The Norwegian Code of Practice for Corporate Governance - Statoil

10. Risk management and internal controlThe board of directors must ensure that the company has sound internalcontrol and systems for risk management that are appropriate in relationto the extent and nature of the company’s activities. Internal control andthe systems should also encompass the company’s corporate values,ethical guidelines and guidelines for corporate social responsibility.The board of directors should carry out an annual review of thecompany’s most important areas of exposure to risk and its internalcontrol arrangements.CommentaryThe board’s responsibility and objective for risk management and internalcontrolThis section of the Code of Practice on risk management and internalcontrol is intended to clarify the supervision responsibilities of the boardof directors.The objective for risk management and internal control is to manage, ratherthan eliminate, exposure to risks related to the successful conduct of thecompany’s business and to support the quality of its financial reporting.Effective risk management and good internal control contribute to securingshareholders’ investment in the company and the company’s assets.Internal control comprises guidelines, processes, duties, conduct and othermatters that:• facilitate targeted and effective operational arrangements for the companyand also make it possible to manage commercial risk, operationalrisk, the risk of breaching legislation and regulations as well as all otherforms of risk that may be material for achieving the company’s commercialobjectives.• contribute to ensuring the quality of internal and external reporting43 CORPORATE GOVERNANCE