Aviva 2009 Annual Report Download - page 92

90
Aviva plc Corporate governance report continued
Annual Report and Accounts 2009
undertaken as well as monitoring the completion of any Group
level actions to a satisfactory conclusion.
Control activities
A formal policy framework has been rolled out across the
Group, which sets out and governs minimum standards around
the management of financial and non-financial risks and the
Group’s approach to internal controls.
Compliance with the policy framework is regularly assessed
and reported upon on a quarterly basis. Such reporting includes
any moves outside the Group’s risk appetite and tolerance and
any emerging issues. Appropriate action plans are developed
and undertaken where such moves are identified.
In addition to the regular reporting, a six monthly Group
policy framework compliance management certification process
is in place. Any risks, control weaknesses, or non-compliance
with the Group policy framework or local delegation of
authority must be highlighted as part of this process.
Internal Controls over financial reporting
A Group Reporting Manual including International Financial
Reporting Standards (IFRS) and Market Consistent Embedded
Value (MCEV) requirements has been defined and rolled out
across the Group. A Financial Reporting Control Framework
(FRCF) is in place across the Group. FRCF relates to the
preparation of reliable financial reporting and preparation of
local and consolidated financial statements in accordance with
IFRS and MCEV. FRCF also allows compliance with the
requirements of the Sarbanes-Oxley Act 2002.
The FRCF process follows a risk based approach, with
management identification, assessment (documentation and
testing), remediation as required, reporting and certification
over key financial reporting related controls. Management
quality assurance procedures over the application of the FRCF
process and FRCF controls are undertaken regularly. The results
of the FRCF process are signed off by business unit and regional
Chief Executives and Chief Financial Officers and at a Group
level by the Group Chief Executive and Chief Financial Officer.
The Disclosure Committee, which has the role of overseeing
the design and effectiveness of the Group’s disclosure controls,
for both financial and non-financial information, evaluates the
Group’s disclosure controls and reviews and endorses the
Group’s key periodic external reports including the consolidated
financial statements. This Committee is chaired by the Chief
Financial Officer and reports to the Audit Committee and
Executive Committee. A Group Technical Committee, reporting
to the Disclosure Committee is in place, which presides over
significant technical matters, reviewing technical decisions
including key judgements, issues and application of
assumptions.
Risk Management
An Enterprise wide Risk Management Framework (ERMF),
designed to identify, evaluate, manage and monitor significant
risks to the achievement of business objectives is in place and
embedded throughout the Group. The Group Risk function
facilitates the implementation of the risk management
framework, with management owning the management and
monitoring of risks. The Group Risk function assesses and
reports significant risks identified across the Group and
corresponding action plans to the Executive Committee,
the Risk and Regulatory Committee and Audit Committee.
A company's objectives, its internal organisation and the
environment in which it operates are continually evolving and,
as a result, the risks it faces are continually changing.
Management in conjunction with the Group Risk function
monitors the risk profile of business units, regions and the
Group on a regular basis. On a quarterly basis, risk reports,
setting the risk profiles, risk exposures outside Group risk
appetite and action plans within financial, operational,
compliance and strategic risk categories, are reported by the
Group risk function. A consolidated Group wide risk profile
including residual risk levels and action plans are considered
by the Executive Committee and the Risk and Regulatory
Committee. Regional executive committees and management
receive and similarly consider local risk reporting.
Where significant risks outside Group risk appetite are identified
an immediate escalation process is in place. Such significant
risks are reported by the Chief Risk Officer to the Executive
Committee, the Risk and Regulatory Committee and Audit
Committee, along with any proposed mitigating actions.
The risk management process has been in place for the year
under review and up to the date of approval of the annual
report and accounts.
Internal audit
The Group’s internal audit function provides independent
assurance to management on the effectiveness of the internal
control systems and, the adequacy of these systems to manage
business risk and to safeguard the Group’s assets and resources.
The internal audit function also provides objective independent
assurance on risk and control to both the Audit Committee and
the Risk and Regulatory Committee.
Throughout 2009, the internal audit function through the
Chief Audit Officer provided quarterly reporting on issues arising
and the status of action items to the Audit Committee and Risk
and Regulatory Committee. Similar reporting is undertaken on a
regional and business unit basis to local executive management
and local audit committees. The effectiveness of the Group’s
internal audit function is reviewed annually by the Audit
Committee.
Share capital and control
The information required to be provided by the directors
pursuant to section 992 of the Companies Act 2006 can be
found on page 83 of the Directors’ report.
Communication with shareholders
The Company places considerable importance on
communication with shareholders and engages with them on
a wide range of issues.
The Group has an ongoing programme of dialogue and
meetings between the executive directors and institutional
investors, fund managers and analysts. At these meetings a
wide range of relevant issues including strategy, performance,
management and governance are discussed within the
constraints of information already made public.
The Company’s investor relations department is dedicated
to facilitating communication with institutional investors.
The directors consider it important to understand the views of
shareholders and, in particular, any issues which concern them.
The Board receives reports on matters that have been raised
with management at the regular meetings held with the
Company’s major investors. During the year the Chairman and
the Senior Independent Director held a meeting with the major
institutional investors and attended investor meetings with
management. In addition, the Senior Independent Director is
available to meet with major investors to discuss any areas of
concern that cannot be resolved through normal channels of
investor communication, and arrangements can be made to