Internal control and risk management

The Board recognises that it is responsible for the Group’s system of internal control and risk management. The system in place has been developed to meet the guidance contained in the Financial Reporting Council’s ‘Guidance on Risk Management, Internal Control and Related Financial Business Reporting’. The system has been designed to manage rather than eliminate the risk of failure to achieve business objectives and can only provide reasonable and not absolute assurance against material misstatement or loss.

The Board has established a continuous process for identifying, evaluating and managing the Group’s significant risks, including risks arising out of Bodycote’s corporate and social engagement. The Board’s monitoring covers all significant strategic, financial, operational and compliance risks. It is based principally on reviewing reports from management and from Internal Audit (IA) to consider whether any significant weaknesses are promptly remedied or indicate a need for more extensive monitoring. The Audit Committee assists the Board in discharging these review responsibilities.

The Board believes that the Group maintains an effective system of internal controls and, in the view of the Board, no significant deficiencies have been identified in the system. The system was in operation throughout 2018 and continues to operate up to the date of the approval of this report. Key elements of the Group’s system of internal control are as follows:

• The Group prepares a comprehensive annual budget which is closely monitored and updated quarterly. The Group’s authority matrix was reviewed and updated during 2018 and this clearly sets out authority limits for those with delegated responsibility and specifies what can only be decided with central approval.
• The Board, with the assistance of EY, who provide co-sourced IA services, monitors the Group’s internal control system. IA reviews are conducted on the basis of a risk based plan approved annually by the Audit Committee. This includes risk based visits to each division, shared service centres and facility. The findings and recommendations from IA are reported on a regular basis to the Executive and Audit Committees.
• An annual internal control self-assessment, with management certification, is undertaken by every Bodycote facility. The assessment covers the effectiveness of key financial and compliance controls and was revised at the start of 2018 to include selected operational controls. The results are validated by IA through spot checks and are reported to the Executive and Audit Committees.
• Group Core Values and Group Policies (including the Code of Conduct, Group Authority Matrix and Finance Policies) are documented and are available to all employees via the Group’s intranet system.
• The Chief Financial Officer, Group Financial Controller, President and Vice President of Finance for each division sign a letter of representation annually. This is to confirm the adequacy of their systems of internal controls, their compliance with Group Core Values and Group Policies, relevant laws and regulations, and that they have reported any control weaknesses and actual, or attempted, frauds or thefts through the Group’s assurance processes.
• A Group-wide risk register and assurance map is maintained throughout the year to identify the Group’s key strategic and operational risks. Any changes to these risks during the year are promptly reported to the Executive Committee and the Board.

During 2018, in compliance with provision C.2.1 of the Code, management performed a specific assessment of its risk management processes for the purpose of this Annual Report. Management’s assessment, which has been reviewed by the Audit Committee and the Board, included a review of the Group’s key strategic and operational risks. The review was based on work performed by the Group Head of Risk and the Group’s Risk and SHE Committee (by means of workshops, interviews, investigations and by reviewing departmental or divisional risk registers). These risks have been reviewed throughout the year and no new risks have been added in 2018. The two risks added in 2017, Environmental and Capital Projects, have been subject to specific Board reviews during 2018. Further information regarding the ways in which the principal business risks and uncertainties affecting the Group are managed is shown on pages 29 to 33 of the annual report 2018.