TomTom 2006 Annual Report Download - page 36

Management Board’s Report
on Risk Management and Internal Control 34 TomTom Annual Report 2006
Management Board’s report
on Risk Management and Internal Control
The Board believes that the Company maintains an
adequate and effective system of risk management
and internal control which complies with the Dutch
Code of Corporate Governance.
The Company views the careful management of risk
as a key management activity. The Board reviews the
effectiveness of the systems of internal control relative
to strategic, financial, operational and compliance risks.
The systems of internal control are designed to manage,
rather than eliminate, the risk of failure to achieve business
objectives and can provide reasonable, but not absolute,
assurance against material misstatement or loss. The
Board discusses risk management and internal controls
with the Supervisory Board on a quarterly basis.
The Company embeds risk management into periodic
planning and internal control mechanisms. A top-down
approach is followed where we identify the major risks
which could affect our business and the likelihood of
problems arising.
The Group’s systems of internal controls are designed
and operated to mitigate the impact of risks affecting
the group. As such, the controls are subject to regular
review as the business changes.
Key features of the systems of internal control are:
— clearly defined lines of accountability and delegation
of authority, and comprehensive reporting and analysis
against approved budgets;
— minimisation of operating risk by ensuring that the
appropriate infrastructure, controls, systems and people
are in place throughout the businesses. Key policies
employed in managing operating risk involve
segregation of duties, authorisation of transactions,
monitoring, financial and management reporting;
— a Code of Conduct and a Code of Ethics which are
available to staff on our intranet; the Code of Conduct
is also available on the TomTom website
(www.tomtom.com); and
— centralised treasury operations to manage the
investment of cash balances and the exposure to
currency transaction risks. Treasury policies, risk limits
and monitoring procedures are approved annually by
the Supervisory Board.
Assurance on compliance with systems of internal
control and on their effectiveness is obtained through
management reviews, control self-assessment, internal
audits and testing of certain aspects of the internal financial
control systems by the external auditors during the course
of their audit.
Significant improvements in internal control during the
year included:
— the development and implementation of a new
medium- term Internal Audit Plan;
— the creation of a Quality Assurance function to manage
risks relating to the supply chain and products; and
— the implementation of a new Product Creation
Framework.
Internal control over financial reporting
Internal control over financial reporting is a process which
is managed by the Group Financial Controller and Chief
Financial Officer to provide reasonable assurance regarding
the reliability of management and financial reporting in
accordance with generally accepted accounting principles.
Controls over financial reporting include policies and
procedures that provide reasonable assurance that:
— commitments and expenditures are appropriately
authorised by the management and directors of
the Company;
— records are maintained accurately and fairly reflect
transactions;
— the unauthorised acquisition, use, or disposal of the
Company’s assets that could have a material effect
on our financial statements would be detected on a
timely basis; and
— transactions are recorded as necessary to permit the
preparation of financial statements in accordance with
generally accepted accounting principles.
Due to inherent limitations, internal controls over financial
reporting may not prevent or detect misstatements. Risk
management and control systems provide reasonable
assurance that the financial reporting does not contain
any material inaccuracies. No material weaknesses were
identified during the year. These systems are deemed
to have functioned properly during the year under review,
and there is currently no indication they will not continue
to do so in the forthcoming period.
Amsterdam, 22 February 2007