Annual Report 2012 - IOI Group

MONITORING• The Group’s policies and procedures are reviewed and revisedperiodically to meet changing business and operationalneeds and regulatory requirements.• Board meetings are held at least on a quarterly basis with aformal agenda on matters for discussion. In addition, regularmanagement and operation meetings are conducted bysenior management which comprises Executive Directors anddivisional heads.• The Group’s Internal Audit function monitors compliancewith the Group’s policies and procedures and applicable lawsand regulations, and provides independent assurance on theadequacy and effectiveness of risk management and internalcontrols by conducting regular audits and continuousassessment. Significant audit findings and recommendationsfor improvement are highlighted to senior management andthe Audit and Risk Management Committee, with periodicfollow-up reviews of the implementation of corrective actionplans.REVIEW FOR THE PERIODFor the period under review, each business unit, cutting across allgeographic areas, via its respective Risk Management Committeesand workgroups comprising personnel at all levels carried out thefollowing areas of work:• Conducted reviews and updates of risk profiles includingemerging risks and re-rated principal risks.• Reviewed implementation progress of previously outlinedactionable programs, and evaluated post-implementationeffectiveness.• Reviewed the adequacy of all business resumption andcontingency plans, and their readiness for rapid deployment.The Board is pleased to conclude that the state of the Group’sInternal Control System is generally adequate and effective. Forthe financial year under review there were no material controlfailures or adverse compliance events that have directly resulted inany material loss to the Group. The Board’s conclusion is reachedbased on the following:• Regular internal audit reports and periodic discussions withthe Audit and Risk Management Committee.• Bi-annual risk reviews compiled by the respective units’ RiskManagement Committees that are presented and discussedwith the Audit and Risk Management Committee, the Board,internal auditors, and external auditors at least once a year.• Operating units’ CEO/CFO’s Internal Control Certification andAssessment disclosure.• Operating unit’s response to the Questionnaire on Controland Regulations.• Periodic management reports on the state of the Group’saffairs which also covers the state of internal controls.• Evaluated the adequacy of key processes, systems, andinternal controls in relation to the rated principal risks, andestablished strategic responses, actionable programs andtasks to manage the aforementioned and/or eliminateperformance gaps.• Ensured internal audit programs covered identified principalrisks. Audit findings throughout the financial period served askey feedback to validate effectiveness of risk managementactivities and embedded internal controls.96IOI CORPORATION BERHADAnnual Report 2012