Risk management and internal control system
STRUCTURE OF THE RISK MANAGEMENT SYSTEM AND INTERNAL CONTROL SYSTEM AT VOLKSWAGEN
The organizational design of the Volkswagen Group’s RMS/ ICS is based on the internationally recognized COSO framework for enterprise risk management (COSO: Committee of Sponsoring Organizations of the Treadway Commission). In the reporting period, Volkswagen again pursued a holistic, integrated approach that combines a risk management system, an internal control system and a compliance management system (CMS) within a single management strategy (governance, risk and compliance strategy). Structuring the RMS/ICS in accordance with the COSO framework for enterprise risk management ensures that potential risks are covered in full; opportunities are not recorded. Uniform Group principles are used as the basis for managing risks in a consistent manner.
With this approach we not only fulfil legal requirements, particularly with regard to the financial reporting process, but we are also able to manage significant risks to the Group holistically, i.e. by incorporating both tangible and intangible criteria.
We further enhanced our RMS/ICS in the reporting period. In addition to the ad hoc and annual risk assessment, the Board of Management also receives quarterly risk reports. This additional reporting on the current risk situation raises awareness of risks in the Company and encourages an open approach to dealing with them. We continued to reinforce the internal control system in the area of product compliance in 2016. This includes what are known as the Golden Rules, which we describe in the chapter on the diesel issue.
Another key element of the RMS/ICS at Volkswagen is the three lines of defense model, a basic element required, among others, by the European Confederation of Institutes of Internal Auditing (ECIIA). In line with this model, the Volkswagen Group’s RMS/ICS has three lines of defense that are designed to protect the Company from significant risks occurring.
THE THREE LINES OF DEFENSE MODEL
First line of defense: operational risk management
The primary line of defense comprises the operational risk management and internal control systems at the individual Group companies and business units. The RMS/ICS is an integral part of the Volkswagen Group’s structure and workflows. Events that may give rise to risk are identified and assessed locally in the divisions and at the investees. Countermeasures are introduced immediately, their effects are assessed and the information is incorporated into the planning in a timely manner. The results of the operational risk management process are incorporated into budget planning and financial control on an ongoing basis. The targets agreed in the budget planning rounds are continually reviewed in revolving planning updates.
At the same time, the results of risk mitigation measures that have already been taken are incorporated into the monthly forecasts on further business development without delay. This means that the Board of Management also has access to an overall picture of the current risk situation via the documented reporting channels during the year.
The minimum requirements for the operational risk management and internal control system are set out for the entire Group in uniform guidelines. These also include a process for the timely reporting of material risks.
Second line of defense: identifying systemic risks using the regular Governance, Risk and Compliance process
In addition to the ongoing operational risk management, the Group Governance, Risk and Compliance (GRC) department each year sends standardized surveys on the risk situation and the effectiveness of the RMS/ICS to the significant Group companies and units worldwide (regular GRC process). The feedback is used to update the overall picture of the potential risk situation and assess the effectiveness of the system.
Each systemic risk reported is assessed using the expected likelihood of occurrence and various risk criteria (financial and nonfinancial). In addition, the measures taken to manage and control risk are documented at management level. This means that risks are assessed in the context of any risk management measures initiated, i.e. in a net analysis. In addition to strategic, operational and reporting risks, risks arising from potential compliance violations are also integrated into this process. Moreover, the effectiveness of key risk management and control measures is tested and any weaknesses identified in the process are reported and rectified.
All Group companies and units selected from among the entities in the consolidated Group on the basis of materiality and risk criteria were subject to the regular GRC process in fiscal year 2016.
The Scania brand had not yet been included in the Volkswagen Group’s risk management system due to various provisions of Swedish company law. Scania was integrated into quarterly risk reporting in 2016. In future, it will also be included in the regular GRC process. According to Scania’s corporate governance report, risk management and risk assessment are integral parts of corporate management. Risk areas at Scania are evaluated by the brand’s Controlling department and reflected in the financial reporting.
The RMS was expanded in the reporting period to include quarterly risk reporting. The aim is to raise awareness of significant risks currently faced by the Volkswagen Group and to encourage these to be dealt with openly. All Group brands are included in this new process along with Volkswagen Financial Services AG.
ANNUAL STANDARD GOVERNANCE, RISK AND COMPLIANCE PROCESS
Third line of defense: checks by Group Internal Audit
Group Internal Audit helps the Board of Management to monitor the various divisions and corporate units within the Group. It regularly checks the risk early warning system and the structure and implementation of the RMS/ICS and the CMS as part of its independent audit procedures.
RISK EARLY WARNING SYSTEM IN LINE WITH THE KONTRAG
The Company’s risk situation is ascertained, assessed and documented in accordance with the requirements of the Gesetz zur Kontrolle und Transparenz im Unternehmensbereich (KonTraG – German Act on Control and Transparency in Business). The requirements for a risk early warning system are met through the elements of the RMS/ICS described above (first and second lines of defense). Independently of this, the external auditors check both the processes and procedures implemented in this respect and the adequacy of the documentation on an annual basis. The plausibility and adequacy of the risk reports are examined on a random basis in detailed interviews with the divisions and companies concerned that also involve the external auditors. The latter assessed our risk early warning system based on this volume of data and established that the risks identified were presented and communicated accurately. The risk early warning system therefore meets the requirements of the KonTraG.
In addition, the Financial Services Division is subject both to scheduled examinations as part of the audit of the annual financial statements and to also unscheduled audits, in particular by the Banking Supervision Committee of the European Central Bank (ECB SSM, Single Supervisory Mechanism) and by the Bundesanstalt für Finanzdienstleistungsaufsicht (BaFin – the German Federal Financial Supervisory Authority) within the meaning of section 44 of the Kreditwesengesetz (KWG – German Banking Act), as well as examinations by the Prüfungsverband deutscher Banken (Auditing Association of German Banks).
Monitoring the effectiveness of the risk management system and the internal control system
To ensure its effectiveness, the RMS/ICS is regularly optimized as part of our continuous monitoring and improvement processes. In the process, equal consideration is given to both internal and external requirements. External experts assist in the continuous enhancement of our RMS/ICS on a case-by-case basis. The results culminate in both regular and event-driven reporting to the Board of Management and Supervisory Board of Volkswagen AG.
THE RISK MANAGEMENT AND INTEGRATED INTERNAL CONTROL SYSTEM IN THE CONTEXT OF THE FINANCIAL REPORTING PROCESS
The accounting-related part of the RMS/ICS that is relevant for the financial statements of Volkswagen AG and the Volkswagen Group comprises measures that are intended to ensure the complete, accurate and timely transmission of the information required for the preparation of the financial statements of Volkswagen AG, the consolidated financial statements and the combined Group management report. These measures are designed to minimize the risk of material misstatement in the accounts and in the external reporting.
Main features of the risk management and integrated internal control system relevant for the financial reporting process
The Volkswagen Group’s accounting is essentially organized along decentralized lines. For the most part, accounting duties are performed by the consolidated companies themselves or entrusted to the Group’s shared service centers. In principle, the audited financial statements of Volkswagen AG and its subsidiaries prepared in accordance with IFRSs and the Volkswagen IFRS accounting manual are transmitted to the Group in encrypted form. A standard market product is used for encryption.
The Volkswagen IFRS accounting manual, which has been prepared using external expert opinions in certain cases, ensures the application of uniform accounting policies based on the requirements applicable to the parent. In particular, it includes more detailed guidance on the application of legal requirements and industry-specific issues. Components of the reporting packages required to be prepared by the Group companies are also set out in detail there and requirements established for the presentation and settlement of intragroup transactions and the balance reconciliation process that builds on this.
Control activities at Group level include analyzing and, if necessary, adjusting the data reported in the financial statements presented by the subsidiaries, taking into account the reports submitted by the auditors and the outcome of the meetings on the financial statements with representatives of the individual companies. These discussions address both the reasonableness of the single-entity financial statements and specific significant issues at the subsidiaries. Alongside reasonableness reviews, control mechanisms applied during the preparation of the single-entity and consolidated financial statements of Volkswagen AG include the clear delineation of areas of responsibility and the application of the dual control principle.
The Group management report is prepared – in accordance with the applicable requirements and regulations – centrally but with the involvement of and in consultation with the Group units and companies.
In addition, the accounting-related internal control system is independently reviewed by Group Internal Audit in Germany and abroad.
Integrated consolidation and planning system
The Volkswagen consolidation and corporate management system (VoKUs) enables the Volkswagen Group to consolidate and analyze both Financial Reporting’s backward-looking data and Controlling’s budget data. VoKUs offers centralized master data management, uniform reporting, an authorization concept and maximum flexibility with regard to changes to the legal environment, providing a future-proof technical platform that benefits Group Financial Reporting and Group Controlling in equal measure. To verify data consistency, VoKUs has a multi-level validation system that primarily checks content plausibility between the balance sheet, the income statement and the notes.