BMW 2015 Annual Report Download - page 76

76
18 COMBINED MANAGEMENT REPORT
18 General Information on the BMW Group
18 Business Model
20 Management System
23 Report on Economic Position
23 General and Sector-specific
Environment
27 Overall Assessment by Management
27
Financial and Non-financial
Performance Indicators
29 Review of Operations
49 Results of Operations, Financial
Position and Net Assets
59 Comments on Financial Statements
of BMW AG
62 Events after the End of the
Reporting Period
63 Report on Outlook, Risks and
Opportunities
63 Outlook
68 Report on Risks and Opportunities
81 Internal Control System and Risk
Management System Relevant for the
Financial Reporting Process
83 Disclosures Relevant for Takeovers
and Explanatory Comments
87
BMW Stock and Capital Markets
also possibly have a negative impact on operating per-
formance due to the non-availability of products and
services or even downtimes in the production of spare
parts and / or vehicles. Indirectly, the BMW Group could
also be exposed to unquantifiable reputational risks.
Risk management procedures include the systematic
documentation of all informational and IT risks, regu-
lar monitoring, and the implementation of
appropriate
measures by the departments responsible. Technical
data protection procedures include virus scanners, fire-
wall systems, access authorisation controls at both oper-
ating system and application level, regular data back-
ups and data encryption. Regular analyses and controls
(for example the testing of data protection requirements)
and rigorous security management ensure a high level
of security.
The demands placed on IT facilities, both externally and
internally, are changing at a breathtaking pace in the
face of technological developments. Potential risks are
therefore investigated continuously and appropriate
measures put in place in order to either prevent them
or minimise their impact. Despite regular testing and
the whole gamut of preventative security measures em-
ployed, it is nevertheless impossible to rule out risks
completely in this area.
Great emphasis is placed on protecting both business
information and employee and customer data from un-
authorised access and / or misuse. Data security based
on International Security Standard ISO / IEC 27001 is
an integral component in all business processes. Per-
sonal data is protected in accordance with the stringent
requirements of the EU Data Protection Directive and
the Federal Data Protection Act (Bundes daten schutz-
gesetz – BDSG).
All employees are required to treat confidential infor-
mation (such as customer and employee data) in an ap-
propriate manner, ensure that information systems are
properly used and that risks are handled with the ut-
most transparency. Uniform requirements, documented
in a coordinated and comprehensive set of principles,
guidelines and work instructions, are applicable group-
wide. Regular communication and awareness-raising
activities create a high degree of security and risk con-
sciousness
among the employees involved. Employees
receive training to ensure compliance with the applicable
requirements and in-house rules.
Responsibility for data protection in each Group entity
lies with the Board of Management (of BMW AG) or the
relevant company management team. Local Data Privacy
Protection Officers are embedded in each of the Group’s
entities. In the case of cooperation arrangements and
business partner relationships, the BMW Group protects
its intellectual property as well as customer and em-
ployee
data by stipulating clear instructions with regard
to data protection and the use of information technology.
Information pertaining to key areas of expertise as well
as sensitive personal data are subject to particularly strin-
gent
security measures. In a clear signal to employees,
customers and Europe’s data protection authorities that
data protection is taken very seriously, the Board of
Management of BMW AG has resolved a set of Binding
Corporate Rules governing the handling of employee
data.
If information, data protection and IT risks were to
materialise, they could have a medium earnings impact
over the two-year assessment period. The levels of risk
attached to information, data protection and IT risks are
classified as medium.
Information, data protection and IT opportunities
Conversely, the deployment of information technology
also opens up a great many opportunities for the BMW
Group. New approaches to production and energy sup-
ply systems currently being investigated in the context
of the Industrial Internet (“Industrie 4.0”) are generat-
ing significant efficiency improvements and resulting in
greater sustainability. The range of services and apps
on offer to customers via Connected Drive is constantly
being expanded and updated. The BMW 7 Series offers
the comfort of partially automated driving functions with
the optional Driving Assistant Plus feature. The pur-
chase of a stake in HERE mapping service was an im-
portant step for the next generation of mobility and
location-based services. For the automobile sector, it
serves as the basis for a variety of new customer-oriented
functions, ranging from innovative assistance systems
through to fully automated driving.
The BMW Group does not expect these opportunities
to have a material earnings impact over the two-year