Annual Report 2012 - IOI Group

ii)Risk Management as a collective responsibilityBy engaging every level of the organisation as risk owners oftheir immediate sphere of risks (as shown in the illustration),the Group aims to approach risk management holistically.This is managed through an oversight structure involving theBoard, Audit and Risk Management Committee, InternalAudit, Executive Management and business units’ RiskManagement Committees.• Board committees such as the Audit and Risk ManagementCommittee, Nominating Committee and RemunerationCommittee are established by the Board of Directors, andthey are governed by clearly defined terms of reference andauthority for areas within their scope.• The Group has an organisational structure that is alignedwith its business and operational requirements, with clearlydefined lines of responsibility and authority levels.iii)iv)Risk forbearance shall not exceed capabilities and capacityto manageAny business risk to be assumed shall be within the Group’score competencies to manage. Hence, the continuous effortin building of risk management capabilities and capacity arekey components of the Group’s ERM effort. The Group’soverall risk appetite is based on assessments of the Group’srisk management capabilities and capacity.To apply as both a control and strategic toolAs a control tool, the Group ensures that the intensity andtypes of controls commensurate with assessed risk rankings.The Group also applies risk management as a strategic toolin scoping opportunities, investment and resource allocation,strategy formulation and performance measurement.The Board conducts periodic reviews on the adequacy and integrityof the Group’s ERM framework and policies, particularly in relationto the mechanisms for principal risks identification, assessment,response and control, communication and monitoring.CONTROL ENVIRONMENT• The Group’s corporate culture are embedded in its corevalues of integrity, commitment, loyalty, excellence inexecution, speed or timeliness, innovativeness and costefficiency – to achieve the Group’s vision and support thebusiness objectives, risk management and internal controlsystem.CONTROL ACTIVITIES• Policies and procedures have been established for keybusiness processes and support functions. The Group has inplace a system to ensure that there are adequate riskmanagement, financial and operational policies, proceduresand rules relating to the delegation and segregation ofduties.• Annual business plans and operating budgets are preparedby business and operating units, and are approved by theBoard. Actual performance and significant variances againstbudget are monitored on an ongoing basis.INFORMATION AND COMMUNICATIONPROCESSES• Management and the Board receive timely, relevant andreliable management and financial reports which are reviewedon a regular basis.• The Group has in place a Management Information Systemthat captures, compiles, analyses and reports relevant data,which enables management to make business decisions in anaccurate and timely manner.• A code of business conduct reinforces the Group’s core valueon integrity by providing guidance on moral and ethicalbehaviour that is expected from all employees in followingthe laws, policies, standards and procedures.Annual Report 2012IOI CORPORATION BERHAD 95