GSK Annual Report 2002

36 GlaxoSmithKline Corporate governance
Having considered the Audit Committee reports on the
effectiveness of controls, the Board believes that the system
of internal controls provides reasonable although not absolute
assurance against material misstatement or loss. The process
accords with the guidance on internal control issued by the
Turnbull Committee in 1999.
The Audit Committee also keeps under review the scope and
results of the external audit and the independence and objectivity
of the external auditors. The Committee reviewed the nature and
extent of non-audit services the external auditors provided during
2002 to ensure that the services were not so significant as to call
into question the auditors’ independence from the Group. With
effect from 1st January 2003 the Committee will pre-approve all
non-audit services to be provided by the external auditors.
The Corporate Social Responsibility Committee of the Board
reviews, amongst other matters, external issues that have the
potential for serious impact upon the Group’s business and
reputation and as such forms part of the internal control
framework.
Management structure
The Board has overall responsibility for ensuring that the Group is
appropriately managed and achieves the strategic objectives agreed
by the Board. To enable it to exercise this responsibility, the Board
requires from management information concerning the business,
including relevant information on risk exposures, internal controls
and external developments. The CEO reports to the Board and is
responsible for the management of the Group. To assist him in this
task, the CEO has established the CET, which is not a Committee
of the Board. Key functional activities and management sectors
are represented on the CET.
The internal control framework includes central direction, resource
allocation, and risk management of the key activities of research
and development, manufacturing, marketing and sales, legal,
human resources, information systems, and financial practice. As
part of this framework there is a comprehensive planning system
with an annual budget approved by the Board. The results of
operating units are reported monthly and compared to the
budget. Forecasts are prepared regularly during the year. Extensive
financial controls, procedures, self-assessment exercises and risk
mitigation activities are reviewed by the Group’s internal auditors.
Commercial and financial responsibility, however, is clearly
delegated to local business units, supported by a regional
management structure. These principles are designed to provide
an environment of central leadership coupled with local operating
autonomy as the framework for the exercise of accountability and
control within the Group.
The Group also attaches importance to clear principles and
procedures designed to achieve appropriate accountability and
control. A corporate policy, ‘Risk Management and Legal
Compliance’, mandates that business units establish processes
for managing risks significant to their businesses and the Group.
In a number of risk areas, specific standards that meet or exceed
requirements of applicable law have been established.
Specialist audit and compliance groups (for example Corporate
Environment, Health and Safety and Worldwide Regulatory
Compliance) assist in the dissemination and implementation of
and carry out audits of these standards.
Risk Oversight and Compliance Council (ROCC)
The ROCC is a council of senior executives authorised by the Board
to oversee the risk management and internal control activities of
the Group and to ensure that business units have designated
managers to manage significant risks. Membership comprises
several members of the CET and the heads of departments with
internal control, risk management, audit, or compliance
responsibilities. The ROCC’s responsibilities also include ensuring
that regular analysis is carried out to identify gaps in internal
controls and providing reports to the CET and Audit Committee in
addition to the separate reports provided by individual internal
control, audit, and compliance departments. A direct reporting line
to the Audit Committee provides a mechanism for bypassing the
executive management if irregularities are ever identified.
The internal control framework relies on the ROCC, as well as
sector and other business unit Risk Management and Compliance
Boards (RMCBs), to help identify risks and to provide guidance to
the risk management and compliance initiatives at the corporate
and business unit levels. The ROCC meets regularly to review and
assess significant risks and mitigation plans directed against those
risks. The ROCC has developed the corporate policy referred to
above and provided the business units with a framework for risk
management and for reporting risks to management and the
ROCC. Mitigation planning and identification of a manager with
overall responsibility for management of any given risk is a
requirement. While the ROCC oversees many of the risks deemed
significant to GlaxoSmithKline, each RMCB oversees risks important
to its business or function, thus increasing the number of risks that
are actively managed across the Group. The ROCC is supported by
the Corporate Ethics & Compliance department.
Corporate Ethics & Compliance
The Corporate Ethics & Compliance department is responsible for
supporting the development and implementation of practices that
facilitate employees’ compliance with laws and Group policy.
The thrust of the Group’s compliance effort is due diligence in
preventing and detecting misconduct and non-compliance with
law or regulation by promoting ethical behaviour, compliance with
all laws and regulations, corporate responsibility at all levels, and
effective compliance systems. Compliance officers support the
Group’s main operating sectors of R&D, Manufacturing,
Pharmaceuticals, and Consumer Healthcare. The Corporate
Compliance Officer chairs the ROCC, coordinates some of the
risk management activities among the various compliance and
audit functions across the Group, and provides summary reports
on the ROCC’s activities and the Group’s significant risks to the
Audit Committee on a regular basis.
Areas of potentially significant risks
Areas of potentially significant risk that are subject to regular
reporting to and by the ROCC include the following. Further
details of the risks affecting the Group may be found in Note 30
to the Financial statements, ‘Legal proceedings’ and in
‘Risk factors’ on pages 64 and 65.
Human resources
The legal requirements regarding discrimination and harassment,
the integrity of the workforce, including pre-employment screening,
and the control and use of contractors and temporary staff are
risks inherent in a Group with over 100,000 employees.