Figure 3: Structure of the Corporate Policies, Requirements and Directives
Below, it is described how DSM covers the eight components of COSO-ERM.
Internal Environment
An important part of the Internal
Environment for risk management is set by the DSM Values and the
communications on risk management as described in the previous section. The
Unit Risk Management Requirements additionally specify that each operational
unit must:
-
have a risk management system in place, the elements of which are accessible
via a portal
-
have a risk management organization which includes an audit committee chaired
by the unit director
-
draw up and monitor the implementation of a Risk Management Year Plan
-
implement a risk management process as described in the Corporate Requirements
and outlined below. The Corporate Requirements require that Corporate Policies
are translated into policies for the operational units. They also stipulate
that management should take the lead and give the example, and should keep the
employees accountable for compliance. In this way the “tone at the top” is
cascaded downward in the organization.
Objective Setting
The Strategy Requirements specify that each
operational unit execute a Business Strategy Dialogue (BSD) at regular
intervals. The outcome of this strategic process is translated into clear
objectives for financial as well as other functional and business fields. If
appropriate, risk profiles of alternative scenarios are analyzed before final
choices are made. The results and prospects of the unit’s strategy and the
related risks and responses are reviewed in an annual strategic review.
Event identification, risks assessment and risk response
As
part of the BSD, a Business Risk Assessment (BRA) has to be carried out to
identify the most important risks inherent to the chosen strategy. If
important risks are identified in the internal processes, specific Process
Risk Assessments (PRA’s) are carried out for those processes. For the most
important risks identified in the BRA and PRA, the unit identifies responses
and manages the follow-up of those responses. Risk updates are made twice a
year. As part of the BRA, major business disruptions need to be identified for
which Business Continuity Plans need to be made.
Control activities
The DSM risk-management system provides for
the identification, assessment and identification of responses and controls in
two ways: via the BRA’s and PRA’s as described above and via the
identification of common risks and common controls. In companies such as DSM,
a large part of the identifiable risks are directly linked to the nature of
the operations. Therefore, DSM has chosen to identify and assess these common
risk and design common controls for them. These mandatory common controls are
part of the Corporate Requirements and cover all functional fields. In the
field of the primary flow of goods and the related financial control processes
and in some supportive processes, the implementation of controls is supported
by standard ICT-solutions. In these cases, the controls are built into
so-called standard business processes and the application of sufficient
segregation of duties is controlled by central authorization management.
Through this concept of common risks and common controls, control or
mitigation of a large number of common risks is achieved in an efficient way.
In their BRA’s and PRA’s, operational units can focus on unit specific risks
and responses.
Information and communication
The Corporate Policies and
Requirements and their implementation in the operational units are subject to
(mandatory) training and specific attention is given to communication about
risks, for instance in job hand-over procedures at senior management levels.
To help the operational units in implementing the risk management system and
in integrating it with the daily business processes, the Management Framework
for the operational level (figure 2) has been made available as a portal on
the DSM Intranet. All relevant policies, requirements, practices and standard
business processes are to be found under the respective buttons. The
operational units can copy the portal for their own use and add unit-specific
business processes, policies, requirements and practices and make links to
archived documents, such as standard operating procedures.
Monitoring, reporting, embedding and continuous improvement
The
effectiveness of controls is monitored and reported in various ways: through
control monitoring in the standard business processes, monitoring of
compliance with the Corporate Requirements, periodic reporting on risks and
controls and through various incident reports. Special tools are available to
support the monitoring of the effectiveness of the controls in standard
business processes.
One of the specific objectives of the risk-management system is to be able to
provide a reasonable level of assurance that the financial reporting does not
contain any material inaccuracies and confirm that the internal controls
function properly. Therefore, in the financial field there are detailed
accounting and reporting requirements and related annexes specifying amongst
other things reporting time schedules and formats, the DSM Chart of Accounts,
the IFRS compliant DSM Accounting Rules and the format for a quarterly
affidavit, to be signed by the Financial Director of each unit.
To embed risk management in the normal way of doing business, behavior-based
practices have been made available to help make risk management sustainable
without it becoming a “tick the box” affair. They include workshops on
learning from deviations and principle-based compliance.
Feedback from the operational units on the functioning of the Corporate
Requirements and other elements of the risk management system is used to
regularly improve the system.
