Lenovo 2016 Annual Report Download - page 82

80 Lenovo Group Limited 2015/16 Annual Report
CORPORATE GOVERNANCE REPORT
For many years, the Company has had an integrated approach for internal control which is consistent
with the Committee of Sponsoring Organizations of the Treadway Commission (COSO) internal control
framework.
Control Activities: Policies and
procedures are implemented to
ensure organizational objectives
and risk-mitigation activities are
effectively executed.
Risk Assessment:
Risks are identified
and the likely impact
on the organization
is assessed.
Information and
Communication: Relevant
information is communicated
in an acceptable format and
timely fashion to enable
the organization to meet its
objectives.
Monitoring: The
internal control
process is continually
monitored.
Modifications are made
to improve internal
control activities
as a result of the
monitoring process.
Control Environment: The internal
organizational environment driven by the
management operating philosophy, risk
appetite, integrity, and ethical values.
Within this framework, management is responsible for setting the appropriate tone from the top,
performing risk assessments, and owning the design, implementation and maintenance of internal
controls. Other teams such as Finance, Legal, and Human Resources provide assistance and expertise to
management to assist it in undertaking its responsibilities. The Board and its Audit Committee oversee the
actions of management and monitor the effectiveness of the established controls, assisted by assurance
provided by the external and internal auditors. Lenovo’s internal control framework is designed to manage
rather than eliminate the risk of failure to achieve business objectives, and as such, provides reasonable
(rather than absolute) assurance against material misstatement or loss.
Management of internal controls
Essential to this internal control system are well defined policies and procedures that are properly
documented and communicated to employees. The corporate policies form the basis of all the Company’s
major guidelines and procedures and set forth the control standards required for the functioning of the
Company’s business entities. The policies address legal, regulatory, and operational topics, including,
for example, intellectual property, data privacy, employee health and safety, delegation of authority,
information security, and business continuity.