Characteristics of the accounting-related internal control and risk management system and explanatory report of the Management Board
METRO’s accounting-related internal control and risk management system employs coordinated instruments and measures for the prevention, early detection, assessment and management of risks. The Corporate Accounting department of METRO AG is responsible for the group-wide implementation of these instruments and measures.
Overarching responsibility for all processes related to the preparation of the consolidated and individual financial statements as well as the combined management report of METRO AG rests with the Board department headed by the Chief Financial Officer of METRO AG, Mr Christian Baier. The actual preparation of the financial statements as well as the combined management report, however, is the legal responsibility of the Management Board of METRO AG. The consolidated and individual financial statements as well as the combined management report are audited and approved by the auditor during and after their preparation. They are then discussed and reviewed by the Supervisory Board of METRO AG. The auditor attends this Supervisory Board meeting. He reports the key findings of his audit and is available for additional questions. Provided the Supervisory Board has no objections, it approves the annual financial statements and the combined management report. The annual financial statements of METRO AG are adopted once the Supervisory Board has issued its approval.
Group-wide framework
Building on the “Internal Control – Integrated Framework” concept of the Committee of Sponsoring Organizations of the Treadway Commission (COSO), the Corporate Accounting department of METRO AG has defined group-wide minimum requirements regarding the design of the accounting-related internal control system of METRO AG, the sales lines and the major service companies. With these requirements, the company particularly wants to ensure adherence to the relevant accounting standards and the respective internal guidelines (for example the IFRS accounting guideline).
Among others, these requirements cover the design and implementation of controls, monitoring the effectiveness of controls and reporting about effectiveness analyses.
- Design of controls: Taking a top-down approach, the company has identified the risk of material errors relating to the financial reporting for significant financial and accounting-related processes. In addition, the Corporate Accounting department has stipulated binding group-wide control objectives which the group companies must meet by employing company-specific control activities.
- Implementation of controls: The group companies must keep records of the implementation of these controls. These provide the basis for an independent review of the controls’ effectiveness by the Group Internal Audit department and the group’s auditor.
- Effectiveness of controls: The major group companies are obligated to evaluate the effectiveness of controls at the end of each financial year (self-evaluation). In the process, they must apply the uniform, group-wide method stipulated by the Corporate Accounting department. In addition, the effectiveness of controls is reviewed as part of the risk-oriented, independent audits conducted by the Group Internal Audit department.
- Reporting: The results of the self-evaluations must be reported to the Corporate Accounting department using a standardised reporting format. The group companies must confirm that their self-evaluations were conducted using the prescribed method. Aside from the control activities, the group companies must also report on the other 4 components of the COSO framework: control environment, risk assessment, information and communication, as well as monitoring. The companies’ individual reports are validated by the Corporate Accounting department and compiled in an overall report on METRO accounting-related internal control system. This is reported to the Governance, Risk, and Compliance Committee (GRCC) as well as the Management Board of METRO AG.
As of financial year 2014/15, these 4 phases of the internal control cycle are mapped by all METRO sales lines, the essential service companies and METRO AG itself using the RSA Archer GRC software. The key requirements (for example, the IFRS accounting guideline), accounting processes, individual controls and independent review by the Group Internal Audit department and the auditor are described in detail below.