Nokia 2014 Annual Report Download - page 87

85
Corporate governance
NOKIA IN 2014
Nokia Group Leadership Team and the
President and CEO
Under its Articles of Association, Nokia has
a Nokia Group Leadership Team that is
responsible for the operative management
of Nokia. The Chairman and members of the
Nokia Group Leadership Team are appointed
by the Board. Nokia Group Leadership Team
is chaired by the President and CEO. The
President and CEO’s rights and responsibilities
include those allotted to the President under
Finnish law.
More information on the members of the
Nokia Group Leadership Team is available on
pages 90 and 91 of this annual report and
on our website at company.nokia.com/en/
about-us/corporate-governance.
Main features of the internal
control and risk management
systems in relation to the
nancial reporting process
The Board’s Audit Committee is responsible
for, among other matters, risk management
relating to the nancial reporting process and
assisting the Board’s oversight of the risk
management function. Nokia also has a Risk
Management Policy which outlines Nokia’s risk
management policies and processes more
extensively and which is approved by the Audit
Committee. Overseeing risk is an integral part
of Board deliberations. The Board’s role
in overseeing risk includes risk analysis and
assessment in connection with nancial,
strategy and business reviews, updates and
decision-making proposals. Nokia applies
asystematic approach to risk management
across business operations and processes
with the Nokia strategy and nancial plans
approved by the Board as a baseline.
Accordingly, risk management at Nokia is
notaseparate process, rather a normal
dailybusiness and management practice.
The management is responsible for
establishing and maintaining adequate
internal control over nancial reporting for
Nokia. Nokia’s internal control over nancial
reporting is designed to provide reasonable
assurance to the management and the Board
regarding the reliability of nancial reporting
and the preparation and fair presentation of
published nancial statements.
The management conducts a yearly
assessment of Nokia’s internal controls over
nancial reporting in accordance with the
Committee of Sponsoring Organizations
(“COSO”) framework (2013 version) and the
Control Objectives for Information and related
Technology of internal controls. For 2014, the
assessment was performed based on a top
down risk assessment of Nokia’s nancial
statements covering signicant accounts,
processes and locations, corporate level
controls, control activities and information
systems’ general controls.
As part of its assessment the management
documented:
■ the corporate-level controls, which create
the “tone from the top” containing the
Nokia values and Code of Conduct and
provide discipline and structure to decision
making processes and ways of working.
Selected items from Nokia’s operational
mode and governance principles are
separately documented as corporate
level controls;
■the control activities, which consist of
policies and procedures to ensure the
management’s directives are carried out
and the related documentation is stored
according to Nokia’s document retention
practices and local statutory requirements;
■the information systems’ general controls
to ensure that sufficient information
technology general controls, including
change management, system development
and computer operations, as well as access
and authorizations, are in place; and
■ the significant processes, including seven
financial cycles and underlying IT cycle,
identified by Nokia to address control
activities implementing a top down risk
based approach. These cycles include
revenue cycle, inventory cycle, purchase
cycle, treasury cycle, human resources
cycle, record to report cycle, tax cycle and IT
cycle. Financial cycles have been designed
to: (i) give a complete end-to-end view of all
financial processes; (ii) identify key control
points; (iii) identify involved organizations;
(iv) ensure coverage for important accounts
and financial statement assertions; and
(v) enable internal control management
within Nokia.
Further, the management also:
■ assessed the design of the controls in
place aimed at mitigating the financial
reporting risks;
■ tested operating effectiveness of all
key controls;
■ evaluated all noted deficiencies in internal
controls over financial reporting in the
interim and as of year-end; and
■ performed a quality review on assessment
documentation and provided feedback
for improvement.
In conclusion, the management has assessed
the eectiveness of Nokia’s internal control
over nancial reporting, at December 31,
2014, and concluded that such internal
control over nancial reporting is eective.
Nokia also has an internal audit function that
acts as an independent appraisal function by
examining and evaluating the adequacy and
eectiveness of Nokia’s system of internal
control. Internal audit resides within the Group
Chief Financial Ocer’s organization and
reports to the Audit Committee of the Board.
The head of the internal audit function has
direct access to the Audit Committee,
without involvement of the management.