Merck 2014 Annual Report Download - page 137

132 GROUP MANAGEMENT REPORT → Report on Risks and Opportunities
INFORMATION TECHNOLOGY RISKS
Merck KGaA, Darmstadt, Germany, uses a variety of IT systems
and processes in order to optimally focus and adequately support
its globalization. Trends in information technology offer various
opportunities but also harbor risks for the Group.
Risks due to cybercrime and the failure of business-
critical IT applications
Increasing international networking and the related possibility of
IT system abuse are resulting in cybercrime risks for the Group,
such as the failure of central IT systems, the disclosure of confi-
dential research and business development data, the manipulation
of IT systems in chemical process control, or an increased burden
or adverse impact on IT systems as a result of virus attacks. The
entire Group has global security guidelines and information pro tec-
tion management for IT and non-IT areas, each with organizational
and technical standards for access rights as well as information
and data protection, based on ISO27001.
Additionally, IT applications used globally form the basis for
the contractual delivery of products and solutions. The failure of
business-critical IT applications could therefore have a direct in-
fluence on the company’s ability to deliver; likewise this applies
to the failure of a data center. To achieve the required service
quality, the Group uses a quality management system certified to
ISO20000:2011. In addition, to reduce the risk of failure, the com-
pany operates several redundantly designed data centers.
Despite the mitigating measures taken and functional continu-
ity plans, the effects of cybercrime or the failure of business-criti cal
IT applications and their influence on the net assets, financial
position and results of operations are considered a medium risk
owing to potentially significant negative effects.
ENVIRONMENTAL AND SAFETY RISKS
As a company with global production operations, the Group is
exposed to risks of possible damage to people, goods and its rep-
utation. Audits, consulting and training on environmental protec-
tion and occupational health and safety minimize these risks to
people and the environment. In order to ensure the continuity of
plant and equipment, Merck KGaA, Darmstadt, Germany, moni-
tors these risks both at its own sites as well as at suppliers and
contract manufacturers. By adhering to high technical standards,
our rules of conduct and all legal requirements in environmental
protection and occupational health and safety, the Group ensures
the preservation of goods and assets. Sufficient appropriate
accounting measures have been taken for the environmental risks
known to us. Nevertheless, the company classifies these as a high
risk since a critical negative impact on the financial position
cannot be ruled out.
ACQUISITION RISKS
Irrespective of the fact that Merck KGaA, Darmstadt, Germany, has
successfully completed acquisitions made in the past, the risk of
conducting the acquisition and integration exists for future trans-
actions. This includes among other things the inability to meet
sales volume targets and higher integration costs than expected,
as well as the failure to meet synergy goals. In addition, the cur-
rently planned acquisition of Sigma-Aldrich is subject to antitrust
clearance and if the acquisition is not conducted, fines could
become payable to the acquisition target. Thanks to strong due
diligence processes and closely managed integration processes, the
Group rates the probability of occurrence of this risk as unlikely.
However, owing to the amount of potential fines, the overall risk
could have a critical negative effect on the net assets, financial
position and results of operations and is therefore classified as a
medium risk.