Aviva 2013 Annual Report Download - page 73

Strategic report Governance IFRS Financial statements Other information
Aviva plc
Annual report and accounts 2013
71
Directors’ and Corporate governance report continued
reviewed and comply with the Financial Reporting Council’s
Internal Control: Revised Guidance for Directors.
Risk Management Framework
The Risk Management Framework (RMF) is designed to identify,
measure, manage, monitor and report the significant risks to
the achievement of the Group’s business objectives and is
embedded throughout the Group. The RMF has been in place
for the year under review and up to the date of approval of the
Annual report and accounts. It is codified through risk policies
and business standards which set out the risk strategy, appetite,
framework and minimum requirements for the Group’s
worldwide operations. Further details on procedures for the
management of risks are given in note 58.
Internal controls
Internal controls facilitate effective and efficient business
operations, the development of robust and reliable internal
reporting and compliance with laws and regulations.
A Group Reporting Manual including International Financial
Reporting Standards (IFRS) requirements and a Financial
Reporting Control Framework (FRCF) are in place across the
Group. FRCF relates to the preparation of reliable financial
reporting and preparation of local and consolidated financial
statements in accordance with IFRS and with the requirements
of the Sarbanes-Oxley Act of 2002. The FRCF process follows
a risk-based approach, with management identification,
assessment (documentation and testing), remediation (as
required), reporting and certification over key financial
reporting-related controls. Management regularly undertakes
quality assurance procedures over the application of the FRCF
process and FRCF controls.
The Board has delegated to the Group CEO the day-to-day
management of the Company and approval of specific issues up
to set financial limits, including limits on revenue and capital
expenditure, reinsurance spend and the settlement of claims. In
turn the Group CEO has delegated some of his authority to his
direct reports. There is a similar delegated authority framework
in place throughout the Group.
First line
Management are responsible for the application of the RMF, for
implementing and monitoring the operation of the system of
internal control and for providing assurance to the Audit
Committee, the Risk Committee, the Governance Committee
and the Board.
The Group Executive members and each business unit Chief
Executive Officer are responsible for the implementation of
Group strategies, plans and policies, the monitoring of
operational and financial performance, the assessment and
control of financial, business and operational risks and the
maintenance and ongoing development of a robust control
framework and environment in their areas of responsibility.
The CFO has established the Asset Liability Committee
(ALCO) which assists him in discharging his responsibilities in
relation to management of the Group’s balance sheet within
risk appetite and to provide financial risk management
oversight. This includes recommending financial and insurance
risk appetites and limit frameworks, evaluating the asset and
liability impact of strategies and business plans, financial risk
oversight, monitoring and management of the Group’s capital
and liquidity position, transaction risk oversight, stress and
scenario testing, and identification of emerging financial risks.
The Disclosure Committee is chaired by the CFO and reports
to the Audit Committee. It oversees the design and
effectiveness of the Group’s disclosure controls, for both
financial and non-financial information, evaluates the Group’s
disclosure controls and reviews and endorses the Group’s key
periodic external reports, including the consolidated financial
statements. The results of the FRCF process are signed off by
business unit Chief Executive Officers and Chief Financial
Officers and compliance with the FRCF is reported to the
Disclosure Committee and the Audit Committee.
Second line
The Risk function is accountable for the quantitative and
qualitative oversight and challenge of the identification,
measurement, monitoring and reporting of significant risks and
for developing the RMF.
As the business responds to changing market conditions and
customer needs, the Risk function regularly monitors the
appropriateness of the Company’s risk policies and the RMF to
ensure they remain up to date. This helps to provide assurance
to the various risk oversight committees that there are
appropriate controls in place for all core business activities, and
that the processes for managing risk are understood and followed
consistently across the Group.
To assist with the execution of his duties the CRCO has
established the Operational Risk and Reputation Committee
(ORRC) which oversees operational risks and reputational
impacts arising from activities across the Group. It oversees the
operational risk elements of the implementation and
maintenance of the risk policies and business standards, the
Group’s adherence to the Operational Risk Policy, and the
adequacy and implementation of the RMF throughout the
Group.
Third line
The Internal Audit function provides independent and
objective assessment on the robustness of the RMF and the
appropriateness and effectiveness of internal control to the
Audit, Governance and Risk Committees, business unit audit
committees and the Board. Further information on the activities
of the Internal Audit function is contained within the Audit
Committee Report.
Board oversight
The Risk Committee assists the Board in its oversight of risk and
risk management across the Group and makes
recommendations on risk appetite to the Board. The
responsibilities and activities of the Risk Committee are set out
in the Risk Committee Report.
The Audit Committee, working closely with the Risk
Committee, is responsible for assisting the Board in discharging
its responsibilities for the integrity of the Company’s financial
statements, the effectiveness of the system of internal financial
controls and for monitoring the effectiveness, performance and
objectivity of the internal and external auditors. The
responsibilities and activities of the Audit Committee are set out
in the Audit Committee Report.
The Governance Committee also works closely with the Risk
Committee and is responsible for assisting the Board in its
oversight of operational risk across the Group, particularly in
respect of behavior and the Group’s relationship with customers.
The Audit, Governance and Risk Committees report regularly
to the Board on their activities and make recommendations and
escalate significant risk exposures to the Board as appropriate.
They ensure that mitigating actions are taken when risks are, or
are expected to move, out of appetite.
The chart overleaf shows the Board and committee structure
that oversees the Company’s frameworks for risk management
and internal control.