2008 Registration Document - Rexel

of efficient and adequate internal control is among theirobjectives. A specific steering tool was rolled out in 2006to structure and render permanent the adoption of thestandard by all relevant internal control participants. Theimplementation of this tool is the responsibility of the AuditDepartment.2.3 Overview of the internal controlsystem2.3.1 Control environmentThe control environment is considered as the keystoneof the internal control system. At the Company, this isexpressed through the importance given to the principle of“responsibility” in the definition of the roles and responsibilitiesof each person, and in particular, management.The control environment is favored by the implication ofmanagement in promoting ethical conduct. The Group’sethical guidelines, which were translated into 16 languages,were distributed to all employees in 2007.In addition, as concerns the principle of responsibility, theManagement Board approved a market ethics charter onApril 4, 2007 in accordance with recommendations fromthe French Autorité des marchés financiers (AMF). Thischarter was developed to reinforce the rules applicablein the management of risks such as holding, disclosing orpotentially using inside information (it being specified thatinside information is information that is non-public andspecific, and that if made public, could have an effect onshare price).Finally, the principle of “responsibility” is also expressed bythe Group’s commitment to its environmental and socialresponsibilities, which are articulated in a sustainabledevelopment charter, the promotion of environmentalprotection measures and raising awareness among ourcustomers and suppliers.2.3.2 Risk identification, assessment andmanagementThe Group’s Audit Department leads risk mapping andmanagement processes.Used both as identification and monitoring tool, this“mapping” has been improved by meetings with GeneralManagement and the Executive Committee. Theparticipation of the headquarters’ operational managementand zone management provides insight into the moretechnical risks and those relating to changes in theeconomy. It also allows the vision of risks to be sharedamong executive management, provides an understandingof the interaction of different factors and improves the riskawareness of the Group.Following a risk inventory, an assessment of the potentialseverity of risks allows for the ranking of risks. Risks arethen categorized by level of acceptability and measuresexisting to limit these risks are identified.An analysis which began in 2007 and pursued in 2008,identified the most important risks.This risk analysis covers four areas:− the economic environment: expansion of markets, priceof commodities, the Company’s capacity to adapt tochanges in the market, relations with customers andsuppliers;− operations: diversification and adaptation of theCompany’s offering, acquisitions and integrations,efficiency of monitoring processes, operational continuityin case of crisis;− support activities: project management, adaptation ofinformation systems to operations, legal protection anddefense against litigation; and− human resources: attractiveness of the Company as anemployer, staff loyalty, training and adaptation of expertiseto the demands of the market, reacting to change.Several risks were subject to a more thorough investigationand the proposed measures to address them wereimplemented. These measures have been discussed duringthe Executive Committee meetings and the conclusionshave been presented to the Audit Committee. The objectiveof the Group is to pursue the documentation, in 2009, of itsrisk management policy, which is focused on strategic andtransversal risks.Operational risks are managed in priority by countries incollaboration with headquarters’ operational management,in accordance with the Group guidelines (see paragraph2.3.3 of this report).2.3.3 Internal control guidelines: ProceduremanualThe Group has compiled an internal control proceduremanual which has been distributed to the managementof its operating subsidiaries. For each main process, themanual presents the fundamental risk management andinternal control standards that must be observed andintegrated into the work process.For example, the guideline contains 800 controls conceivedfor an operational subsidiary, divided into the followingactivities:− strategic procedures: external growth and development,governance and communication;− operating procedures: sales, purchasing and logistics;and− support activities: information systems, human resources,financial and accounting information, tax, legal affairs,property management and insurance.For certain activities (human resources, legal, IT, consolidationand reporting, treasury and credit management), thismanual refers to additional procedures.As to management reporting and the preparation of financialstatements, the Administrative and Financial division hasREXEL 2008 | PAGE 275