Annual report 2010 - Dexia.com

Declaration of corporate governanceManagement reportConsolidatedfinancial statementsAdditional information Annual financial statementsIndeed, in 2010, the risk methodology and establishment ofthe audit plan, which were reviewed in 2009, were subjectto improvements and simplifications (particularly for thesubsidiaries), as well as the computerisation of the principalstages.The methodology first of all identifies the objectives of thebusiness lines and the support processes in order then toquantify the impact of major risks which might adversely affectthe achievement of those objectives. Then the audit tasks aretargeted on the more critical subjects in terms of impact andprobability of occurrence. The methods used structure theaudit activity as a support to corporate governance in termsof risk control.The global risk universe approach, the common auditmethodology, the performance of “transversal” tasks ifnecessary, if not local and jointly depending on needs, andthe terms of accounting and monitoring at the level of theGroup parent structure contribute to assessing whether theDexia internal audit system is integrated and efficient and, ifnecessary, to asking for improvements.1. Process of risk analysis and planning audit tasks andresourcesInternal audit at Dexia SA exercises its function on the basisof a single audit plan for the Group defined by the IAEC,approved by the Management Board and then by the AuditCommittee and/or the Board of Directors.This plan is constructed from an annual risk analysisperformed independently by audit in compliance with bestpractices presented by the Institute of Internal Audit. Theprincipal stages leading audit to elaborate its audit plan areas follows:• identification of potential critical risks which might becontrary to the outcome of business line objectives by businessline and support process;• evaluation of the degree of vulnerability of Dexia SA inrelation to those critical risks, via a measure of the impactand probability of occurrence. The results of that evaluationenable more significant risks to be identified;• identification of audit units and audit universes which areeither at the origin of risks or responsible for anticipatingthem, leading to a risk score per audit unit, a score fromwhich a frequency of audit review is deducted;• listing of tasks performed in the past (the last three years)on audit units (back testing);• selection of tasks on risky audit units taking account of tasksperformed in the past and possible regulatory requirements interms of frequency.With a desire for efficiency, the audit plan is targeted onthe more risky audit units, namely those which, through allbusiness lines and all support processes, carry the greatestnumber of risks and/or key controls for the achievement ofobjectives. The audit units which do not carry major risks aresubjected to a simplified approach, responding to regulatoryrequirements to cover the audit universe.This perennial plan enables any resources requirement to bedetermined both from a quantitative and a qualitative pointof view as well as training needs.The audit plan draws a distinction between several types ofaudit tasks:• transversal tasks which are performed on the same sphereof activity in several entities at the same time and relateprincipally to one of the processes with a relatively highdegree of integration;• joint tasks which are performed jointly within an entity bylocal audit teams (if available), with the participation of oneor more auditors from a shared service centre;• local tasks which only relate to a single entity.2. Method of performing audit tasksThe method of performing audit tasks is common to allentities of the Dexia Group. The different phases of theprocess are presented in a procedure which describes thedifferent phases to be followed in performing an internal audittask (preparation, realisation, audit report, recommendationmonitoring...) as well as the formats of documents expectedat each phase. The procedure also determines the roles andresponsibilities and modes of review and approval and thearchiving of documents.The Dexia audit methodology revolves around four principalphases.• The preparation phase: after studying the activity sectorto be audited, when the aim is to gather and to analyseavailable information which might prove useful in properlyunderstanding the activity, the audit team prepares a workprogramme which in particular includes the processes, risks,controls expected to cover the identified risks and tests to beperformed in order to give an opinion on the concept andeffectiveness of the controls in place to cover identified risks.A task letter informs those concerned as well as the membersof the management boards of the entities involved of thescope, objectives and programme for the task• The realisation phase: each task must be performed on thebasis of working documents established on a determined basisand organised in audit files. They clearly reflect the work carriedout and the techniques and methods of work used to reacha substantiated conclusion. The audit opinion is expressed onthe capacity of the controls to provide appropriate cover ofidentified risks. A causal analysis is performed of weaknessesrevealed and residual risk is assessed.• The conclusion phase: each task is subject to a writtenreport, established in the presence of all concerned, intendedfor the parties audited as well as management. The reportcontains an assessment of the ability of the internal controlsystem to cover risks (positive and negative points), but alsorecommendations on measures enabling the risk level to beimproved. Then action plans are established by the partiesaudited and discussed with audit. Each action plan is definedby an operational member of staff who assumes responsibilityfor it and the date completion. The audit attributes a criticallevel to each of the recommendations made. Finally, eachaudited process is given a rating expressing the degreeof risk control. Throughout the task, a constant andconstructive dialogue is established with the audited partiesand management. Each report is then presented to theManagement Board which rules on the recommendations,action plans and their completion.• Recommendation monitoring: each task results inrecommendations being made from the action plans definedby the audited parties with an undertaking on their part asto the date of completion. The aim of these is to remedy anyweaknesses revealed by the audit tasks, in order to consolidatethe internal control system. The implementation of each action54 Dexia Annual report 2010