National Grid 2015 Annual Report Download - page 40

Strategic Report
The Board is committed to protecting and enhancing our reputation and assets,
while safeguarding the interests of our shareholders. It has overall responsibility
for the Company’s system of risk management and internal control.
Internal control and risk management
National Grid is exposed to a variety of uncertainties
that could have a material adverse effect on the
Company’s financial condition, our operational
results, our reputation, and the value and liquidity
ofour shares.
The Board oversees risk management, and, as
partof this role, it reviews the main elements of our
process and sets and monitors risk appetite. Risk
appetite establishes the amount of uncertainty the
Company may seek or accept at any given time
when pursuing our strategic objectives.
The Board regularly reviews our internal controls
andrisk management processes. This year specific
consideration was given to the guidance in the new
UK Corporate Governance Code 2014 (the New
Code) which applies to the Company in the next
fiscal year and refinements to our processes will be
introduced, as appropriate, over the coming year.
Risk management approach
Our Company-wide corporate risk management
process provides a framework through which we can
consistently identify, assess and prioritise, manage,
monitor and report risks, as shown in the diagram
below. The process is designed to support the
delivery of our vision and strategy as described
onpages 14 and 15.
Our process involves a continuous cycle of bottom-
up review and reporting and top-down review
andfeedback.
All our business functions participate in the bottom-
up risk management process. They identify the main
risks to achieving their objectives and the actions
being taken to manage and monitor them. They
assess each risk by considering the potential ‘worst
case credible’ financial and reputational impacts
andhow likely the risk is to materialise. The risks we
identify are collated in risk registers and are reported
at functional and regional levels of the Company.
Therisk registers also describe the adequacy of our
existing risk controls.
An important feature of our risk management
process is that each business function owns and
isresponsible for managing its particular risks.
Acentral risk management team acts as an advisory
function and also provides independent challenge
and review. Thisteam partners with the business
functions through nominated risk liaisons and
collaborates withassurance teams and specialists,
such as internal audit and compliance management,
to sense check risk information.
Regional senior management regularly review and
debate the outputs of the bottom-up process and
agree the prioritisation of the risks. The main risks for
the UK and US businesses are highlighted in regional
risk profiles and reported to the Chief Executive
through quarterly performance reports. An overview
ofcurrent risk themes for the UK and US businesses
isprovided on pages 27 and 34 respectively.
Our main strategic uncertainties or ‘principal risks’
forthe Company are developed through top-down
discussions with the Executive leadership team.
These risks are reported and debated with the
Executive Committee and Audit Committee every
sixmonths.
The Board participates in an annual risk workshop
tomake sure that the principal risks remain closely
aligned to our strategic aims and that no important
risks (or combination of risks) are being overlooked.
Inaddition, the Board considers emerging risks
(uncertainties that are still developing and sit outside
the principal risks profile) together with our strategy
team’s annual long-term update.
The outcomes from each level of the risk review
process are fed back to the relevant teams and
incorporated as appropriate into the next cycle
ofourongoing process as shown below.
Feedback and reporting
Executive
Committee
Audit
Committee
National Grid
Board
Regional
Executive
Directors
Corporate Risk
team
Business functions
Top-down feedback
Bottom-up reporting
Risk management process
Risk profiles
Risk reports
I
d
e
n
t
i
f
y
r
i
s
k
s
A
s
s
e
s
s
&
p
r
i
o
r
i
t
i
s
e
r
i
s
k
s
Vision
strategy
objectives
Monitor
and report
M
a
n
a
g
e
r
i
s
k
s
38