john-lewis-partnership-plc-annual-report-2015

Annual Report and Accounts 2015 John Lewis Partnership plc 107
Risk management and
internal audit activities
The Partnership Board has ultimate
responsibility for the Partnership’s system
of internal control and risk management and
reviewing its effectiveness.
The Partnership Board delegates the
monitoring of internal control and risk
management processes to the Committee.
The Committee seeks assurance from
the work of the Group Risk Management,
and Internal Audit and Operational Risk
Management departments, which provide
objective assurance on the effectiveness of
those arrangements through the delivery of a
risk-based work plan and risk
management activities.
The Head of Group Risk and the Head
of Internal Audit and Operational Risk
Management report functionally to the Chair
of the Committee and operationally to the
Acting Group Finance Director.
The Partnership’s systems of risk
management and internal control
Risk management
Assessing and managing risk is fundamental to
safeguarding our Partners’ interests, protecting
our reputation, complying with regulatory
standards and achieving our business objectives.
Executive management is responsible for
identifying and evaluating the principal business
risks and for implementing and maintaining
systems for managing those risks in an efficient
and effective manner.
To enable this, the Partnership has developed
a risk management framework, including a
process for how we identify, evaluate, manage
and monitor the principal risks faced by the
Partnership, supported by tools, dedicated
Partners and a risk governance structure.
Further details on this can be found on pages
42 to 43, along with details of our principal risks
and how we mitigate them, on pages 45 to 47.
Strategic, operational, financial and compliance
risk areas are all included within the scope of
these activities.
Internal control
The systems of internal control we have
established are designed to manage, rather than
eliminate, the risk that is inherent in pursuit of
our business objectives. As a consequence, our
internal controls can only provide reasonable,
and not absolute, assurance against material
misstatement or loss.
The Committee monitors the development
of our policies and systems for identifying,
evaluating and managing the principal risks
throughout the Partnership. On a quarterly
basis, the Committee receives an updated
Risk Report on progress on the principal
Partnership risks identified as part of the
business planning process.
Strategic risks
e.g. risk of us “taking the wrong investment decision”
Operational risks
e.g. risk of us “doing the right thing, in the wrong way”
Financial risks
e.g. risk of us “doing things in a way that loses money
or incurs unnecessary liabilities”
Compliance risks
e.g. risk of us “not doing what Regulators require”
The Committee reports regularly to the
Partnership Board, which seeks assurance
that the systems of internal control for
risk management are operating effectively.
Reporting is through management
representations, the work of internal audit
and other means of assurance.
During the year, the Committee focussed on
IT controls including meeting with Divisional IT
Directors to understand plans to strengthen
our IT controls framework. Additionally the
Committee oversaw the updating of the
Partnership’s Internal Controls Framework.
At the end of the year, the Committee
conducted an annual review of the effectiveness
of the risk management framework, supported
by a self certification exercise by management.
During the year and for 2015/16
Strengthening and embedding
our risk management framework
During the year, the Committee has
overseen further strengthening and
embedding of the risk management
framework within the Partnership as part
of a continuous improvement programme.
This included initiating a review by external
consultants of our framework.
Outcome of our actions
In response, new tools have been
developed, new practices implemented
and our risk governance structure has been
refined. These are now in use and provide
a consistent basis across the Partnership
for more efficient identification, evaluation
and communication of emerging risk and
control issues.
Focus areas for 2015/16
In the following year, we plan to formalise
the identification and monitoring of
measures for our principal risks and their
mitigations, to give us better warning of
changes to our risks and the resilience of our
internal controls.
Introduction Partnership difference Principles Strategy Performance Governance Financial statements