Vodafone 2012 Annual Report Download - page 72

70
Vodafone Group Plc
Annual Report 2012
Internal control and risk management
During the year we reviewed the process by which the Group evaluated
its control environment, its risk assessment process and the way
inwhich signicant business risks were managed. The agenda was
drivenprimarily by the Group’s assessment of its principal risks and
uncertainties, as set out on pages 51 to 53. The Committee also
received regular updates from the Group’s Compliance Director on
compliance related activities where throughout the year the Group has
continued to expand its work to formalise a more centralised approach
to the co-ordination of these activities. Further we also considered the
Group Audit Director’s reports on the effectiveness of internal controls,
signicant identied frauds and any identied fraud that involved
management or employees with a signicant role in internal controls.
Oversight of the Group’s compliance activities in relation to section 404
of the Sarbanes-Oxley Act also fell within the Committee’s remit.
The Committee conducted a number of in-depth reviews in the year
covering the control environments and risk management processes
inanumber of our markets, the appropriateness of the Group’s whistle
blowing procedures, ensuring arrangements are in place for the
independent investigation and follow up of such matters, corporate
security and two sessions on information security. In light of recent
economic conditions in the eurozone the Committee also undertook
adetailed review of the country and currency risks facing the business
and the plans in place to mitigate the Group’s exposures. We have
summarised the main elements of this review on page 53 in view of the
signicance of the Group’s operations in Europe. We view these reviews
as being critical to the role of the Committee as they allow us to meet
key business leaders responsible for these areas and provide
independent challenge to their activities.
Internal audit
A substantial agenda item at each Committee meeting is the monitoring
and reviewing of the scope, extent and effectiveness of the activity of
the Group Internal Audit department. Reports from the Group Audit
Director usually include updates on audit activities, progress of the
Group audit plan, the results of any unsatisfactory audits and the action
plans to address these areas, and resource requirements of the internal
audit department. Further we receive summaries of investigations into
known or suspected fraudulent activities by both third parties and
employees. We hold private discussions with the Group Audit Director
asnecessary throughout the year and I also meet with the Group Audit
Director outside the formal committee process.
External audit
The effectiveness of the external audit process is dependent on
appropriate audit risk identication and at the start of the audit cycle
wereceive from Deloitte LLP a detailed audit plan, identifying their
assessment of these key risks. For 2012 the primary risks identied were
in relation to goodwill impairment, provisioning for current tax liabilities
and deferred tax asset recognition due to the inherent management
judgement required in these areas. These risks are tracked through the
year whenever we receive reporting from Deloitte LLP.
We hold private meetings with the external auditor at each Committee
meeting to provide additional opportunity for open dialogue and
feedback from the Committee and the auditor without management
being present. Matters typically discussed include the auditor’s
assessment of business risks and management activity thereon,
thetransparency and openness of interactions with management,
conrmation that there has been no restriction in scope placed on
themby management, independence of their audit and how they have
exercised professional scepticism. I also meet with the external audit
partner outside the formal committee process throughout the year.
Appointment and independence
The Committee considers the reappointment of the external auditor,
including the rotation of the audit partner, each year and also assesses
their independence on an ongoing basis. The external auditor is required
to rotate the audit partner responsible for the Group audit every ve
years. The current lead audit partner has been in place for three years.
Deloitte LLP have been the Company’s external auditor since its
stockmarket listing in 1988; as part of the Committee’s review of the
objectivity and effectiveness of the audit process an assessment was
undertaken in 2011 as to whether the Group should consider putting
the audit engagement out to tender. This process included the
re-proposal by Deloitte LLP of their audit approach. After extensive
discussion, the Committee felt a tender was not necessary at present
and provided the Board with its recommendation to the shareholders
on the reappointment of Deloitte LLP as external auditor for the year
ended 31 March 2012. This position will be kept under annual review.
In accordance with section 489 of the Companies Act 2006, a resolution
proposing the reappointment of Deloitte LLP as our auditor will be put to
the shareholders at the 2012 AGM. There are no contractual obligations
restricting the Committee’s choice of external auditor and we do not
indemnify our external auditor.
In its assessment of the independence of the auditor and in accordance
with the US Public Company Accounting Oversight Board’s standard on
independence, the Committee receives details of relationships between
the Company and Deloitte LLP that may have a bearing on their
independence and receives conrmation that they are independent of
the Company within the meaning of the securities laws administered by
the SEC.
During the year Deloitte LLP and member rms of Deloitte Touche
Tohmatsu Limited charged the Group £8 million (2011: £9 million, 2010:
£9 million) for audit and audit related services. The Committee approved
the fees for audit services for 2012 after a review of the level and nature
of work to be performed and after being satised by Deloitte LLP that
the fees were appropriate for the scope of the work required.
Non-audit services
As a further safeguard to help avoid the objectivity and independence
ofthe external auditor becoming compromised, the Committee
hasaformal policy governing the engagement of the external
auditortoprovide non-audit services. This policy precludes Deloitte
LLPfrom providing certain services such as valuation work or the
provision of accounting services. This policy was extended in December
2011 and now sets the presumption that Deloitte LLP should only be
engaged fornon-audit services where there is no legal or practical
alternative supplier.
For certain specic permitted services the Committee has pre-approved
that Deloitte LLP can be engaged by management, subject to the
policies set out above, and subject to specied fee limits for individual
engagements and fee limits for each type of specic service. For all
other services, or those permitted services that exceed the specied
feelimits, I as Chairman, or in my absence another member, can
pre-approve permitted services.
During the year Deloitte LLP and member rms of Deloitte Touche
Tohmatsu Limited charged the Group £1 million (2011: £1 million, 2010:
£1 million) for non-audit assignments. An analysis of the fees paid to
Deloitte LLP, for both audit and non audit services, can be found in
note4 to the consolidated nancial statements. Non-audit services
performed during the year by Deloitte LLP were primarily in relation to
non-audit related compliance matters, corporate nance activities and
debt issuance.
Committee evaluation
The Committee conducts a formal review of its effectiveness annually
and concluded that its performance was effective. A number of changes
have been agreed to be implemented for the forthcoming year. Details
of the Board and Committee evaluation process can be found under
“Performance evaluation” on page 67.
Nick Land
On behalf of the Audit and Risk Committee
22 May 2012
Corporate governance (continued)