Risk management system and internal control system

A prerequisite for the long-term success of our company is to identify opportunities and risks at an early stage and to exploit or manage them.

The Management Board of METRO AG bears overall responsibility for an effective risk management system (RMS) and an effective internal control system (ICS). Both management systems and the opportunities and risks that are considered significant for METRO and the corresponding measures are presented in this chapter of the annual report.

The RMS and the ICS of METRO are implemented by the Group department based on the recommendations of the and the requirements of the standards 981 and 982 of the Institut der Wirtschaftsprüfer in Deutschland e. V. (IDW, Institute of Public Auditors in Germany). Accordingly, the management systems consist of the following elements:

Risk management system and internal control system

Risk management system and internal control system (graphic)

Objectives of the RMS and ICS

The overarching objectives of the RMS and ICS are to protect assets and support sustainable growth for METRO. The RMS supports these objectives through systematic reporting on opportunities and risks. It facilitates informed decisions and creates transparency. The ICS supports the aforementioned objectives by creating reliable operational and financial processes in order to ensure accuracy, completeness and timeliness of financial reporting in particular and with laws and guidelines.

Organisation of the RMS and ICS

Group-wide RMS and ICS tasks and responsibilities are clearly defined and reflect our corporate structure. We combine centralised business management by the management holding company METRO AG with the decentralised responsibility of the sales companies for the operational business and the service companies that support the operational business.

It is the responsibility and a legal obligation of the Management Board of METRO AG to organise a for METRO. We regard the risk management system, the internal control system, the compliance management system (CMS) as well as Internal Audit to be components of the governance, risk and compliance system (GRC system). This organisational structure is based on the governance elements identified in § 107 Section 3 of the German Stock Corporation Act (AktG) as well as the German Corporate Code. The fundamental principles of the GRC system are defined and documented in our governance, risk and compliance guideline. On this basis, we continuously work on increasing the efficiency and effectiveness of the GRC system.

The group’s Governance, Risk and Committee (GRCC) is chaired by the Chief Financial Officer of METRO AG and regularly discusses methods and further developments of the GRC subsystems. The structural and procedural organisation of the RMS and the ICS are clearly defined in the relevant guidelines and implemented throughout the group.

Governance
Statutory and factual regulatory framework for the management and supervision of a company.
Glossary
Committee of Sponsoring Organizations of the Treadway Commission (COSO)
US-based private-sector organisation that developed and published a standard for internal controls in 1992 that is recognised by the U.S. Securities and Exchange Commission. In 2004, this standard was updated and the COSO ERM (Enterprise Risk Management – Integrated Framework), also known as COSO II, was published.
Glossary
Audit
A procedure that assesses an organisation’s processes and structures according to previously formulated standards and guidelines. Audits shed light on the effectiveness of process optimisation measures. If an audit is conducted by an external auditor, the certificate issued after the review can be used as evidence of adherence to standards.
Glossary
Compliance
All measures specifying compliance with legal requirements as well as social guidelines and values by a company and its employees.
Glossary
Governance management system
System for controlling all management and monitoring processes of a company. The METRO governance management system comprises the risk management system, the internal control system, the compliance management system and the internal auditing system.
Glossary
Governance
Statutory and factual regulatory framework for the management and supervision of a company.
Glossary
Compliance
All measures specifying compliance with legal requirements as well as social guidelines and values by a company and its employees.
Glossary