Carrefour - 2017 Registration Document

MANAGEMENT’S DISCUSSION AND ANALYSIS AS OF DECEMBER 31, 2017 Internal control system 2017 REGISTRATION DOCUMENT | CARREFOUR 4. 206 the Group CSR Department is responsible for: ● ensuring Carrefour suppliers uphold human rights, ● defining and implementing processes to ensure that suppliers ● comply with the Group’s Social and Ethical Standards Charter, which is an integral part of all procurement contracts, managing the audit process, which includes a preliminary ● review with the sourcing teams, an initial audit with an independent firm, follow-up audits by independent firms with second-opinion audits carried out by the Group and, lastly, specific audits to check one-off or specific items, helping suppliers to achieve compliance in partnership with ● FIDH, raising awareness among suppliers and sourcing teams and providing them with training, implementing a duty of care and prevention plan with respect ● to the environment, employees, human rights and corruption, jointly with the Group Risks & Compliance Department; the Group Human Resources Department is responsible for: ● establishing a human resource management policy within the ● Group that: ensures the proper availability level of resources, suitable for current and future business requirements, monitors employees’ career development and commitment, ensures high-quality social dialogue, ● defines the framework for the compensation policy and ● employee benefits and guides the associated commitments, helps to create a culture of collective development and ● performance; coordinating social risk management; ● the Group Information Systems Department is responsible for: ● establishing the information systems security policy within the ● Group. Information systems aim to respond to needs and meet requirements regarding information security, reliability, availability and traceability: at Group level, the accounting and financial information ● system is based on a reporting and consolidation tool for preparing the Consolidated Financial Statements and measuring the Group’s operating performance, the Country Executive Directors are responsible for their ● own information systems, and have implemented measures to ensure system security and digital data integrity; managing risks relating to the continuity, integrity, ● confidentiality and security of information systems; the Group Insurance Department is responsible for setting up ● insurance to cover the Group’s insurable risks as effectively as possible and according to available capacity on the market, pursuant to Group insurance policies. It works with the Group Risks & Compliance Department in transferring a portion of the risks to the insurance market; the Group Internal Audit Department is tasked with: ● assessing the operation of asset risk management and related ● internal control systems by performing the tasks included in the annual audit plan, regularly monitoring and making any necessary ● recommendations to improve these systems, leading and consolidating the annual self-assessment ● campaigns to develop internal control tools as carried out by the Country Executive Directors. The Board of Directors reports on the Group’s principal risks and uncertainties in the management report. It takes note of the process for preparing the financial information as well as the essential characteristics of the internal control and risk management systems communicated in a timely manner by the Accounts Committee and the Group’s Executive Management. It also takes note of the CSR risk prevention plan provided by the CSR Committee. The role of the Accounts Committee established by the Board of Directors is primarily to: review the financial statements and ensure that the accounting ● methods adopted to prepare the Company and Consolidated Financial Statements are relevant and consistent before they are presented to the Board of Directors. It monitors the procedures used to prepare the financial statements and assesses the validity of the methods used to present material transactions; monitor the process for preparing financial information and, ● where applicable, make recommendations to ensure the integrity of such information; monitor the effectiveness of the internal control, risk ● management and, where applicable, internal audit systems relating to the preparation and processing of accounting and financial information, without compromising its independence. It ensures that such systems are in place and implemented, and that corrective measures are undertaken in the event that any failings or anomalies are identified. For this purpose, the Statutory Auditors and the internal audit and risk control managers submit their main findings to the committee. It consults the internal audit and risk control managers and issues its opinion on the organisation of their services. It must be kept informed about the internal audit programme and must be provided with the internal audit reports or a regular summary of these reports; review risks and material off-balance sheet commitments, assess ● the significance of any malfunctions or weaknesses reported to it and inform the Board of Directors where appropriate. As such, the review of the financial statements must be accompanied by a presentation prepared by Group Executive Management describing the Company’s risk exposure and its material off-balance sheet commitments, as well as a presentation prepared by the Statutory Auditors highlighting both the key findings of their statutory audit, including any audit adjustments and significant internal control failings identified during their engagement, and accounting options applied. In the management report, it reviews the section covering internal control and risk management procedures;