Annual Report - EDP

: corporate governance :new matters were included, such as estimates,valuations and assessments subject toprofessional judgements considered high riskin a bottom-up analysis.º º The EDP Renováveis subgroup also identifiedthe stand alone scope with the materiality andrisk suited to its size, given that its shares arelisted on the securities regulated market, withtheir inherent duty to provide information.The certificate was published in its 2012Annual Report and Accounts.º º In line with the recommendation of ComisiónNacional del Mercado de Valores(CNMV - Securities Market Commission), theHC Energía/Naturgas subgroup underwentidentification of its stand alone scope with themateriality and risk suited to its size, given thatit has bonds on the securities regulated market.The certificate was published in its 2012Annual Report and Accounts.º º Under Brazilian legislation, which requiresperiodic rotation of the team of auditors,EDP Brasil began to be audited by Deloitte,a different entity from the other EDP Groupcompanies. Its control matrix underwent acomplete revision and the evaluation wasperformed by the new external auditor, thoughusing the methods and planning defined by theGroup’s external auditor, KPMG Portugal.º º SCIRF managers were identified, reviewedand appointed on the basis of the result ofthe model and review and/or update resultingfrom organisational, structural, legislative andoperational changes in the business units.º º New processes were documented andprocesses and controls documented in previouscycles were controlled and redesigned.º º Necessary action was taken to resolve the nonconformitiesidentified in the evaluation tests.º º The SCIRF managers used self-assessmentto evaluate the adequacy and updating ofdocumentation and maintenance of evidence incontrol activities at different levels in the chainof command.The 2012 SCIRF was conducted by the Group’sexternal auditor in accordance with ISAE 3000 –International Standard on Assurance Engagementsin all the countries covered by the scope model,with the support of Deloitte for EDP Brasil.The procedures followed by the Group in themaintenance, assessment and monitoring ofthe SCIRF demonstrate a reasonable degreeof certainty as to the reliability of the financialinformation provided to the market andguarantees quality and soundness in line withthe best international practices and standards.No material deficiencies were detected.The external auditor issued an independent reporton the Group’s internal control system for thefinancial statements as at 31 December 2012.It is included in the Annex V.II.5.2. RISK MANAGEMENTSTRUCTUREII.5.2.1. Risk managementmandate and structureThe diversity of the Group’s business linescontinued to ensure a low level of intrinsic risk,mainly due to: (i) the high relative weight ofregulated businesses, (ii) growth in low-riskactivities, such as wind generation with lowexposure to electricity market prices, (iii) use ofappropriate hedging policies to mitigate financial,fuel and price risks and the risk of the amount ofelectricity placed or bought on the market and(iv) the increase in geographical diversification ofrisk with a reduction in the weight of the IberianEDP - Annual Report 2012Peninsula. This diversification has been essentialin mitigating the company’s risks, including thosearising from the financial crisis and more recentlythe European sovereign debt crisis.The organisation and process of risk managementin place in the Group have received the highestclassifications in the Dow Jones SustainabilityIndex, challenging us to further integrated R2R– return to risk methods and include them inthe normal management business units and theCorporate Centre. The process is based on thefollowing components:º º Identification of risks – risk assessment. Stepshave been taken to ensure that this processis included in the usual cycle of preparing thebusiness plan and budget, at least for the mostimportant risks and from the point of view oftop management. There is also a risk portal tobe used by the Risk Management Departmentin recording work done and the consolidationof the most important risks from a joint pointof view and also for the use of the businessunits, according to their needs. This tool wasdeveloped in-house and the system was updatedin 2012 to adapt it to users’ needs. The tool isused for the consistent collection of informationon each relevant risk, with qualitative and, as faras possible, quantitative assessments of overallimpact, minimum and maximum likelihoodof occurrence and degree of control, and forpreparing priority matrices for action or control.It enables us to answer the following questions:what are the most important risks for eachbusiness unit and how big are these risks?º º Risk owner. This is how we clarifyresponsibilities in risk management andcoherence in internal delegation of powersand contracts for supplies and services frominternal or external outsourcers. For eachof the priority risks, we seek to identify keymeasures that can be used to avoid or mitigatethe risk and decide on the transfer of the risk toanother entity (e.g. insurance, hedging).This tool answers the following questions: whois responsible for managing a certain risk?Which risks is it in EDP’s interest to manage andwhich should be transferred to other entities?º º Risk appetite. Considering that it is assessedon the way in which the Group plans to grow(business areas, countries, acquisitions orcorporate growth), how it is going to obtainfunding for this (and dividend paymentcommitments) and what rating it wishes tomaintain or obtain, the rating is the basicoperative condition, by endeavouring to satisfyappropriate ratios: net debt/EBITDA, FFO/netdebt among others. Although ratings dependon broader indicators, some of which aresubjective, and also on the sovereign rating,which according to some agencies is the limiton the ratings of a country’s companies(a company’s rating cannot be one or two levelshigher than the sovereign rating, for example),they are the most important indicators andconstitute part of the controls. From a strategicperspective, the Group defines the overall limitson its activity – vision – and its commitments inits Annual Report and Accounts. They set out theareas of risk in which its work is done (i.e. therisk inherent in a multi-utility strategy outsidethe energy branch is not included). It enablesus to answer the following questions: does thecompany have the necessary capital for therisks that it takes? Is it overexposed or overinsured?How much risk does it want to take?º º Integrated risk assessment. This dimensionof risk control uses bottom-up methods tomeasure EBITDA, EBIT and cash flow at risk,along with other financial indicators from the117