Information Technology
Code of Business Conduct and Whistle-blowing
jpervision
nancial reporting
Main risks
Strategic risks
Heineken brand and Company reputation
Heineken's worldwide operations are highly dependent on
the availability and integrity of its (common) information
systems. IT processes and infrastructures are to a large
extent centralised and outsourced to professional outsourcing
partners. Structured IT Risk monitoring processes are in
place, which includes clear agreements on assurance from
IT outsourcing partners. The harmonisation, centralisation
and outsourcing of IT have a positive impact on the overall
control environment.
The Code of Business Conduct and Whistle-blowing
procedures are applicable to all majority-owned Operating
Companies, regional offices and Head Office. Compliance is
supported through continuous monitoring of effectiveness
and rotational audits. Employees may report suspected
cases of serious misconduct to their direct superior, the local
Trusted Representative or anonymously to an independently
un confidential helpline. The Integrity Committee oversees
he functioning of the Whistle-blowing procedure and reports
bi-annually to the Executive Board and Audit Committee on
reported cases and effectiveness of the procedure. In the
2ar under review, Heineken revised and relaunched the
ode of Business Conduct, and brought the Whistle-blowing
rocedure in line with Data Privacy regulations.
new case-management system and e-learning tool for
perating Companies will be implemented early 2010.
he Executive Board oversees the adequacy and functioning
f the entire system of risk management and internal control,
ssisted by Group departments. Group Internal Audit provides
ndependent assurance and advice on the Risk Management
nd Internal Control Systems. The Assurance Meetings
versee the adequacy and operating effectiveness of the Risk
'anagement and Internal Control Systems in their respective
nvironments at both local and regional level. Regional
lanagement and Group Internal Audit participate in the
ical meetings in order to ensure effective dialogue and
ansparency. The outcome and effectiveness of the Risk
ianagement and Internal Control Systems are discussed
ith the Executive Board and the Audit Committee.
he risk management and control systems over financial
eporting contain clear accounting policies, a standard
hart of accounts and Assurance Letters signed by regional
nd local management. The Heineken common systems and
mbedded control frameworks that have been implemented
i a large number of the Operating Companies support
ommon accounting and regular financial reporting
i standard forms. Testing of the key controls relevant
or financial reporting is part of the common Internal
mdit Approach.
The worldwide external audit activities provide additional
assurance on true and fair presentation of the financial
reporting at the Operating Company level. Within the scope
of the external auditors' financial audit assignment, they also
report on internal control issues through their management
letters, and they attend the regional and certain local
assurance meetings.
In 2009, special attention was given to the continuous
integration of financial reporting of the acquired businesses
from former Scottish Newcastle and other acquisitions,
including transfer to the Heineken Accounting Policies.
Almost all acquired companies have already implemented
the Heineken standard chart of accounts.
The internal risk management and control systems, as
described in this section, provide a reasonable assurance
that the financial reporting does not contain any errors of
material importance. The risk management and control
systems worked properly in the year under review.
This statement cannot be construed as a statement in
accordance with the requirements of Section 404 of the US
Sarbanes-Oxley Act, which is not applicable to Heineken N.V.
Under the explicit understanding that this is not an
exhaustive list, Heineken's main risks are described below,
including the mitigation measures. Risks concerning
the Heineken brand and Company reputation, economic
downturn, volatility of input costs, exchange and interest
rates, availability and cost of capital and increasing
legislation (such as alcohol excise duties and anti-trust)
affecting the business are considered the most significant
risks. The main Company risks have been discussed with
the full Supervisory Board.
As both the Group and its most valuable brand carry the
same name, reputation management is of utmost importance.
Heineken enjoys a positive corporate reputation and our
Operating Companies are well respected in their regions.
Constant management attention is directed towards
enhancing Heineken's social, environmental and financial
reputation. The Heineken brand is, along with our people, our
most valuable asset and one of the key elements in Heineken's
growth strategy with a portfolio that combines the power
of local and international brands. Anything that adversely
affects consumer or stakeholder confidence in the Heineken
brand or Company could have a negative impact on the
overall business.
Annual Report 2009 - Heineken N.V. 45