Eng - IOI Group

NATURE OF OUR INTERNAL CONTROLS CONT’D• Information SystemsCentral to our Internal Control efforts is our Information Systems that provide the means for monitoring andcommunication of performance measures, key indicators, and the external environment. The degree of sophisticationvaries amongst the business segments, and is being periodically reviewed and upgraded.• Risk Based Audit ApproachThe ERM program provides sufficient documentation and groundwork to complement our risk based audit approach.Our independent internal audit – besides performing audit on the adequacy and integrity of internal controls - alsoprovide audit assurance on the overall compliance and adequacy of the ERM Framework.WORK DONE UNDER PERIOD REVIEWEDAll divisions, operation, and functional units had begun the implementation of various control activities and action plansproposed or formulated since the last reporting period. The stages of implementation vary in accordance with the natureof control activities and plans – of which some entailed continuous on-going effort (i.e. quality improvement programs,customer relationship management programs, and competitiveness enhancement programs). We have periodicallyreviewed the progress of these, and we are satisfied with the emphasis given by the management on areas of significantrisks, and on the overall pace of implementation.In the period under review, the management represented in the respective unit’s Risk Management Committee hadengaged various cross-functional work committees to address emerging risks and opportunities in accordance with theGroup’s ERM Framework. New initiatives and risk mitigation plans have quickly emerged and being implemented –particularly those requiring fast response (i.e. during the SARs epidemic scares and the Iraq War in the 3rd quarter of ourfinancial year). The management has also deployed the Group’s Intranet and developed its own web application tofacilitate communication of risk alerts and the coordination of initiatives and risk mitigation efforts. Particularly, the riskprofile of the Group’s various units is constantly updated and is accessible through our Intranet. This has helped createawareness and congruency in the overall risk management effort.Based on the review, the Board is satisfied with the on-going progress for identifying, evaluating, managing andmonitoring significant risks, and is of the opinion that the Group’s Internal Control systems are adequate and of integrity.BOARD’S CONCLUSIONThe Board is pleased to disclose that the state of the Group’s Internal Control Systems is sufficiently in line with theCode and the Guidelines (on Statement on Internal Control) issued by the KLSE. There are no significant control failure orweaknesses that would result in material loss and require disclosure in the Group’s annual report for the financial yearunder review. The Board’s conclusion is reached based on its review as mentioned above, and also on the following:• Periodic audit reports and discussion with the Audit Committee• Periodic management report on the state of the company’s affairs which also covers the state of internal control• Bi-annual risk review report as compiled by the respective risk management committees89IOI Corporation BerhadAnnual Report 2003