Internal control and risk management

In accordance with the FRC ‘Guidance on Risk Management, Internal Control and Related Financial Business Reporting’ the Board recognises that it is responsible for the Group’s system of internal control and risk management. The system has been designed to manage rather than eliminate the risk of failure to achieve business objectives and can only provide reasonable and not absolute assurance against material misstatement or loss.

The Board has embedded a continuous process for identifying, evaluating and managing the Group’s significant risks, including risks arising out of Bodycote’s corporate and social engagement. The Board’s monitoring covers all significant strategic, financial, operational and compliance risks. It is based principally on reviewing reports from management and from Internal Audit (IA) to consider whether any significant failings or weaknesses are promptly remedied or indicate a need for more extensive monitoring. The Audit Committee assists the Board in discharging these review responsibilities.

The emerging risk review, based around horizon scanning, has explored what the future might look like and seeks to identify early warning signals. These emerging risks are characterised by their high level of uncertainty both in terms of likelihood and potential impact and are therefore more difficult to manage or mitigate. Risks that have been considered by the Board have included:

• COVID-19 – the long-term effect of this and other possible pandemics;
• geopolitical risks – increased international tensions and tariffs;
• move away from internal combustion engines towards electric vehicles; and
• continued environmental activism, as well as increased focus from both regulators and the investment community on climate change.

The Board is satisfied that the Group maintains an effective system of internal controls and that there were no significant failings or weaknesses in the system. The system was in operation throughout 2022 and continues to operate up to the date of the approval of this report. The key elements of the Group’s system of internal control that is monitored by the Board include:

• Key financial, legal and compliance policies that apply across the Group including: Detailed Financial Policies, Group Authority Matrix, Anti-Bribery and Anti-Corruption, Anti-Slavery and Human Trafficking, Core Values and Code of Conduct. There are also procedures in place for the identification, reporting and resolution of potential fraudulent activities.
• A comprehensive financial planning, accounting and reporting framework.
• Bodycote has engaged BDO to monitor and assist in improving the Group’s internal control system. IA reviews are conducted on the basis of a risk-based plan approved annually by the Audit Committee. To provide assurance on the continued operation of controls, financial control self-assessments (CSAs) have been developed and implemented in each division. The results of these CSAs have been verified by IA. The findings and recommendations from IA are reported on a regular basis to the Executive and Audit Committees.
• An annual internal control self-assessment, with management certification, is undertaken at every Bodycote plant.

The assessment covers the effectiveness of key financial, compliance and selected operational controls. The results are validated by IA through spot checks and are reported to the Executive and Audit Committees.

During 2022, in compliance with Provision 29 of the Code, the Executive Committee performed an assessment of its risk management processes by holding risk reviews. Risk reviews were conducted via an internally facilitated risk workshop and also an externally facilitated workshop with BDO. Management’s assessment, which has been reviewed by the Board, included a review of the Group’s key strategic, operational and emerging risks.

The 2022 emerging risk discussion focused on the wider effects of climate change on the Group and the rise in inflation and energy costs on Bodycote’s business. As a result of the discussion, it was concluded that the principal risks reported as at December 2022 remained valid. Refer to pages 28 to 32 for further information on principal risks and uncertainties affecting the Group.