BMW 2015 Annual Report Download - page 81

81 COMBINED MANAGEMENT REPORT
The internal control system in place throughout the
BMW Group is aimed at ensuring the effectiveness of
operations. It makes an important contribution towards
ensuring compliance with the laws that apply to the
BMW Group as well as providing assurance on the pro-
priety and reliability of internal and external financial
reporting. The internal control system is therefore a
significant factor in the management of process risks.
The principal features of the internal control system
and the risk management system, as far as they relate
to individual entity and Group financial reporting pro-
cesses, are described below.
Information and communication
One component of the internal control system is that of
“Information and Communication”. It ensures that all
the information needed to achieve the objectives set for
the internal control system is made available to those
responsible in an appropriate and timely manner. Infor-
mation relevant for the various financial reporting pro-
cesses – at BMW AG, other consolidated Group entities
and for the BMW Group as a whole – is set out pri-
marily
in organisational manuals, internal and external
financial reporting guidelines, accounting manuals and
training documentation. This information, which can
be accessed at all levels via the BMW Group’s intranet
system, provide the framework for ensuring that the
relevant rules are applied consistently throughout the
Group. The quality and relevance of these instructions
are ensured by regular review as well as by continuous
communication between the relevant departments.
Organisational measures
All financial reporting processes (including Group finan-
cial reporting processes) are structured in organisa-
tional terms in accordance with the principle of segrega-
tion of duties, thus making an important contribution
to the early identification of errors and the prevention
of potential wrongdoing. Regular comparison of inter-
nal forecasts and external financial reports, for example,
improves the quality of financial reporting. Moreover,
the internal audit department, in its capacity as a pro-
cess-independent function, tests and assesses the effec-
tiveness of the internal control system and proposes
improvements where appropriate.
Controls
Extensive controls are carried out by managers and staff
in all financial reporting processes at an individual
entity and Group level, thus ensuring that legal require-
ments and internal guidelines are complied with and
that all business transactions are properly executed. Con-
trols are also carried out with the aid of IT applications,
thus reducing the incidence of process risks. Moreover,
the performance of controls on accounts deemed to
be exposed to risk are subject to additional monitoring.
IT authorisations
All IT applications used in financial reporting processes
throughout the
BMW Group are subject to access re-
strictions, allowing only authorised persons to gain ac-
cess
to systems and data in a controlled environment.
Access authorisations are allocated on the basis of the
nature of the duties to be performed. In addition, IT
processes are designed and authorisations allocated
using the dual control principle, as a result of which, for
instance, requests cannot be submitted and approved
by the same person. Technical monitoring procedures
are also in place to ensure appropriate authorisation
security throughout all IT systems.
Internal control training for employees
All employees are appropriately trained to carry out
their duties and kept informed of any changes in regula-
tions or processes that affect them. Managers and staff
also have access to detailed best-practice descriptions
relating to risks and controls in the various processes,
thus increasing risk awareness at all levels. As a conse-
quence, the internal control system can be evaluated
regularly and further improved as necessary. Employees
can, at any time and independently, deepen their
un-
derstanding of control methods and design using an
information platform that is accessible throughout the
entire Group.
Evaluating the effectiveness of the internal
control system
Responsibilities for ensuring the effectiveness of the in-
ternal control system in relation to individual entity
Internal Control System* and Risk Management System Relevant for the Financial Reporting Process
* Disclosures pursuant to § 289 (5) HGB and § 315 (2) no. 5 HGB.