Carphone Warehouse 2016 Annual Report Download - page 46

Dixons Carphone plc Annual Report and Accounts 2015/16
Corporate Governance
Corporate Governance Report
44
Risk and internal controls
Committed to effective risk management
The Board has overall responsibility for the Group’s system of
internal control and for reviewing its effectiveness.
Effective risk management requires collective responsibility
and engagement across the entire business. Dixons
Carphone’s senior management team, operating through the
Group Risk & Compliance Committee, are accountable for:
•identifying, mitigating and managing risk in their areas of
responsibility; and
•implementing and monitoring controls which are designed
to mitigate the risks to which their area of the business is
exposed. The controls by their nature are designed to
manage rather than eliminate risk and can only provide
reasonable but not absolute assurance against material
misstatement or loss.
System of risk management and internal control
The system is built on the pillars of effective governance, risk
management, internal control and assurance. These are more
fully described below.
Governance
•The Board and its various committees have defined financial
authorities and operational responsibilities, which are
designed to enable effective decision-making and
organisational control.
•The Board has agreed a risk appetite that provides the
reference point against which to benchmark risk
management reviews and risk mitigation activity within the
organisation. The risk appetite defines the boundaries within
which risk-based decision-making can occur and outlines
the expectations for the operation of the control
environment.
•An organisation and management structure operates across
the business to enable the delivery of products and services
to our customers and operational control of business
activities in accordance with the risk appetite.
•Annual strategic planning and budgeting processes.
•Defined delegation of authorities that cascades throughout
the Group.
•A Group policy framework contains the core compliance
policies which all employees are required to observe.
•Compliance policy owners are responsible for managing and
improving standards in their respective areas of
accountability across all our operations.
•A system of quarterly business reviews covering financial
and operational reporting by each business unit which
involves comparison of actual results with the original
budget and the updating of a full year forecast.
•Annual objective setting and performance reviews.
Risk management
•A risk management policy and framework outlines the
principles and approach to risk management within the
business.
•The Group Director of Risk facilitates and manages the risk
management policy and framework throughout the Group.
•A formal risk identification process takes place to evaluate
and manage the significant risks faced by the Group in
accordance with the requirements of the Code and Financial
Reporting Council Guidance on Risk Management and
Internal Control. Risk is broadly identified against strategic,
operational, technological, financial, people, regulatory and
hazard / external categories. Details of the principal risks
and examples of mitigating actions can be found on pages
20 to 23 of the Strategic Report.
•A Group risk register, which identifies the risks faced by
each of the businesses, including regulated business, their
potential impact and likelihood of occurrence (assessed on a
gross and net basis), together with an evaluation of the key
controls and management processes established to mitigate
these risks. Each of the Group’s business units also
maintains a risk register. Action plans are determined to
enhance risk mitigation if required.
•The Group Risk & Compliance Committee reports to the
Audit Committee and meets quarterly to review the
management of risk arising out of the Group’s activities and
to monitor the status of key risks and actions at Group and
business unit level.
•Each of the Group’s business units has a risk committee
which identifies risk in accordance with the Group Risk
Management Framework. These committees meet to
consider risk and internal control matters for their respective
areas of responsibility.
Internal control
•A minimum control environment which defines detailed
financial, supplier funding, purchasing, payroll, capital
expenditure, treasury, B2B, information systems, stock
management, merchandise revenue and service revenue
controls to be applied by all business operations.
•Each business unit operates a control environment to satisfy
legal, regulatory, Group and customer requirements.
•Processes exists that govern the way in which we
operate our retail, wholesale, logistics, distribution and
service operations. The operation of these processes
provides assurance on the standard of our customer and
service delivery.
00_DC 2016 Annual Report.pdf 44 11/07/2016 18:34