Barclays 2012 Annual Report Download - page 67

Effectiveness of internal controls
The Directors review the effectiveness of the system of internal control
semi-annually. An internal control compliance certification process is
conducted throughout the Group in support of this review. Key controls
are also assessed on a regular basis for both design and operating
effectiveness. Issues arising out of business division risk and control
assessments are considered to identify pervasive themes. Where
appropriate, individually significant issues or those affecting more
than one business division may be categorised as having Group level
significance and are reported to the Board Audit Committee via
the Group Governance and Control Committee. The Board Audit
Committee monitors resolution of any identified control issues
of Group level significance through to a satisfactory conclusion.
In addition, regular reports are made to the Board Audit Committee
by management, internal audit and the finance, compliance and
legal functions covering in particular financial controls, compliance
and other operational controls.
Risk management and internal control framework
Processes are in place for identifying, evaluating and managing the
significant risks facing the Group in accordance with the guidance
‘Internal Control: Revised Guidance for Directors on the UK Corporate
Governance Code’ published by the Financial Reporting Council (the
Turnbull Guidance). These processes include an attestation procedure
which requires all significant processes and identified material risks to
be assessed and recorded, together with the related key controls by the
Heads of Divisions, Businesses and Functions. As part of this, specific
consideration is given to relevant information, including as a minimum,
legal entities; any open control issues; any outstanding internal and
external audit findings; regulatory reviews and any outstanding
regulatory compliance matters; compliance with Group level policies;
records of operational incidents and loss/risk events; experience of all
types of fraud; and any other material control-related matters that have
been raised either by management or via independent/external review.
The status of any remediation in connection with these matters is also
considered. The results of this attestation procedure were reported to
the Board Audit Committee in February 2013, when it was noted that
although several of the Group Key Risk Owner attestations received refer
to outstanding control design/operating effectiveness issues, these had
all been assessed against risk appetite and none of these had prevented
the Heads of Divisions, Businesses or Functions from providing a
Turnbull statement. All these issues had identified remediation tasks and
attributed timescales for resolution (or timescales being determined).
The Board regularly reviews these processes through its principal Board
Committees. Regular risk reports are made to the Board covering risks
of Group significance including credit risk, market risk, funding risk,
operational risk and legal risk. The Board Risk Committee receives
reports covering the Principal Risks as well as reports on risk
measurement methodologies and risk appetite. Further details of risk
management procedures are given in the Risk management section on
pages 313-343.
As discussed in the Risk management section of the Annual Report a
number of matters were public during the course of 2012 which related
to failings in the design and/or operation of certain controls other than
those over financial reporting. Whilst the matters were disclosed in
2012, the failings giving rise to those issues occurred in prior periods.
Management has reviewed the specific control processes impacted
and concluded that these are now designed and operating effectively.
Areas of ongoing control remediation are not considered to constitute
material control failings.
Controls over financial reporting
A framework of disclosure controls and procedures is in place to
support the approval of the Group’s financial statements. The Legal and
Technical Review Committee is responsible for reviewing the Group’s
financial reports and disclosures to ensure that they have been subject
to adequate verification and comply with legal and technical
requirements, and reports its conclusions to the Disclosure Committee.
The Disclosure Committee, which is chaired by the Group Finance
Director, considers the content, accuracy and tone of the disclosures,
reporting its conclusions to the Group Executive Committee and the
Board Audit Committee, both of which review its conclusions and
provide further challenge. Finally, the Board reviews and approves
results announcements and the Annual Report for publication and
ensures that appropriate disclosures have been made. This governance
process is in place to ensure both management and the Board are given
sufficient opportunity to review and challenge the Group’s financial
statements and other significant disclosures before they are made
public. It also provides assurance for the Group Chief Executive and
Group Finance Director when providing certifications as required
under the Sarbanes-Oxley Act 2002 and recommended by the
Turnbull Guidance.
Throughout the year ended 31 December 2012, and to date, the Group
has operated a system of risk management and internal control which
provides reasonable assurance of effective and efficient operations
covering all controls, including financial and operational controls and
compliance with laws and regulations.
Management’s report on internal control over financial reporting
Management is responsible for establishing and maintaining adequate
internal control over financial reporting. Internal control over financial
reporting is a process designed under the supervision of the principal
executive and principal financial officers to provide reasonable
assurance regarding the reliability of financial reporting and the
preparation of financial statements for external reporting purposes
in accordance with International Financial Reporting Standards (IFRS)
as adopted by the European Union and the International Accounting
Standards Board (IASB).
Internal control over financial reporting includes policies and procedures
that pertain to the maintenance of records that, in reasonable detail,
accurately and fairly reflect transactions and dispositions of assets;
provide reasonable assurances that transactions are recorded as
necessary to permit preparation of financial statements in accordance
with IFRS and that receipts and expenditures are being made only in
accordance with authorisations of management and the respective
Directors; and provide reasonable assurance regarding prevention or
timely detection of unauthorised acquisition, use or disposition of assets
that could have a material effect on the financial statements.
Internal control systems, no matter how well designed, have inherent
limitations and may not prevent or detect misstatements. Also,
projections of any evaluation of effectiveness to future periods are
subject to the risk that internal controls may become inadequate
because of changes in conditions, or that the degree of compliance
with the policies or procedures may deteriorate.
barclays.com/annualreport Barclays PLC Annual Report 2012 I 65
The strategic report Governance Risk review Financial review Financial statements Risk management Shareholder information