Annual Report 2010 - Enel.com

their observance with regard to short-, medium-, and
long-term plan objectives; (vi) to define and propose to
the Chief Executive Officer the optimal architecture of
the controls dedicated to risk management; (vii) to prepare
appropriate integrated and detailed reports on the
Company’s significant risks, the control processes implemented,
and the hedging actions carried out; (viii) to ensure
insurance coverage for the entire Group; and (ix) to
implement and manage the Group enterprise risk management
model.
In 2010, the main activities carried out by the “Group Risk
Management” Department concerned:
> the elaboration of the risk governance of the Group
and its sharing with the operative Divisions and the interested
staff Functions;
> the drafting of the guidelines for the management
of the financial risks, commodity risks and credit risks,
comprising the definition of the system of operative
limits;
> the commencement of risk assessment activities within
the operative Divisions;
> the support for the definition of the organization of the
local structures of risk management, which is currently
in course;
> the development of specific methodologies for the
analysis and measuring of different risks.
The system of risk management
and internal control of financial
information
As part of the internal control system, the Group has had
for several years a special system of risk management and
internal control regarding the process of financial information
(in the present section, for the sake of brevity, referred
to as the “System”).
Overall, this System is defined as the set of activities intended
to identify and assess the actions or events whose
materialization or absence could compromise, partially or
entirely, the achievement of the objectives of the control
system (“Risk Management System”), supplemented by
the subsequent activities of identifying the controls and
defining the procedures that ensure the achievement of
the objectives of the credibility, accuracy, reliability, and
timeliness of financial information (“Internal Control System”).
The executive in charge of preparing the corporate
272 Enel Annual Report 2010
Corporate governance
accounting documents supervised the development and
implementation of a specific model for assessing the System
and adopted a special procedural body – of which all
the personnel concerned has been informed – which records
the methods adopted and the responsibilities of the
aforesaid personnel as part of the activities of defining,
maintaining, and monitoring the System in question. Specifically,
the Group issued a procedure that regulates the
reference model of the control system and a procedure
describing the process of assessing the internal system for
controlling financial information, which defines roles and
responsibilities within the Company’s organization, providing
for a specific flow of internal certifications.
The controls instituted have been monitored to check
both their “design” (that is, if it is operative, that the control
is structured to mitigate the identified risk in an acceptable
way) and their actual “effectiveness”.
The management responsible for the activities, risks and
controls and the Company’s Audit Department are entrusted
with responsibilities regarding the periodic testing
of the System.
In line with Section 404 of the Sarbanes-Oxley Act (which
was fully applicable to the Company and the Group until
the completion of the procedure of deregistration of the
ADS - American Depositary Shares of Enel at the US Securities
and Exchange Commission in March 2008, and which
is still applicable to certain Latin-American companies of
the Group, which currently have ADS listed on the New
York Stock Exchange, as explained in detail in the first section
of the document under “Share capital structure”), the
assessment of the controls on financial information was
based on the criteria established in the model “Internal
Controls - Integrated Framework” issued by the Committee
of Sponsoring Organizations of the Treadway Commission
(the so-called “COSO Report”), supplemented
with regard to the IT aspects by the model “Control Objectives
for Information and related Technology” (the socalled
“COBIT”).
The process of assessment of the System, defined in Enel
as Management Assessment Process (and in the rest of
the present section referred to, for the sake of brevity,
as “MAP”), which is progressively extended to newly acquired
subsidiaries of a material significance, is divided
into the following macro-phases:
> definition of the perimeter and identification of the
risks;
> assessment of the design and effectiveness of the controls
(the so-called “line” monitoring);