Internal control and risk management

In accordance with the FRC ‘Guidance on Risk Management, Internal Control and Related Financial Business Reporting’ the Board recognises that it is responsible for the Group’s system of internal control and risk management. The system has been designed to manage rather than eliminate the risk of failure to achieve business objectives and can only provide reasonable and not absolute assurance against material misstatement or loss.

The Board has embedded a continuous process for identifying, evaluating and managing the Group’s significant risks, including risks arising out of Bodycote’s corporate and social engagement. The Board’s monitoring covers all significant strategic, financial, operational and compliance risks. It is based principally on reviewing reports from management and from Internal Audit (IA) to consider whether any significant weaknesses are promptly remedied or indicate a need for more extensive monitoring. The Audit Committee assists the Board in discharging these review responsibilities.

To meet updated guidance from the FRC a new process was implemented in 2019 to identify emerging risks. These risks are characterised by their high level of uncertainty both in terms of likelihood and potential impact and are therefore more difficult to manage or mitigate. The process, based around horizon scanning, has explored what the future might look like and seeks to identify early warning signals. Risks that have been considered by the Board have included climate change, new technologies, and cyber risks.

The Board is satisfied that the Group maintains an effective system of internal controls and that there are no significant deficiencies in the system. The system was in operation throughout 2019 and continues to operate up to the date of the approval of this report. The key elements of the Group’s system of internal control that is monitored by the Board includes:

• A comprehensive financial planning, accounting and reporting framework
• A Group authority matrix that clearly defines the authority limits for those with delegated responsibility and specifies what can only be decided with central approval.
• Effective from the 1st January 2020 IA is co-sourced with BDO (previously Ernst & Young) to monitor the Group’s internal control system. IA reviews are conducted on the basis of a risk-based plan approved annually by the Audit Committee. This includes risk-based visits to each division, shared service centres, anda sample of facilities. The findings and recommendations from IA are reported on a regular basis to the Executive and Audit Committees.
• An annual internal control self-assessment, with management certification, is undertaken by every Bodycote facility. The assessment covers the effectiveness of key financial, compliance and selected operational controls. The results are validated by IA through spot checks and are reported to the Executive and Audit Committees.
• Group Core Values and Group Policies (including the Code of Conduct, Group Authority Matrix and Finance Policies) are documented and are available to all employees via the Group’s intranet system.
• The Chief Financial Officer, Group Financial Controller, President and Vice President of Finance for each division sign a letter of representation annually. This is to confirm the adequacy of their systems of internal controls, their compliance with Group Core Values and Group Policies, relevant laws and regulations, and that they have reported any control weaknesses and actual, or attempted, frauds or thefts through the Group’s assurance processes.
• A Group-wide risk register and assurance map is maintained throughout the year to identify the Group’s key strategic and operational risks. Any changes to these risks during the year are promptly reported to the Executive Committee and the Board.

During 2019, in compliance with provision 29 of the Code, management performed an assessment of its risk management processes for the purpose of this Annual Report. Management’s assessment, which has been reviewed by the Audit Committee and the Board, included a review of the Group’s key strategic, operational and emerging risks. The review was based on work performed by the Group Head of Risk and the Group’s Risk and SHE Committee (by means of workshops, interviews, investigations, and by reviewing departmental or divisional risk registers). These risks have been reviewed throughout the year and no new risks have been added in 2019. Further information regarding the ways in which the principal business risks and uncertainties affecting the Group are managed is shown on pages 27 to 30 of the 2019 Annual Report.

By order of the Board:
U.S. Ball
Group Company Secretary
12 March 2020
Springwood Court
Springwood Close
Tytherington Business Park
Macclesfield
Cheshire
SK10 2XF