Annual Report - QuamIR

Corporate Governance Report (Continued)
Control Environment
The Group is a tightly-knit organization, the actions of management and its
demonstrated commitment to effective governance and controls are therefore
very transparent to all. The Group strives to conduct all business affairs based
on good business ethics and accountability. We have in place a formal Code
of Conduct & Business Ethics that is communicated to all staff members.
We aim to build risk awareness and control responsibility into our culture and
regard them as the foundation of our internal control system.
No matter how well an internal control system is conceived and operated,
it is designed to manage, rather than eliminate, the risk of failure to achieve
business objectives, and can only provide reasonable, but not absolute,
assurance. Recognising this, we maintain an effective internal audit function,
the Internal Control and Risk Management (“ICRM”) Department, whose main
features include:
(i) independence from operational management;
(i)
(ii) fully empowered auditors with access to all data and every operation of
the Group;
(ii)
(iii) adequate resources and well qualified and capable staff; and
(iii)
(iv) risk-based auditing, concentrating on areas with significant risks or where
significant changes have been made.
Risk management
The management has an ongoing process to identify, evaluate and manage
the risks faced by the Group. Each risk is rated in terms of probability of
occurrence and potential impact on performance, which serves as a basis
for better priority setting and resource allocation. Mitigation strategies and
plans with respect to each key risk identified are developed and implemented,
which include establishing or enhancing internal controls and procedures.
(iv)
Heads of the departments, projects and business units also review and
analyse the key risks associated with achieving the objectives of their
particular departments, activities and businesses from time to time to provide
reasonable assurance that controls are both embedded and effective within
the business.
22 HKC (Holdings) Limited • Annual Report 2011