RISK MANAGEMENT
Managing risks is explicitly on the
agenda of management in order to
protect the business from the effects
of disasters, failures and reputational
damage. Continuity and sustainability
of the business is as important to the
stakeholders as growing and operating it.
44 REPORT OF THE EXECUTIVE BOARD
HEINEKEN N.V. ANNUAL REPORT 200L
Risk management and control system
The Heineken risk management and control systems aim
to ensure at a reasonable level of assurance, that the risks
of the Company are identified and managed and that the
operational and financial objectives are met, in compliance
with applicable laws and regulations. A system of controls to
ensure adequate financial reporting is included. Heineken's
internal control system is based on the COSO Internal
Control Framework.
Risk appetite
The Company is recognised by its drive for quality,
consistency and financial discipline. Entrepreneurial spirit
is encouraged across the Group to seek opportunities
supporting continuous growth (like business development
and innovation), whilst taking controlled risks.
Risk profile
Heineken is a single-product company, with a high level of
commonality in its worldwide business operations spread over
many mature and emerging markets. The worldwide activities
are exposed to varying degrees of risk and uncertainty, some
of which, if not identified and managed, may result in a
material impact on a particular operating company, but may
not materially affect the Group as a whole. Compared to other
leading beer companies, Heineken has a much wider spread
of its businesses and risks across the globe.
Risk management
Doing business inherently involves taking risks, and by
managing these risks Heineken strives to be a sustainable and
performance-driven company. Structured risk assessments
are part of, amongst others, change projects, business
planning and performance monitoring process, common
process and system implementations, acquisitions and
business integration activities. The risk management and
control systems are considered to be in balance with
Heineken's risk profile, although such systems can never
provide absolute assurance. Following Heineken's continuing
growth and changing risk profile, the Company's risk
management and control systems are subject to continuous
review and adaptations.
Responsibilities
The Executive Board, under the supervision of the
Supervisory Board, has overall responsibility for Heineken's
risk management and control systems. Regional and
operating company management are responsible for
managing performance, underlying risks and effectiveness
of operations, within the rules set by the Executive Board,
supported and supervised by Group departments.
Heineken Company Rules
The Heineken Company Rules are a key element of the risk
management system and are in place to set the boundaries
within which operating companies should conduct their
business. A governance procedure, and activities on
continuous awareness and compliance are in place, managed
by the Heineken Company Rules Network, which meets on a
semi-annual basis. The Assurance Letter, signed annually by
all Regional Presidents, General and Finance Managers
worldwide, provides additional comfort on financial
reporting and selected rules.
Business planning and performance monitoring
The main pillars of Heineken's internal governance activities
are the annual business planning and performance
monitoring. Operating companies' strategies, business plans,
key risks and quarterly performance are discussed with
Regional Management. Regional performance is discussed
with the Executive Board. The approved business plans
include clear objectives, performance indicators and target
setting, which provide the basis for monitoring performance
compared to business plan. These plans also contain an
annual assessment of the main risks (including mitigation
plans) and financial sensitivities, although these assessments
require further improvement. Heineken made good progres:
on its Company-wide programme to create a more
integrated management information environment for
reporting to Regions and Group.
Internal control in operating companies
Heineken is progressing the Group-wide development
and implementation of best practice processes supported
by common IT systems. At the end of 2008, 69 per cent
of Heineken's operations (based on revenue) worked in
accordance with the evolving Heineken Common System.
Next to the Supply Chain area, also other functions
work on improving documentation, measurement and
performance of processes under the Business Process
Management Initiative.
Best practice key control frameworks, to ensure the integrity
of the information processing in supporting the day-to-day
transactions and financial and management reporting, are
embedded in developed common processes/systems.
Internal Audit is strongly involved in monitoring controls
based on a common audit approach, whilst plans are in
preparation to strengthen controls monitoring by management