Consolidated Financial Statements and Consolidated Management ...

- to keep records of transactions recorded on media other than normal accounting records that are not entered into official books;
- to record non-existent expenditure, income, assets or liabilities;
- to make entries in accounting books, incorrectly indicating their object;
- to use false documents;
- to deliberately destroy documents before the end of the legally-required time limit for retaining them “.
1.2.3. Defined complaints channel
A procedure has been established for lodging complaints about breaches of the principles enshrined in the Code of Conduct, and this
enables employees to provide confidential information about any non-compliance with the principles set out in the Code of Conduct.
The procedure for reporting and dealing with possible non-compliance and reports relating to the Code of Conduct is administered by the
manager of the Group’s Internal Audit Department, who acts independently, giving an account of the most significant incidents over the
course the year to the Company’s Audit and Control Committee.
Complaints should preferably be submitted electronically, using the channel expressly provided for this purpose on the NH Hoteles intranet
(codeofconduct@nh-hotels.com). Complaints sent in this way will reach the manager of the Internal Audit Department, thereby guaranteeing
their confidentiality. Complaints can also be sent by post, addressed to the Internal Audit Manager of NH Hoteles, S.A., at the following
address: Santa Engracia 120, 28003 Madrid, Spain.
The Manager of the Internal Audit Department is responsible for analysing the information provided, requesting the corresponding
evidence and reports and, where relevant, presenting the files with all the information available to the Chairman of the Board of Directors of
NH Hoteles, S.A. All relevant complaints are presented to the Chairman of the Audit and Control Committee.
Since the new Code of Conduct came into force, no relevant complaint of any kind that could lead to any measures being taken has been
received.
1.2.4. Training and periodic skills-updating programmes on, at least, accounting standards, audit, internal control and risk management for
staff involved in preparing and reviewing financial information and carrying out FICS evaluations.
The Company has put in place two action channels relating to the Internal Financial Information Control System:
- Initial training programmes on the objectives and characteristics of the Internal Financial Information Control System: these programmes
are aimed at members of the financial information control structure, process managers and business unit managers.
The objective is to report on the most relevant aspects of the financial information generation process, specifically, the Company’s operating
systems, comprising the control system, the people responsible for overseeing the controls defined for each process, notification of
improvements or modifications, understanding of the supervision system in place, etc. These training programmes were carried out at the
start of the evaluation project and will take place once a year.
- Continuity programmes: the objective of these programmes is to maintain the efficiency and efficacy of the control system through
periodic training throughout the entire control structure. These programmes will be decided on a one-off basis according to the needs
reported by the departments involved
Meanwhile, the Financial Department, the staff of which are the most heavily involved in producing the Financial Information, have an
annual training plan that is outsourced to external consultants, covering significant areas within their area of activity considered to be
of particular relevance to them in carrying out their functions: accounting regulations, consolidation regulations and specific financial
information applicable to the sector.
2. Main characteristics of the risk identification process
Risks relating to the Financial Information System are determined and evaluated within the general risk map produced by the Company, which is
periodically reviewed and updated.
The risks defined within the Company’s risk map are classified according to COSO criteria, including the following categories:
- Strategic risks: those caused by the uncertainty associated with changes in the competitive, company or industry environment.
- Financial risks: all risks caused by the uncertainty associated with fluctuations in interest rates, foreign exchange rates or difficulties and variations in
the conditions for accessing financing.
- Unforeseen risks: in general, these relate to damage to the company’s own assets and liabilities arising from damages caused to third parties and
damages caused by natural hazards.
- Operational risks: these include risks associated with uncertainty in processes, operations and staff or due to inadequate internal systems.
The Company currently has a risk management process in place, which is properly documented and contained on a company IT application.
In designing the risk management process associated with generating Financial Information the Company has focused on the following objectives:
- Definition of the Financial Information Control System processes and subprocesses.
- Determination of the relevant risk categories and types for each of the different Internal Financial Information Control System processes defined in
the point above.
Corresponding subcategories have been defined for each of these risk categories.
The Accounting, Reporting and Internal Control subcategories are differentiated and defined within the section on the group’s operational risks.
- Definition and analysis of controls for each specific risk and establishment of their degree of effectiveness.
A risk matrix has been established for each of the subprocesses detailed above, in which the most relevant risks for each process are defined, along
with the operational controls and their effectiveness in mitigating the risks that affect them.
ANNUAL CORPORATE GOVERNANCE REPORT 57