Annual report and accounts 2016

190
Spanish corporate governance report continued
E. RISK CONTROL AND MANAGEMENT SYSTEMS
E.1 Describe the company’s risk management system, including tax risks.
The Group has an Enterprise Risk Management Policy approved by the IAG Board of Directors. This Policy establishes a
common framework within the Group to manage and control the financial and non-financial risks the Group is exposed to,
establishing the risk level that is considered acceptable.
The IAG Board has ultimate responsibility for risk management and internal control, including the determination of the nature
and extent of the principal risks it is willing to take to achieve its strategic objectives.
The Audit and Compliance Committee reviews all enterprise risk management matters on behalf of the Board. This includes a
six monthly IAG risk map review containing a robust assessment of the principal risks facing the Group and how these risks are
managed or mitigated to reduce their incidence or their impact. The Audit and Compliance Committee also carries out deep
dives on selected risks as and when requested. During such reviews the requirement for any changes to the Board’s risk
appetite is considered. The Audit and Compliance Committee also monitors and reviews the risk management framework,
satisfying itself that it is functioning effectively and that corrective action is being taken where necessary.
Within this common framework, Enterprise Risk Management is led by the Management Committee of IAG supported by the
Aer Lingus, Avios, British Airways, IAG Cargo, Iberia and Vueling Management Committees.
Enterprise risk management
There is a comprehensive risk management process and methodology ensuring a robust assessment of the principal risks facing
the Group. All the operating companies have well established enterprise risk management systems that ensure that:
a. Each risk is owned by a Senior Manager who is ultimately responsible for its management;
b. All operating companies’ risks are discussed with the IAG risk management team.
c. A central record is kept of all risks, their owners and mitigating actions in all of the operating companies.
d. A risk map representing the likelihood and potential impact of each risk is reviewed at least every six months by the
respective management committees;
e. There are defined procedures for updating risks and the mitigating actions in place to manage those risks; and
f. There is active participation from both the Senior Managers managing the risks and the management committees.
Risks are classified by their source in:
a. Strategic: risks arising from the competitive and regulatory environment, major projects and strategic decisions;
b. Business and operational: risks encompassing emergencies, information technology operations, major project
implementation and airline operations;
c. Financial: risks including liquidity and financing;
d. Compliance and regulatory: risks associated with compliance with laws and regulation.
Enterprise risk management in the Company
At the Group level, material risks from the airlines, together with Group wide risks, are maintained in a Group risk map.
The IAG Management Committee reviews the Group risk map twice a year in advance of reviews by the Audit and Compliance
Committee. The IAG Board also discusses risks at a number of meetings, including a specific annual review of the Group’s risk
map and risk appetite as well as in the context of discussions around strategy and the business plan.
Tax risk
Tax risk is explicitly included within the Group’s Enterprise Risk Management Policy. Tax risk is owned by the IAG Head of Tax
and is reported, as part of the overall risk review, to the IAG Management Committee and Audit and Compliance Committee
twice a year. Tax risk is mitigated by an IAG Tax Policy which considers engagement between the tax department and the
business; compliance with tax obligations; tax planning; reputation; and transparency.
INTERNATIONAL AIRLINES GROUP
Annual Report and Accounts 2016