Annual Report - QuamIR

Corporate Governance Report (Continued)
Control processes
The Board establishes and maintains a sound internal control system through
the following major processes:
(i) Systems and procedures are in place to identify and measure risks on
an ongoing basis. Senior management reviews and defines the risk
assessment process and monitor the progress of risk mitigation plans.
(i)
(ii) An organization structure with defined lines of responsibility and
delegation of authority is devised.
(ii)
(iii) The Board reviews its strategic plans and objectives on an annual basis.
(iii)
(iv) Financial performance is analysed against budget with variances being
accounted for and appropriate actions are taken to rectify deficiencies.
(iv)
(v) Policies and procedures on key control activities are established to ensure
management directives are carried out.
(v)
(vi) Ranges of activities including approvals, authorization, verifications,
recommendations, performance reviews, asset security and segregation
of duties are identified and implemented.
(vi)
(vii) The ICRM Department conducts independent reviews on the effectiveness
of the Group’s internal control system and tests key business processes
and controls in accordance with its audit plan, including following up the
implementation of management actions. The ICRM Department reports
directly to the Audit Committee and the CEO and has direct access to the
Board through the Audit Committee.
Review of internal control effectiveness
The Board is responsible for maintaining sound and effective internal
control system for the Group and for reviewing its effectiveness. The ICRM
Department reports on reviews of the business processes and control
activities, including action plans to address any identified control weaknesses.
The management evaluates and conducts assessments of the overall internal
control and risk management systems, with action plans to make further
improvement. External auditors also report on any control issues identified in
the course of their work. Taking these into consideration, the Audit Committee
reviews the effectiveness of the Group’s internal control system at least once
each year and reports to the Board on such reviews.
(vii)
•
23