Lenovo 2015 Annual Report Download - page 72

70 Lenovo Group Limited 2014/15 Annual Report
CORPORATE GOVERNANCE REPORT
For many years, the Company has had an integrated approach for internal control which is consistent with the
Committee of Sponsoring Organizations of the Treadway Commission (COSO) internal control framework.
Risk Assessment
Risks are identified and the likely impact
on the organization is assessed.
Control Environment
The internal organizational environment
driven by the management operating
philosophy, risk appetite, integrity, and
ethical values.
Control Activities
Policies and procedures are implemented
to ensure organizational objectives and
risk-mitigation activities are effectively
executed.
Information and Communication
Relevant information is communicated in
an acceptable format and timely fashion
to enable the organization to meet its
objectives.
Monitoring Activities
The internal control process is continually
monitored. Modifications are made to
improve internal control activities as a
result of the monitoring process.
Risk Assessment
Function
Division
Operating Unit
Entity
Information & Communication
Control Activities
Control Environment
Monitoring Activities
Compliance
Reporting
Operations
Within this framework, management is responsible for setting the appropriate tone from the top, risk assessment,
and the design, implementation and maintenance of internal controls, while the Board and its Audit Committee
oversee the actions of management and monitor the effectiveness of the established controls. Other teams such as
Finance, Legal, and Human Resources provide assistance and expertise to management to assist it in undertaking
its responsibilities.
Management of internal controls
Essential to the internal control system are well defined policies and procedures that are properly documented and
communicated to employees. The corporate policies form the basis of all our major guidelines and procedures
and set forth the control standards required for the functioning of our business entities. The policies address legal,
regulatory, and operational topics, including, for example, intellectual property, data privacy, employee health and
safety, delegation of authority, information security, and business continuity.