Carrefour - 2017 Registration Document

4 MANAGEMENT’S DISCUSSION AND ANALYSIS AS OF DECEMBER 31, 2017 Internal control system CARREFOUR | 2017 REGISTRATION DOCUMENT 205 Internal control organisation and parties involved 4.8.2 Internal control organisation 4.8.2.1 Internal control activities are designed to ensure that the necessary measures are taken in order to reduce exposure to the strategic, operational and asset risks likely to affect the achievement of the Group’s objectives. Control activities take place throughout the organisation, at every level and in every function, including prevention and detection controls, manual and IT controls, and hierarchical controls. The Group is organised geographically to ensure that specific local needs and interests are addressed effectively and that operations are as responsive as possible, with each country serving as a basic link in its organisation. The internal control system comprises formal procedures and operating methods for each country, which stipulate ways of carrying out an action or process in accordance with the Group’s regulatory framework. The internal control system is based on this organisational principle: the Group’s Executive Management sets the reference ● framework for the Group’s internal control system. Executive Management’s role is to design, coordinate, lead and continuously supervise internal control systems, and it has defined a Group regulatory framework that covers all the principles and standards applicable at store, supply chain and Group support function level. All countries are required to implement the Group regulatory framework. Its main aims are to cover all risks related to the Group’s assets through more than 100 rules: accounting and financial risks, ● risks associated with the safety and security of people and ● property, risks to the continuity, integrity, confidentiality and security of ● information systems, contractual obligation, compliance and communication risks; ● at country level, the Country Executive management teams are ● responsible for adopting and implementing internal control procedures. They have established procedures and operating methods, including control activities required to cover all the strategic, operational and asset risks relating to their businesses and organisation. These procedures and operating methods include and extend the key controls set out in the Group’s regulatory framework. Parties involved in internal control 4.8.2.2 A. At Group level The Group’s Executive Management is responsible for the internal control system. It is also tasked with designing, implementing and overseeing the internal control systems suited to the size of the Group, its activity and its organisation. It initiates any corrective actions that are needed to rectify an identified malfunction and to maintain a situation within the limits of acceptable risk. It ensures that these actions are successfully implemented. Executive Management’s duties in relation to the internal control system also include defining the corresponding roles and responsibilities in the Group. The Group’s Executive Management has created the following organisation structure: the Group Finance Department is responsible for: ● ensuring that accounting and financial information is reliable, ● managing risks that may be reflected in the financial statements and have an impact on them, measuring Group performance and budget control, ● following Group investment procedures; ● the Group Legal Department is responsible for: ● overseeing the governance policy for legal services, ● establishing the governance policy of Group subsidiaries, ● managing the Group’s legal risks, ● establishing the Group’s market abuse prevention policy; ● the Group Risks & Compliance Department is responsible for: ● identifying, analysing, assessing and addressing risks within ● the Group, in support of the Functional Departments and Country Executive Directors, managing risks associated with the safety and security of people and property, through a Risk Prevention Charter and a safety policy for travel abroad, establishing an overall compliance framework by drawing up ● and circulating compliance programmes throughout the entire Group, establishing the Group’s insurance policy, ● coordinating the Group crisis management system; ● the Group Property Department is responsible for: ● establishing the Group’s property policy, ● risk management related to security and the operation of establishments open to the public; the Group Quality Department is responsible for: ● establishing the product quality, health and safety policy ● within the Group, managing security, quality, compliance and product safety risk, ● coordinating crisis management relating to product safety risks; ●