PDF 25 MB - Sun International | Investor Centre

SUN INTERNATIONAL ANNUAL REPORT ’10
114
CORPORATE GOVERNANCE REPORT CONTINUED
Each risk has been measured in terms of its potential impact upon
statements of comprehensive income items and the group’s statements of
financial position. The group’s propensity for risk tolerance is used to
guide decisions for risk mitigation. The risk committee intends to formalise
a recommendation regarding the group’s appetite for risk, for consideration
by the board. The process of enterprise risk management is embedded at a
strategic level and the process has been cascaded to the group’s major
subsidiaries.
The board has adopted and disseminated a Risk Policy Framework outlining
the group’s framework and processes of risk management. The group has
developed a strong culture of managing risk, with a significant number of
embedded processes, resources and structures in place to address risk
management needs. These range from internal audit systems; insurance
and risk finance; IT security and governance; compliance processes; quality
management; and a range of other line management interventions. The
Risk Policy Framework provides an integrated framework through which
the group’s risk management efforts are maximised. All operations are
required to follow the policy’s directives in terms of risk assessment, risk
monitoring and risk reporting.
At operational level, there are numerous risk management processes,
including functions such as safety management, health and environment
responsibilities, security, fire, defence, fraud detection, food hygiene
controls and quality management. Each of these functions includes
processes for the identification of risk, the implementation of risk
mitigations, and compliance with relevant legislation. Risks are monitored
and reported upon at quarterly management and divisional meetings.
There is a comprehensive system of incident reporting that allows for
exception reporting to executive management. The group’s operational
risk control functions have performed well.
The group’s annual internal audit plan incorporates the outcomes of
the enterprise risk management process and the top risks in the group
have been incorporated into the internal audit plan and internal audit
investigates the effectiveness of risk controls. These risks are addressed
by the plan at least once a year. The director of internal audit attends
risk committee and divisional and management meetings where risk
is addressed in order to verify that the risk management process is
appropriate. The internal audit function formally reviews the effectiveness
of the group’s risk management processes once a year and reports on its
findings to the risk committee and the audit committee. As such, internal
audit provides a high profile risk management facilitation role, but without
assuming responsibility for risk management which remains the responsibility
of line management.
The board is satisfied with the process of identifying, monitoring and
managing significant risks and internal controls and that appropriate
systems are in place to manage the identified risks, measure the impact
thereof and that these are proactively managed so that the company’s
assets and reputation are suitably protected. Accordingly, the board has
elected not to appoint a single chief risk officer, as recommended by
King III, as the risk function is comprehensively embedded throughout
the group.
ACCOUNTABILITY AND AUDIT
Internal audit
The internal audit department is designed to serve management and the
board of directors through independent evaluations and examinations of
the group’s activities and resultant business risks.
The purpose, authority and responsibility of the internal audit department
is formally defined in an internal audit charter which is reviewed by the
audit committee and approved by the board. This charter is reviewed on
an annual basis and revised as necessary.
The internal audit department is designed to respond to management’s
needs while maintaining an appropriate degree of independence to
render impartial and unbiased judgements in performing its services. The
scope of the internal audit function includes performing independent
evaluations of the adequacy and effectiveness of group companies’
controls, financial reporting mechanisms and records, information systems
and operations, reporting on the adequacy of these controls and
providing additional assurance regarding the safeguarding of assets and
financial information. Internal audit is also responsible for monitoring
and evaluating operating procedures and processes through, inter alia,
gaming compliance, Responsible Gambling Programme compliance,
operational safety and health and environmental audits. Risk assessment
is co-ordinated with the board’s assessment of risk through interaction
between internal audit, the audit and risk committees which also
minimises duplication of effort. The director of internal audit reports at
all audit and risk committee meetings and has unrestricted access to
the chairmen of the company and the audit and risk committees. The
appointment or dismissal of the director of internal audit is with the
concurrence of the audit committee.
In accordance with the group’s policy of conducting an independent
assessment every three years, KPMG Inc has been engaged to conduct an
independent assessment of the effectiveness of the internal audit
function, in the forthcoming financial year.
External audit
The external auditors provide the board and the audit committee with
their independent observations and suggestions on the group’s internal
controls, as well as suggestions for the improvement of the financial
reporting and operations of the business.
The external auditors’ audit approach is risk-based, requiring them to
continually identify and assess risks throughout the audit processes. The
external auditors are reliant on the operating procedures and place
emphasis on understanding how management obtains comfort that the
business is generating reliable information and then evaluating and
validating the basis of this comfort. This approach aligns the way they
work closely with the organisational structures and risk management
processes.
There is close co-operation between internal and external audit and
reliance is placed, where possible, on the work of internal audit, therefore
minimising the duplication of effort. The annual external audit plan is
placed before the audit committee for review and approval. The external
auditors attend all shareholder meetings of the company.