Vodafone 2016 Annual Report Download - page 24

Strengthening our approach to risk management
To support the implementation of this framework, the following actions have been put in place during the 2016 nancial year.
a Created a Group Risk function reporting to the Group Risk & Compliance Director
a Brought together a global risk community from local markets and specialist risk areas to support the delivery of the framework and share
best practices
a Completed an Integrated assurance mapping project to identify and enable oversight into the mitigations and level of assurance in place for the
key risks in all local markets and entities
a Assigned Executive Committee owners and Senior Leadership champions for each principal risk
Further enhancements are planned during the 2017 nancial year, including the implementation of a Risk & Integrated Assurance platform that can
bring the framework to life and support the ongoing development of integrated assurance across the “three lines of defence”1.
Identifying and managing
our risks
We have a clear framework for identifying and managing risk, both
at an operational and strategic level. Our risk identication and mitigation
processes have been designed to be responsive to the ever-changing
environments in which we operate.
Risk management
Our risk management framework
Vodafone needs to take risks and assume exposures to achieve its
strategy. Risk, within agreed and dened parameters, is essential to the
success of Vodafone. Equally, failure to suitably manage risk may have
an adverse impact upon Vodafone’s strategic goals and objectives.
Vodafone has recently introduced an enhanced global framework
designed to identify risks; set risk appetite: put in place appropriate
measures to ensure risks are properly managed and monitored;
and facilitate informed decision making. The framework, as set out
in the diagram, ensures we have one, company-wide approach to risk
management, with local oversight and approvals.
Identify
a Risks identied
in each Vodafone
local market
and entity
a Strategic risk
reviews with
Senior Leadership
a Group principal risks
reviewed and agreed
with the Board
Measure
a Risk appetites set
by the Board for all
principal risks and
cascaded down
a Standardised scoring
and categorisation
allows consolidation
and escalation
across Group
Manage
a Controls and
mitigating
actions identied
and measured
a Risk action plans
created to control
risks outside
of appetite
Monitor
a Integrated assurance
mapping identies all
levels of control and
oversight in place
a Effectiveness
of control and
oversight is tested
across the “three
lines of defence”1
Report
a Inform the Board
and Executive
Committee on how
effectively risks are
being managed
versus appetite
a Group-wide,
consolidated
views shared with
risk managers
Note:
1 A term used to describe the systematic approach to how we manage risk and provide assurance to the Board that risks are managed effectively. The rst line of defence typically sits in the
business operations (e.g. Technology), the second line of defence has oversight over the rst line of defence (e.g. Compliance or Risk Management), and the third line of defence are the
independent assurance providers (e.g. Internal Audit).
Vodafone Group Plc
Annual Report 2016
22