Consolidated Financial Statements and Consolidated Management ...

D. RISK CONTROL SYSTEMS
D.1. General description of the risk policy of the Company and/or its group, detailing and evaluating the risks covered by the system,
together with an explanation of why these systems are appropriate for each type of risk.
As a basic risk management tool, the NH Group has an Overall Group Risk Map. Such risk map was drawn up for the first time in 2007. Since then, it has
been updated on an annual basis with the collaboration of the group’s different corporate divisions. The main aim of this map is to provide the group with
an efficient instrument to guard against the possible emergence of the risks identified.
Regarding the company’s risk management, work has been done in 2011 on two fronts:
a) Integrating the risk map into an in-house computer management tool that is also used by the company for its processes and procedures. This software
allows risk management to be improved by describing the controls affecting each one of the risks and enhancing the capacity to manage their
assessment.
b) It improves the controls implemented to mitigate operating risks, which are the risks that directly affect hotel activities. The development of these
controls within the company’s front-office tool and the incorporation of as yet non-existent controls form part of this work. A second phase of this project
will take place in 2012.
The business risk control systems of the activities of the NH Group can be classified in the following way:
- Control of financial risk
- Control of strategic development risk
- Control of business, operating and environmental risks - Control of regulatory risks
- Other preventative procedures
1. Financial risk control systems
The group controls its financial risks through the following mechanisms:
1.1 Procedures Manual: Any relevant operations performed by the NH Hoteles Group are standardised through an internal procedures manual for
procurement, asset management, cash and bank, month-end closing, etc. In addition, the accounting standards which apply to all Spanish and
foreign companies of the group have been regulated.
1.2 Internal Auditing: The Internal Auditing Department performs work on an ongoing basis essentially aimed at identifying situations of risk and
assessing their management. It has therefore defined an annual auditing plan, the purpose of which is to verify that the standards and procedures
which have been established are properly implemented at both a corporate department level as well as at the different hotels.
1.3 Audit Committee: The Audit Committee reports directly to the Board of Directors and is in charge of ensuring that all of the group’s internal control
systems work properly. In addition, it periodically analyses the main risks affecting the business and the systems established for their management
and control. It is the body responsible for establishing relationships with the group’s external auditors.
1.4 Centralised Management: The group’s management of financing, interest rate and exchange rate policies is centralised solely through the Economic
and Financial Division using non-speculative criteria.
In accordance with the provisions set forth in Article 61 of the Securities Market Act, a detailed description of the financial reporting control systems
is attached hereto as an Annex.
2. Strategic Risk Control Systems
2.1 The NH Hoteles Group has a team of professionals that analyse strategic opportunities of various types. This team selects the alternatives best
aligned with the Group’s global strategy and submits them to the Expansion and Management Committee, and subsequently to the Executive
Committee and the Board of Directors.
2.2 The Group has identified a number of employees that form an Integration Committee for each acquisition, in order to standardise the policies and
procedures in the different critical areas(human resources, information systems, sales management and marketing...)
2.3 The Expansion Committee reports directly to the Management Committee and analyses any transactions put forward. It is comprised of members
from each of the areas who analyse all the business risks and opportunities which may arise for the group.
3. Risk control systems for business, transaction control and environmental risks
3.1 The Management Committee meets on a weekly basis. It analyses the information contained in the management charts drawn up by the Corporate
Control Management Department to assess the development of transactions, and closely monitors aspects of the business assessment obtained
through the computer system.
It also sets the policy to be applied by each Company department and monitors the application of the market policy for the Committee.
3.2 The group has a policy in place aimed at attaining maximum respect for the environment, especially regarding its main activity, golf hotel
management. In this regard, the Corporate Engineering and Environmental Area is in charge of providing the company with the basic mechanisms
needed to properly manage environmental regulations. This is carried out directly with the hotels, and together with analyses and reviews of
compliance with the specific regulations issued for such purpose, forms the basis of their day-to-day activity.
3.3 A project geared at analysing and improving existing controls at centres through the specific enhancement and development of the computer tools
used by the company (front-office and back-office) was initiated in 2011. It has a two-fold aim:
- To improve existing controls on day-to-day operations: automation and simplification
- To add new additional controls to existing controls.
The main objective is to reduce the risks of fraud and to reinforce existing manual controls over production through the gradual incorporation of
growing number of preventive and corrective controls.
ANNUAL CORPORATE GOVERNANCE REPORT 37