Lenovo 2012 Annual Report Download - page 50

2011/12 Annual Report Lenovo Group Limited
48
CORPORATE GOVERNANCE REPORT
In selecting the audits to perform each year, Internal
Audit uses information collected throughout the year
from process owners, the risk assessment team, senior
executives, external auditor and the Board. Using this
information Internal Audit develops a risk based audit plan,
focusing on areas with significant risks or where substantial
changes have been made. The audit plan is reviewed by
the Audit Committee, which is also given quarterly updates
on the performance of the plan and key findings. In keeping
with best practices, Internal Audit regularly monitors the
status of management action plans with respect to audit
findings to closure in order to ensure completion and
reports to the Audit Committee. Reporting also includes
identified key controls issues as well as potential controls
issues in order to provide the Audit Committee full visibility
into the status of Lenovo’s control environment. Ad hoc
reviews of areas of concern identified by management or
the Audit Committee may also be performed. During the
year, Internal Audit issued multiple reports covering most of
the operational and financial units worldwide.
Furthermore, Internal Audit is responsible for investigating
any allegations of potential violations of Lenovo’s Code
of Conduct, the Anti-Bribery and Anti-Corruption Policy,
or any other company policies as appropriate. Internal
Audit partners with Legal, Ethics and Compliance, Human
Resources, and subject matter experts where necessary
to ensure the appropriate expertise when performing these
investigations. The management of the business units, the
process owners and the Audit Committee are informed
of any required actions resulting from these reviews, and
Internal Audit monitors the corrective actions to completion.
Price-Sensitive Information
Regarding procedures and internal controls for the
handling and dissemination of price-sensitive information,
the Company is aware of its obligations under the Listing
Rules and the overriding principle that information which
is expected to be price-sensitive should be announced
immediately if it is the subject of a decision. The Company
conducts its affairs with close regard to the applicable
laws and regulations prevailing in Hong Kong and has
implemented policies and procedures which strictly prohibit
unauthorized use of confidential and sensitive information,
and has communicated to all relevant staff regarding this
matter.
Control Effectiveness
The Board, through the Audit Committee of the Company,
conducts a continuous review of the effectiveness of the
internal control system operating in the Company and
considers it to be adequate and effective. The review
covers all material controls, including financial, operational
and compliance controls, and risk management functions.
The Board is not aware of any significant areas of concern
which may affect the shareholders. The Board is satisfied
that the Company has fully complied with the code
provisions on internal controls as set forth in the CG Code.
Enterprise Risk Management
At Lenovo, risk is defined as a potential action, event or
circumstance that could impact the Company’s ability,
favorably or unfavorably, to meet its strategic goals.
Risk is an inherent part of the Company and needs
to be understood and managed properly to provide a
foundation for the Company’s sustained growth. In line
with the commitment to deliver sustainable value, Lenovo
has implemented an Enterprise Risk Management (ERM)
framework to proactively manage risks.
Lenovo’s ERM framework is effected by the Board and
management team, and is applied in strategy setting and
across all major functions of the Company. It involves:
• TheERMteam,whoisresponsibletodesign,
implement, review, and update Lenovo ERM
framework.
• AllLenovomajorfunctions,whereriskownershipis
established via the appointment of ERM Champions in
each function.
Within this framework, critical and major risks of the
business functions, especially in view of the changing
business environment, are identified and assessed to
determine the appropriate risk mitigation plans to be
implemented. These are monitored and reviewed by each
business function as well as at the group level. These
influential risks are highlighted to the Audit Committee,
along with the status of actions taken to manage these
risks.