reference document 2003 - Euler Hermes Kreditversicherungs-AG

Reinsurance, Information Technology,
Audit, Communication and Human
Resources. In the area of Risks, these rules
were updated in 2003. They have been
implemented in the main entities as procedures
that include in particular the thresholds
of individual responsibility and the
organisation of specific risk and commercial
committees for example.
It should be noted that the following models
are being introduced throughout the
Group:
• a risk business model and quality standards
in terms of the management of
debtor risk,
• a collection business model in terms of
collection of receivables.
First level of control
At Group level, there are cross-company
functions for the Risk/Litigation, Sales and
Marketing, and Strategy operational areas
and for the Information Technology,
Finance and Accounting, Reinsurance,
Internal Audit, Human Resources and
Communication support areas. A member
of the Group Management Board is responsible
for each function and these members
check the implementation of Group directives
in the subsidiaries.
For example, the risk (credit) cross-company
function monitors all the credit risk
business. To do this, it uses the monthly
group reports drawn up by Group
Management Control and monthly reports
on sensitive risks. Corrective action is coordinated
with a Group Risk Committee
whose members include subsidiaries’ risk
managers. This committee, chaired by the
manager of the risk cross-company function,
meets every two months. Each sub-
sidiary’s risk manager reports to this committee.
Local risk business is supervised by
a local risk committee, of which the CEO is
generally a member, and by a system of
delegation of powers.
Within company departments, procedures
govern the measures to be taken and the
main related controls. The extension of the
documentation of the control system to
departments that are not yet covered is
under way in the context of complying with
the Sarbanes-Oxley Act and should be completed
for the largest subsidiaries at the
end of 2004.
Controls are carried out by the operational
units themselves. These controls may be
integrated into the processing of transactions
(first level) and some may be integrated
into automated systems. In
addition, they may be carried out by units
or individuals who are independent of the
above-mentioned operational units or distinct
from those who have carried out controls
at the first level (second level).
Second level of internal control
The Group has a central audit function and
audit structures within the largest units.
There are 25 auditors within the Group. The
audit structure is decentralised and the
main subsidiaries have their own structure.
The group audit manager reports to the
Euler Hermes Audit Committee and to the
Chairman of the Group and is a permanent
member of subsidiaries’ audit committees
along with the local audit manager.
An annual programme of audit assignments
is drawn up. This programme,
based on a map of risks and a pragmatic
approach to requirements, has a local part
(2/3 of the activity) and a Group part that
includes the global audits of subsidiaries,
and audits of cross-functional processes
carried out simultaneously in the main
subsidiaries. It is drawn up in accordance
with a structured procedure in the second
half of the year. It is the subject of a procedure
of discussion, communication and
validation with operational staff, General
Management and audit committees. The
last stage of the validation process is the
presentation of the programme to the
Euler Hermes Audit Committee for
approval in November. The audit programme
is adapted appropriately, in order
to obtain coverage of risk over five years
in accordance with Allianz’s directives,
while ensuring more frequent coverage of
the most sensitive risks. The Group 2004
programme includes four independent
audits (audit of subsidiaries) and three
cross-functional audits including the introduction
of continuity plans.
The audit activity is based on an audit charter
that was validated by the audit committee
and the Supervisory Board in April
2001. It precisely defines the assignment,
the organisation of the various levels of
control within the Euler Hermes Group and
its subsidiaries and the terms and conditions
of intervention by Group and local
audit departments. It is completed by the
development of audit standards and procedures
at local and Group level.
Risk mapping
Risks were first mapped in 2002, by listing
the operational risks with the managers of
the subsidiaries. Business activity is
divided into nine main functions
49