annual report 2007 - the Admiral Group plc

28 CORPORATE GOVERNANCEIn order to ensure these responsibilities are properly discharged, the Board has delegated the taskof supervising risk management and internal control to the Risk Management Committee (RMC).There are several key elements to the risk management environment throughout the Group.These include the setting of risk management policy at Board level, enforcement of that policyby the Chief Executive, delivery of the policy by the RMC via the Group’s systems of internalcontrol and risk management, and the overall assurance provided by the Audit Committee thatthe systems operate effectively.The Board recognises that the day-to-day responsibility for implementing these policies must liewith the management team, whose operational decisions must take into account risk and howthis can effectively be controlled. The Company Secretary and Risk Officer take responsibilityfor ensuring management are aware of their risk management obligations, providing them withsupport and advice, and ensuring that the risk management strategy is properly communicated.The head of each business unit or business area is required, with the support of the Risk Manager,to undertake a full assessment process to identify and quantify the risks that their departmentsface or pose to the Group and the adequacy of the controls in place to mitigate or reduce thoserisks. Reports are produced showing the most significant risks identified and the controls inplace. Internal Audit and the Compliance function use the risk registers to plan their programmeof audits to ensure that the controls described are actually in place.The RMC receives reports setting out key performance and risk indicators and considers possiblecontrol issues brought to their attention by early warning mechanisms that are embeddedwithin the operational units. The RMC and the Audit Committee also receive regular reportsfrom Internal Audit, which include recommendations for improvement in the control andoperational environment. The Audit Committee’s role in this area is primarily confined to a highlevelreview of the arrangements for internal control although at its discretion the Committeemay well request more detailed information on specific issues should they arise. The Board’sagenda includes a regular item for consideration of risk and control and receives reports thereonfrom the RMC and the Audit Committee. The emphasis is on obtaining the relevant degree ofassurance and not merely reporting by exception. At its March 2008 meeting, the Board carriedout the annual assessment for the 2007 year by considering documentation from the AuditCommittee, taking account of events since 31 December 2007.The Audit Committee’s ability to provide the appropriate assurance to the Board depends on theprovision of periodic and independent confirmation, primarily by Internal Audit, that the controlsestablished by management are operating effectively. The Audit Committee reviews the wideraspects of internal control and risk management, providing a high level challenge to the stepsbeing taken to implement the risk management strategy.The Board confirms that there were no significant issues arising during the year under review.The Risk Management CommitteeThe Committee’s members include the three Executive Directors, the Group Company Secretary(who chairs the meetings), the Deputy Compliance Officer, the Risk Manager and seniormanagement representatives.One of the Committee’s principal responsibilities is to ensure that the risk management policyapproved by the Board is implemented throughout the Group.