Risk management and control system

HEINEKEN is a single-product Company, with a high level of commonality in its worldwide business operations spread over many mature and emerging markets. The worldwide activities are exposed to varying degrees of risk and uncertainty, some of which, if not identified and managed, may result in a material impact on a particular operating company, but may not materially affect the Group as a whole.

Doing business inherently involves taking risks, and by managing these risks HEINEKEN strives to be a sustainable and performance-driven company. Structured business risk assessments are part of HEINEKEN’s business planning and control process. Operational risks are mainly managed through the embedding of Key Business Controls based on HEINEKEN common processes and systems. The risk management and control systems are considered to be in balance with HEINEKEN’s risk profile, although such systems can never provide absolute assurance. Following HEINEKEN’s continuing growth and changing risk profile, the Company’s risk management and control systems are subject to continuous review and adaptations.

The Executive Board, under the supervision of the Supervisory Board, is responsible overall for HEINEKEN’s risk management and control systems. Regional and operating company management are responsible for managing performance, underlying risks and effectiveness of operations, within the rules set by the Executive Board, supported and supervised by Group departments.

The commonality of HEINEKEN’s operations, the development of HEINEKEN common processes, systems, and definitions and related performance benchmarking opportunities, facilitate Corporate departments on setting directives and ensuring monitoring. In addition, Corporate departments are contributing to competence development in operating companies by sharing of best practices, common system and tool developments and training programmes. With the growth of the company and evolving business needs, Corporate departments are reviewing and adapting their activities towards operating companies.

HEINEKEN is further developing shared services, mainly driven by synergies, but also strengthening risk management and internal control. Main examples of HEINEKEN’s shared services are world-wide technical services to breweries, contracting of raw and packaging materials by Corporate Purchasing, back office activities with regard to HEINEKEN’s export businesses, and shared IT services for all common system operations. Also within various operating companies, there is a movement towards shared services, like in the widely spread wholesale businesses in Western Europe, and various supportive processes in regional operating companies, managing many mid-sized and smaller market operations.

The main pillar of HEINEKEN’s internal governance activities is the business planning and performance monitoring process. Operating company’s strategy, business plan and quarterly performance are discussed with Regional Management. Regional performance is discussed with the Executive Board. The approved business plans include clear objectives, performance indicators and target setting, which provide the basis for monitoring performance compared to plan. In 2005, a new performance management model was implemented.

HEINEKEN is progressing on the Group-wide development and implementation of uniform processes, common IT systems and business control frameworks based on best practices. At the end of 2005, two third of HEINEKEN’s operations (based on turnover) work in accordance with the evolving HEINEKEN common system. In developing and implementing common systems, risk assessments were included and controls established or adjusted. These internal controls ensure the integrity of the information processing in its support of the day-to-day transactions and financial and management reporting. In 2005, Key Business Control Frameworks were developed and provided to the majority of operating companies for further optimising control design and effectiveness testing.

The Executive Board oversees the adequacy and functioning of the entire system of risk management and internal control, assisted by Group departments. Group Internal Audit provides independent assurance on the entire risk management and internal control system.
The Assurance Meetings at operating company level, oversee the adequacy and operating effectiveness of the risk management and internal control system. Regional Management and Group Internal Audit participate in these meetings to ensure effective dialogue and transparency. Following the introduction of the regional management structure in 2005, Regional Assurance meetings have been established.
The outcome and effectiveness of the risk management and internal control systems have been discussed with the Audit Committee and Supervisory Board.