COMMERZBANK AKTIENGESELLSCHAFT

The Supervisory Board oversees financial reporting, mainly through the Audit Committee
set up for this purpose. The responsibilities of the Audit Committee also include ensuring
that the auditor is independent, appointing the auditor, setting the focus of the audit and
agreeing the fee. During the year Group Audit reports to the Supervisory Board and its appointed
committees about the work it has carried out and its material findings.
Group Management Finance (GM-F), which reports directly to the CFO, is responsible for
ensuring that the financial statements are drawn up in compliance with the relevant laws and
internal and external guidelines. GM-F produces the separate financial statements of Commerzbank
Aktiengesellschaft and consolidates the separate financial statements of Group
companies to produce the Group financial statements.
Within GM-F, Accounting Policies & Guidelines is the department responsible for drawing
up and communicating Group-wide accounting guidelines. It supports consistent and correct
accounting treatment across the Group by drawing up and co-ordinating accounting guidelines.
Published guidelines are monitored on an ongoing basis to see if they need updating,
which is carried out as required. Regular staff training sessions are also held on relevant issues.
This is complemented by more detailed working instructions on the Bank’s intranet.
GM-F is supported in producing financial statements by other corporate divisions. Of particular
importance here is Group Information Technology, which is responsible for providing
and upgrading the accounting IT systems used.
Controls to minimise risk
Controls at the Bank are integrated directly into operating processes, either technically or
manually (i.e., by means of organization). Technical controls are used in the IT systems employed
and consist, for example, of check sums and verification digits. Technical controls are
often complemented by manual controls such as screen approvals carried out by the responsible
employees. Data quality on initial entry into systems is ensured by organisational measures
such as the dual-control principle, delegation of powers of approval and the separation of functions,
and by technical measures such as issuing IT approval authorities. Additional controls during
further processing guarantee that the data entered and used is complete and accurate.
Monitoring by Group Audit
Group Audit provides auditing services for the Board of Managing Directors independently, objectively
and in a risk-oriented manner so as to optimise Commerzbank’s business processes in terms
of their compliance, security and cost-effectiveness. It supports the Board of Managing Directors by
evaluating the effectiveness and appropriateness of the internal control system and risk management,
provides support on key projects in an internal auditing capacity and issues recommendations.
In doing so, it contributes to the security of business processes and assets. Group Audit’s activities
complement the work of the subsidiaries’ auditing activities within the framework of Group
risk management.
Group Audit is directly accountable to the Board of Managing Directors and reports to
that body. It performs its functions autonomously and independently. With regard to reporting
and the assessment of audit results, it is not subject to any directives. Based on MaRisk,
Group Audit’s auditing activities, underpinned by the principle of risk-oriented auditing, extend
to all of the Group’s activities and processes, regardless of whether these take place
within the Group or are outsourced. The task of auditing the effectiveness and appropriateness
of the ICS covers the risk management and controlling systems, reporting, information
systems and financial reporting. In performing its duties, Group Audit has an unrestricted
right to information.
Financial Statements and Management Report 2011 27