Audi 2013 Annual Report Download - page 199

REPORT ON EXPECTED DEVELOPMENTS, RISKS AND OPPORTUNITIES
REPORT ON RISKS AND OPPORTUNITIES
MANAGEMENT REPORT
196
A
REPORT ON RISKS AND
OPPORTUNITIES
/ THE RISK MANAGEMENT SYSTEM
WITHIN THE AUDI GROUP
// OPERATING PRINCIPLE OF THE
RISK MANAGEMENT SYSTEM
The Audi Group fundamentally adopts a value and future-
oriented approach in the interests of its stakeholders.
Approaching entrepreneurial opportunities and risks construc-
tively is a key aspect of its economic responsibility.
Our Company’s risk propensity is reflected in the strategic,
operating and financial targets that it develops. The binding
objectives are subjected to responsible risk/return analyses
and are synchronized both Company-wide and with the
Volkswagen Group.
For many years the Audi Group has maintained a Group-wide risk
management system which reflects the internationally recog-
nized standard of the Committee of Sponsoring Organizations
of the Treadway Commission (COSO). The risk management
system is intended to satisfy statutory and business require-
ments. Statutory changes are continually observed and are
acted on promptly where relevant for the Company. Our risk
management system enables us to systematically record the
risks to which the Audi Group is exposed and simultaneously to
highlight ways of identifying and exploiting opportunities for
the divisions. Within the COSO framework, internal controls
are defined and carried out along the entire value chain. Audi
addresses the growing challenges of an increasingly complex
and volatile environment by steadily expanding, gradually
refining and culturally anchoring the risk management system,
which is also embedded in an internal Board Directive in light
of its high strategic relevance. Risk management and compli-
ance are closely linked both organizationally and procedurally
in a comprehensive, integrated management approach. Further-
more, a combined report on risk management, internal controls
and compliance is submitted regularly to the Board of Manage-
ment and the Audit Committee of the Supervisory Board. The
risks identified in the Audi Group and the countermeasures
adopted for them are taken into account in corporate planning
and management.
The Audi Group bases the systemic design around the “Three
Lines of Defence Model.” This system architecture is based on
the recommendations of leading specialist organizations such
as the European Confederation of Institutes of Internal Audit-
ing (ECIIA). The divisions of AUDI AG and the Group companies
constitute the first line of defence. In their capacity as the risk
owners, they are responsible for managing their risks and con-
trols, and are also required to carry out reporting. The findings
of this operational risk management are continuously incorpo-
rated into the relevant planning and control calculations of the
Controlling department.
As the second line of defence, Central Risk Management safe-
guards the fundamental functioning of the risk management
system and internal control system. The core activities include
systemic monitoring, ensuring system performance and submit-
ting an aggregated report on the risk situation to the Board of
Management and the Audit Committee of the Supervisory Board.
Other significant tasks involve refining practical frameworks and
standards, methods and processes. The provision of consulting
functionalities to help the divisions and subsidiaries conduct
operational risk management furthers the ongoing improve-
ment of the system by permanently ensuring risk transparency,
optimizing risk controllability and promoting the risk culture.
Risk management within the Audi Group
As the third line of defence, Internal Auditing, as an impartial
body, examines the security, regularity and economic effec-
tiveness of the systemic and operational activities of the risk
management system and internal control system. In addition,
the risk early warning system and internal control system for
accounting are subject to review by the independent auditor of
the Consolidated Financial Statements.
Central Risk Management
Non-central risk managers
Risk inventory
Risk evaluation
Risk early warning
Risk culture
Risk avoidance
Risk minimization
Risk reporting
Risk monitoring
Transparency Management