Experian 2008 Annual Report Download - page 51

49Experian Annual Report 2008
Introduction 2 – 5
Business review 6 – 37
Financial statements 65 – 144
Governance Corporate governance statement Governance Corporate governance statement
The board confirms that there is an ongoing process for identifying, evaluating and managing the significant risks
faced by the Group, including those risks relating to social, environmental and ethical matters. This process was in
place throughout the year under review and up to the date of approval of the annual report and meets the requirements
of the Code. For certain joint arrangements, the board places reliance upon the systems of internal control operating
within the partners’ infrastructure and the obligations upon partners’ boards relating to the effectiveness of their own
systems. In the board’s view, the information it received was sufficient to enable it to review the effectiveness of the
Group’s system of internal control in accordance with the ‘Internal Control Revised Guidance for Directors’ contained
in the Code. The audit committee has kept under review the effectiveness of this system of internal control and has
reported regularly to the board.
The key procedures, which operated throughout the year, were as follows:
Risk assessment:
The Group set out its objectives clearly as part of its planning process and organisation design. These objectives
l
were then incorporated as part of the planning cycle and supported by the use of both financial and non-financial key
performance indicators.
Risks were methodically anticipated, identified, assessed and appropriately mitigated as part of an enterprise-wide risk
l
management process operating throughout the Group on an ongoing basis and headed by an Executive Risk Management
Committee.
Senior management made presentations on risk to the audit committee, which reported regularly to the board on the risks
l
facing the Group’s business.
The audit committee has delegated responsibility from the board for reviewing the effectiveness of the Group’s
l
internal controls and received its annual report on the controls over these risks. This included risks arising from social,
environmental and ethical matters.
Control environment and control activities:
The Group has established procedures for delegated authority which ensure that decisions that are significant, either
l
because of their value or the inherent degree of risk, are taken at an appropriate level.
The Group has implemented appropriate strategies to deal with each significant risk that has been identified. These
l
strategies include internal controls, insurance and specialised treasury instruments.
The Group sets out principles, policies and standards to be adhered to throughout its business. These include risk
l
identification, management and reporting standards, ethical principles and practice, accounting policies, treasury policy,
information security policy and policy on fraud and whistleblowing.
Information and communication:
The Group has a comprehensive system of budgetary control, including monthly performance reviews for each major
l
business. These reviews are at a detailed level within each region and global business line and at a high level for the board.
On a monthly basis, the achievement of business objectives, both financial and non-financial, was assessed using a range
l
of performance indicators. These indicators were regularly reviewed to ensure that they remain relevant and reliable.
The Group had whistleblowing procedures in place for employees to report suspected improprieties.
l
Monitoring:
A range of procedures were used to monitor the effective application of internal control in the Group, including
l
management assurance, through the ongoing risk management process, and independent assurance, through internal
audit reviews and reviews by specialist third parties.
The internal audit department’s responsibilities include reporting to the audit committee on the effectiveness of internal control
l
systems, focusing on those areas considered to be of greatest risk to the Group.
Follow-up processes were used to ensure there was an appropriate response to changes and developments in risks and
l
the control environment.