Figure 3: Structure of the Corporate Policies, Requirements and Directives
Below, it is described how DSM covers the eight components of the
COSO-ERM-Cube.
Internal Environment
An important part of the Internal
Environment for risk management is set by the DSM Values and the
communications on risk management as described in the previous section. The
Unit Risk Management Requirements additionally specify that each operational
unit must put a risk management organization in place and that reporting of
control failures and material risks must be encouraged. The Corporate
Requirements require that Corporate Policies are translated into policies for
the operational units. They also stipulate that management should take the
lead and give the example, and should keep the employees accountable for
compliance. In this way the “tone at the top” is cascaded downward in the
organization.
Objective Setting
The Strategy Requirements specify that each
operational unit execute a Business Strategy Dialogue (BSD) at regular
intervals. The outcome of this strategic process is translated into clear
objectives for financial as well as other functional and business fields. If
appropriate, risk profiles of alternative scenarios are analyzed before final
choices are made. The results and prospects of the unit’s strategy and the
related risks and responses are reviewed in an annual strategic review.
Event identification, risks assessment and risk response
As
part of the BSD, events are identified that could influence the risk profile
of the business. The Unit Risk Management Requirements specify that, following
a BSD, a Business Risk Assessment (BRA) has to be carried out to identify the
most important risks inherent to the chosen strategy. If important risks are
identified in the internal processes, specific Process Risk Assessments
(PRA’s) are carried out for those processes. For the most important risks
identified in the BRA and PRA, the unit identifies responses and manages the
follow-up of those responses.
Control activities
The DSM risk-management system provides for
the identification, assessment and identification of responses and controls in
two ways: via the BRA’s and PRA’s as described above and via the
identification of common risks and common controls. In companies such as DSM,
a large part of the identifiable risks are directly linked to the nature of
the operations. Therefore, DSM has chosen to identify and assess these common
risk and design common controls for them. These mandatory common controls are
part of the Corporate Requirements and cover all functional fields. In the
field of the primary flow of goods and the related financial control processes
and in some supportive processes, the implementation of controls is supported
by standard ICT-solutions. In these cases, the controls are built into
so-called standard business processes. Through this concept of common risks
and common controls, control or mitigation of a large number of common risks
is achieved in an efficient way. In their BRA’s and PRA’s, operational units
can focus on unit specific risks and responses.
A business continuity plan needs to be prepared for an effective response to
all risks with a potentially very serious impact which, although they have a
very low chance of occurring, cannot be excluded altogether.
Information and communication
The Corporate Policies and
Requirements and their implementation in the operational units are subject to
(mandatory) training and specific attention is given to communication about
risks, for instance in job hand-over procedures at senior management levels.
To help the operational units in implementing the risk management system and
in integrating it with the daily business processes, the Management Framework
for the operational level (figure 2) has been made available as a portal on
the DSM Intranet. All relevant policies, requirements, practices and standard
business processes are to be found under the respective buttons. The
operational units can copy the portal for their own use and add unit-specific
business processes, policies, requirements and practices and make links to
archived documents, such as standard operating procedures.
Monitoring, reporting, embedding and continuous improvement
The
effectiveness of controls is monitored and reported in various ways: through
control monitoring in the standard business processes, monitoring of
compliance with the Corporate Requirements, periodic reporting on risks and
controls and through various incident reports. Special tools are available to
support the monitoring of the effectiveness of the controls in standard
business processes.
One of the specific objectives of the risk-management system is to be able to
provide a reasonable level of assurance that the financial reporting does not
contain any material inaccuracies and confirm that the internal controls
function properly. Therefore, In the financial field there are detailed
accounting and reporting requirements and related annexes specifying amongst
other things reporting time schedules and formats, the DSM Chart of Accounts,
the IFRS compliant DSM Accounting Rules and the format for a quarterly
affidavit, to be signed by the Financial Director of each unit.
To embed risk management in the normal way of doing business, behavior-based
practices have been made available to help make risk management sustainable
without it becoming a “tick the box” affair. They include workshops on
learning from deviations and principle-based compliance.
Feedback from the operational units on the functioning of the Corporate
Requirements and other elements of the risk management system is used to
regularly improve the system.
