Audi 2015 Annual Report Download - page 190

REPORT ON EXPECTED DEVELOPMENTS, RISKS AND OPPORTUNITIES
REPORT ON RISKS AND OPPORTUNITIES
190 >>
Within each scope of responsibilities, risks are to be identified,
evaluated, appropriately managed and monitored. Furthermore,
transparent, accurate, timely communication up the chain of
command to the appropriate internal business units and Group
functionalities is required. All organizational levels are to be
integrated into the Risk Management System. The inclusion of
Group, brand, corporate and divisional levels also meets statu-
tory requirements. Changes in the legal framework with respect
to risk management are continually observed and are acted on
promptly where relevant for the Company. The integration of all
principal subsidiaries is currently already ensured. New compa-
nies are integrated promptly.
The Risk Management System and Internal Control System is
closely interlocked with the compliance functionality (central
governance, risk & compliance organization/central GRC organ-
ization) as part of an integrated and inclusive management ap-
proach. The Board of Management and the Audit Committee of
the Supervisory Board are kept regularly informed about the
Risk Management System and Internal Control System as well
as the Compliance Management System in a combined report.
The central task of risk management is to identify and analyze
risks, then systematically render them transparent and improve
their controllability using suitable risk management tools. This
process also creates scope for generating and exploiting oppor-
tunities. Using the COSO framework, risk-appropriate internal
controls are defined and performed along the entire value chain
(Internal Control System). So that suitable measures and
controls can be implemented early on, cross-disciplinary topics
and activities in particular are examined for risk potential both
continually and ad hoc.
The Audi Group promotes the ongoing development of the Risk
Management System through cross-divisional and cross-company
projects. One of the priorities here is to interlink the system
closely with financial corporate planning and management,
accounting and insurance management. In view of its high
strategic relevance, the regulatory framework for the Risk
Management System and Internal Control System is firmly
established both in an internal Board Directive of AUDI AG and
at the subsidiaries.
For the systemic design of its risk management architecture,
the Audi Group adopts the “Three Lines of Defense” model – a
recommendation of the European Confederation of Institutes
of Internal Auditing (ECIIA). The Risk Management System
and Internal Control System of the Audi Group consequently
features three lines of defense that are intended to protect the
Company against the occurrence of material risks.
The “Three Lines of Defense” model
The individual risk owners of the AUDI AG divisions and subsid-
iaries are responsible for the operational management of risks
and their control, as well as for reporting on them. They repre-
sent the first line of defense. Controlling maintains a constant
dialogue with the individual departments of the Company
throughout. This ensures that the financial impacts are
continuously taken into account in corporate planning and
management.
In the second line of defense, the central GRC organization
takes charge of the fundamental functionality of the Risk
Management System and Internal Control System as well as
the compliance management system. The core activities of
Central Risk Management involve monitoring system perfor-
mance and submitting an aggregated report on the risk situa-
tion to the Board of Management and the Audit Committee of
the Supervisory Board (GRC Annual Report). This ensures that
the statutory requirements for the early identification of risks
and the effectiveness of the Risk Management System and
Internal Control System are met. In addition, Central Risk
Management handles the Group-wide ongoing development of
risk management governance and tools. These include direc-
tives and standards, as well as methods and processes that are
adapted to the scale of the individual company. In addition,
consultancy on operational risk management is available for
the divisions and subsidiaries. Regular training courses and
fact-finding events are held to lastingly reinforce awareness of
risk management and compliance as well as promote a posi-
tive risk culture in the Audi Group. AUDI AG also has risk com-
Supervisory Board
Board of Management
First
line of defense
Third
line of defense
Second
line of defense
Operational risk
management
Coordination
of GRC control
process, risk and
compliance program
Audit of
RMS/ICS
Reports on risk
management Reporting through GRC Annual Report Audit reports on RMS/ICS
Divisions Central GRC
organization Internal Audit