Annual Accounts and Report as at 30 June 2011 Draft - Mediobanca

RISK MANAGEMENT AND INTERNAL ICONTROL SYSTEM FOR FINANCIALREPORTING PROCESSMediobanca has equipped itself with an internal control system for accountingand financial reporting requirements based on benchmark standards which arewidely accepted at international levels (COSO and COBIT framework) ( 1 ). The systemprovides for:– company level controls: controls to ensure that general and supervisoryregulations are complied with in the running of the business, which are thenorms, regulations and control mechanisms in force at Group level. Companylevel controls regard the organization of the company and impact on the methodsby which the financial reporting and disclosure objectives are reached.– administrative/accounting model: organizational processes (operators,activities, risks and controls) which generate the most significant earningsand asset figures included in the financial statements and informationdisclosed to the market.– general IT controls: general rules governing technologies and applicationsdevelopments which are common to the architectures and IT applicationsused to generate financial reporting.The system has been constructed and is applied based on a rationale ofrelevance to Group companies, accounts and processes.Control activity is carried out via two distinct methods according to theprocess involved:– test of controls, strictly for accounting processes, and performed by theInternal Audit unit;– test of controls for non-accounting processes (chiefly those affecting theFront, Middle and Back Office areas), performed by the person responsiblefor the process itself on a self-assessment basis and checked by the head ofthe relevant area.The Internal Audit unit ascertains annually that the tests carried out on aself-assessment basis have been performed in accordance with the relevantmethodologies.1) The COSO Framework has been drawn up by the Committee of Sponsoring Organizations of the TreadwayCommission, a US organization whose objective is to improve corporate reporting, via the definition ofethical standards and a system of corporate governance and effective organization; the COBIT Framework-Control Objectives for IT and related technology is a set of rules prepared by the IT Governance Institute,another US organization whose objective is to set and improve corporate standards in the IT sector.– 567