Risk management

We believe that risk management is an essential discipline in our business operations. As an integral part of this, we have a Group-wide risk management process to ensure a consistent approach to the assessment, recording and reporting of our key risks in a visible, structured and continuous manner. This process helps to safeguard the Group’s assets and is designed to manage, rather than eliminate, material risks to the achievement of the Group’s business objectives, while also recognising that any such process can provide only reasonable, and not absolute, assurance against material misstatement or loss. This process complies with the Turnbull working party guidance (revised October 2005) and, in addition, contributes toward the Group’s compliance with our obligations under the Sarbanes-Oxley Act as well as other internal assurance activities.

The risk management process continues to be based on both bottom-up and top-down assessments of operational, financial and other business risks. From the bottom up, business units and Corporate Centre functions must prepare and maintain risk registers that capture their key risks and the actions that are being taken to manage them. These risk registers are primarily management tools for use at an operational level, but are also intended to ensure that risk is reported on a consistent basis throughout the Group. The key element in the top-down assessment of our risk profile is the involvement of the Executive Directors and other senior management across the Group at critical stages in the review process. Their review of the bottom-up assessment produces an overall evaluation of the risks that are faced by the Group. Graphics that set out the Group’s risk profile and any significant changes to this between reporting periods are considered by the Executive Committee, the Risk & Responsibility Committee and the Audit Committee twice a year. The Audit Committee also reviews the risk management process at least once during each year and reports on this to the Board.

During the year, the Group risk management process was subject to independent internal review and found to be applied on a consistent basis across the Group. In addition, during the year we have sought to derive further benefits from this process through closer coordination with the Group Insurance team and a more formalised interaction with the Group Internal Audit function. An external benchmarking exercise has also continued with other FTSE 100 companies and similar organisations to measure the effectiveness of our own approach and exchange best practice.

Our risk management process has identified the risk factors set out under Corporate governance - Risk factors.