strategic risks are identified
as part of the company’s annual strategy work. The
corporate strategy presents the primary corporate-level risks
and the related risk management. The risks are monitored,
co-ordinated and managed by the executive management
group, but each function and/or business process is responsible
for implementing its own risk management. The executive
management group identifies and assesses regularly the
strategic risks pertaining to personnel and expertise, corporate
finances, customers and stakeholders, and business processes.
Moreover, the risks are assessed in view of society
with regard to the functioning of the electricity market, system
security, safety, and the environment.
Foremost risks and factors of uncertainty
The biggest risk in terms of the company and society is a
major disturbance related to the functioning of the power
system. A comprehensive disturbance in the power system
may be caused by several simultaneous faults in the grid,
inoperability of Fingrid’s operation control system, insufficiency
of production capacity, external events, or problems
related to operation support systems or data security,
preventing grid operation entirely or partially. Fingrid
is prepared for a widespread disturbance concerning Finland
or the Nordic power system by making capital investments
in the transmission grid and in reserve power. In its
strategy, the company focuses on the versatile utilisation of
the operation control system, expedited disturbance clearing,
90 FINGRID OYJ