INTEGRATED INTERNAL CONTROL AND RISK MANAGEMENT SYSTEM RELEVANT FOR THE FINANCIAL REPORTING PROCESS
The accounting-related internal control and risk management system that is relevant for the financial statements of Volkswagen AG and the Volkswagen Group comprises measures that are intended to ensure the complete, accurate and timely transmission of the information required for the preparation of the financial statements of Volkswagen AG, the consolidated financial statements and the Group management report, and to minimize the risk of material misstatement in the accounts and in the external reporting.
Main features of the integrated internal control and risk management system relevant for the financial reporting process
The Volkswagen Group’s accounting is organized along decentralized lines. For the most part, accounting duties are performed by the consolidated companies themselves or transferred to the Group’s centralized shared-service centers. The financial statements of Volkswagen AG and the subsidiaries prepared in accordance with IFRS s and the Volkswagen Group accounting manual and reported on by the auditors are transmitted to the Group in encrypted form. A standard market product is used for encryption.
The Group accounting manual ensures the application of uniform accounting policies based on the requirements applicable to the parent. In particular, these include more detailed guidance on the application of legal requirements and industry-specific issues. Components of the reporting packages required to be prepared by the Group companies are also set out in detail and requirements established regarding the presentation and settlement of intragroup transactions and the balance reconciliation process that builds on that.
Control activities at Group level include analyzing and, if necessary, adjusting the data reported in the financial statements presented by the subsidiaries, taking into account the reports submitted by the auditors and the outcome of the meetings on the financial statements with representatives of the individual companies. These discussions address both the reasonableness of the single-entity financial statements and specific critical issues at the subsidiaries. Alongside reasonableness reviews, the clear delineation of areas of responsibility and the application of the dual control principle are further control mechanisms applied during the preparation of the single-entity and consolidated financial statements of Volkswagen AG.
In addition, the financial reporting-related internal control system is independently reviewed by Group Internal Audit in Germany and abroad.
Integrated consolidation and planning system
The Volkswagen consolidation and corporate management system (VoKUs) is a system that can be used in the Volkswagen Group to consolidate and analyze both Financial Reporting’s backward-looking data and Controlling’s forward-looking data. It offers centralized master data management, uniform reporting and maximum flexibility with regard to changes to the legal environment, thus providing a future-proof technical platform that benefits Group Financial Reporting and Group Controlling in equal measure. To verify data consistency, VoKUs has a multi-level validation system that primarily carries out content plausibility checks between the balance sheet, the income statement and the notes.
RISK EARLY WARNING SYSTEM IN LINE WITH THE KONTRAG
The Company’s risk situation is ascertained, assessed and documented annually in accordance with the requirements of the Gesetz zur Kontrolle und Transparenz im Unternehmensbereich (KonTraG – German Act on Control and Transparency in Business). Each year, the auditors check the processes and procedures implemented for this as well as the adequacy of the documentation. Risk management, which forms an operational component of our business processes, is designed to identify risks in a timely manner, assess their extent and, where appropriate, take prompt countermeasures. The Scania brand, which has been consolidated in the Group since July 22, 2008, has not yet been incorporated into the Volkswagen Group’s risk management system due to various provisions of Swedish company law. According to Scania’s Corporate Governance Report, risk management and risk assessment are integral parts of corporate management. Risk areas are evaluated by the Controlling department and reflected in the financial reporting.
Porsche Holding Salzburg and MAN SE, which were consolidated in 2011, have already implemented mature structures for risk early warning systems. Starting in 2012, these will gradually be integrated into the Volkswagen Group’s existing systems.
Updating the risk documentation
Standardized risk position surveys of both the risk managers of the individual divisions and the members of the Boards of Management and managing directors of significant investees are performed annually. Their responses are used to update the overall picture of the potential risk situation. In the process, the expected likelihood of occurrence and the expected loss are assigned to each significant risk identified and the measures taken are documented. The annual updating of the risk documentation is coordinated centrally by the Governance, Risk and Compliance function. Under the guidance of the auditors, the plausibility and adequacy of the risk reports are examined on a test basis in detailed interviews with the divisions and companies concerned. The auditors assessed the effectiveness of our risk early warning system based on this information and established both that the risks identified were presented in a suitable manner and that measures and rules have been assigned to the risks adequately and in full. We therefore meet the requirements of the KonTraG. In addition, the Financial Services Division is subject to regular special audits by the Bundesanstalt für Finanzdienstleistungsaufsicht (BaFin – the German Federal Financial Supervisory Authority) in accordance with section 44 of the Kreditwesengesetz (KWG – German Banking Act) and controls by association auditors.
Workflow rules, guidelines, instructions and descriptions are systematically recorded and can for the most part be accessed online. Adherence to these rules is assured by internal controls performed by the heads of the Group Internal Audit, Quality Assurance, Group Treasury, Brand Controlling and Group Controlling organizational units.
The risk management system – goals and operation
The Group’s risk management system is designed to identify potential risks at any early stage so that suitable counter-measures can be taken to avert the threat of loss to the Company, and any risks that might jeopardize its continued existence can be ruled out.
The risk management system is an integral part of the Volkswagen Group’s structure and workflows and is embedded in its business processes. Events that may give rise to risk are identified and assessed on a decentralized basis in the divisions and at the investees. Countermeasures are introduced immediately, their effects are assessed and the information is incorporated into the planning in a timely manner. The results of the operational risk management process are used to support budget planning and controlling on an ongoing basis. The targets agreed in the budget planning rounds are continually verified in revolving planning reviews.
At the same time, the results of risk mitigation measures that have already been taken are incorporated into the monthly forecasts on further business development in a timely manner. This means that the Board of Management has access to an overall picture of the current risk situation through the documented reporting channels during the year as well.
We are prepared to enter into transparent risks that are proportionate to the benefits expected from the business.
We constantly optimize the internal control system and the risk management system as part of our continuous improvement processes. In doing so, equal consideration is given to both internal and external requirements – such as the provisions of the Bilanzrechtsmodernisierungsgesetz (BilMoG – German Accounting Law Modernization Act). The objective of the improvements made to the systems is to ensure regular monitoring of the relevant risk areas in the organizational units responsible. The focus is on reviewing the effectiveness of the key management and monitoring instruments identified. This concept culminates in both regular and event-driven reporting to the Board of Management and Supervisory Board of Volkswagen AG, into which the reporting in accordance with the KonTraG is integrated.