ING Direct 2008 Annual Report Download - page 73

ING Group Annual Report 2008
71
Section 404 Sarbanes-Oxley Act
Internal control over financial reporting
Due to the listing of ING shares on the New York Stock
Exchange, ING Group is required to comply with the SEC
regulations adopted pursuant to Section 404 of the
Sarbanes-Oxley Act, or SOX 404. These regulations require
that the CEO (the chairman of the Executive Board) and
the CFO of ING Group report and certify on an annual basis
on the effectiveness of ING Group’s internal controls over
financial reporting. Furthermore, the external auditors are
required to provide an opinion on the effectiveness of ING
Group’s internal controls over financial reporting.
Internal controls over financial reporting already existed before
the adoption of SOX 404. However, SOX 404 regulations require
management to demonstrate the effectiveness of such controls.
This implies a more formalised approach in executing our tasks.
ING Group has long-established Business Principles and a strong
internal-control culture, which all staff must adhere to. SOX 404
activities are organised along the lines of the governance structure,
and involve the participation of senior management across ING.
Following the SOX 404 process, ING is in the position to publish an
unqualified statement which denotes that the company’s internal
control over financial reporting is effective as of 31 December
2008. The SOX 404 statement by the Executive Board is included
below, followed by the report of the external auditor.
REPORT OF THE EXECUTIVE BOARD ON INTERNAL CONTROL
OVER FINANCIAL REPORTING
The Executive Board is responsible for establishing and maintaining
adequate internal control over financial reporting. ING’s internal
control over financial reporting is a process designed under the
supervision of our principal executive and principal financial
officers to provide reasonable assurance regarding the reliability
of financial reporting and the preparation of financial statements
for external purposes in accordance with generally accepted
accounting principles.
Our internal control over financial reporting includes those policies
and procedures that:
pertain to the maintenance of records that, in reasonable detail, •
accurately and fairly reflect the transactions and dispositions of
the assets of ING;
provide reasonable assurance that transactions are recorded •
as necessary to permit preparation of financial statements in
accordance with generally accepted accounting principles,
and that our receipts and expenditures are being made only
in accordance with authorisations of our management and
directors; and
provide reasonable assurance regarding prevention or timely •
detection of unauthorised acquisition, use or disposition of our
assets that could have a material effect on our financial statements.
Because of its inherent limitations, internal control over financial
reporting may not prevent or detect misstatements. Also, projections
of any evaluation of effectiveness to future periods are subject to
the risk that controls may become inadequate because of changes
in conditions, or that the degree of compliance with the policies or
procedures may deteriorate.
The Executive Board assessed the effectiveness of our internal
control over financial reporting as of 31 December 2008. In making
this assessment, the Executive Board performed tests based on
the criteria of the Committee of Sponsoring Organizations of the
Treadway Commission (COSO) in Internal Control – Integrated
Framework. Based on the Executive Board’s assessment and those
criteria, the Executive Board concluded that the company’s internal
control over financial reporting is effective as of 31 December 2008.
Our independent registered public accounting firm has audited
and issued their report on ING’s internal control over financial
reporting, which appears on the following page.
AMSTERDAM, 16 MARCH 2009
Eric Boyer de la Giroday
Acting CEO, member of the Executive Board
John Hele
Chief Financial Officer