annual-and-sustainability-report-2014

Internal control over financial reportingCorporate governance | Corporate governance reportThis section describes the most important elements in Vattenfall’ssystem of internal control and risk management in connection with thefinancial reporting, as prescribed by the Annual Accounts Act and theCode. Vattenfall’s framework for this control is based on the COSOframework, which has been developed by the Committee of SponsoringOrganizations of the Treadway Commission. For further informationsee also the risk section, pages 66–72.Control environmentAccording to the Swedish Companies Act and the Code, the Boardof Directors has overarching responsibility for internal control overfinancial reporting. In this context the Board shall ensure that thecompany’s organisation is structured in such a way that the bookkeeping,treasury management and the company’s financial conditionsin general are controlled in a satisfactory manner. The Board’s auditcommittee conducts drafting work for the Board on matters related tointernal control over financial reporting.The control environment is based on the division of responsibilitybetween the Board and the CEO, which is set forth in the Board’sRules of Procedure, along with the reporting requirements made bythe Board. The Board has also adopted Vattenfall’s Code of Conduct,which lays out the overarching rules governing employee conduct.The VMS is an integrated management system for the VattenfallGroup and is revised on a continuing basis (see also the section oninternal governance on page 56). The VMS contains governancedocuments for all identified material areas, including roles and responsibilities,authority, decision-making processes, risk management,internal control, and ethics and integrity issues. The VMS lays out the“grandfather principle” and “four eyes principle” for decision-making.The VMS also stipulates which decision-making, oversight and advisorybodies exist within the Group, in addition to those required by law.Vattenfall has an internal financial control (IFC) process whoseoverall purpose is to ensure that controls are in place in the financialreporting.Risk assessmentThe Board handles the Group’s risk assessment and risk managementprocess at an overarching level. The Board’s audit committee conductsdrafting work for evaluation and monitoring of risks and quality infinancial reporting. The Audit Committee maintains continuous andregular contact with the Group’s internal and external audit functions.Other risks of an operational character that are evaluated andmonitored at the board level are addressed and drafted primarily bythe Board’s safety and risk committee.The Board’s risk management and reporting is centrally coordinatedvia Vattenfall’s risk committee (VRC). A continuous EnterpriseRisk Management (ERM) process makes it possible to quantify andcompare both financial and non-financial risks.For the financial reporting, the IFC process serves as a frameworkfor internal control that identifies and defines risks for material errorsin the financial reporting. These are overseen by the CFO Staff Functionthrough regular reporting on tests performed of defined controlpoints. The CFO Staff Function is also responsible for performingregular analyses of risks related to financial reporting and for updatingthis framework.The external and internal auditors discuss Vattenfall’s risk situationin connection with the planning work ahead of the annual audit.Control activities and monitoringVattenfall applies the “three lines of defence” model for managementand control of risks. The first line of defence consists of the BusinessUnits, which own and manage risks. The risk organisation, which isheaded by the Chief Risk Officer (CRO), makes up the second line ofdefence and is responsible for monitoring and controlling risks. Internaland external audit make up the third line of defence. Internal Auditis an independent and objective function that reviews and evaluatesthe first and second lines of defence.The CRO is responsible for the risk management organisation withinthe Group and provides information to the Board’s audit committeeand safety and risk committee on a regular basis. The CRO is also responsiblefor processes related to, among other things, new productsand certain contracts with long durations.Internal Audit evaluates, recommends and monitors improvementsto the effectiveness of Vattenfall’s risk management, internal controlsand governance processes throughout the Group. This also appliesfor compliance with Vattenfall’s governance documents, including theCode of Conduct. The Internal Audit function is directly subordinateto the Board of Directors and Audit Committee, and performs itswork in accordance with an established internal audit plan. InternalAudit’s budget, the Internal Audit Charter and the internal audit planare drafted by the Audit Committee and decided on by the Board ofDirectors. The Head of Internal Audit reports administratively to theCEO and informs the management teams of the Business Units andother units about audit activities that have been performed.Three lines of defenceBusiness UnitsFirst line of defenceOwnership andmanagement of riskRisk organisation andother control functionsSecond line of defenceRisk managementand risk controlInternal andexternal auditThird line of defenceIndependent reviewand oversightRisksVattenfall Annual and sustainability report 2014 59