Maxis Berhad | Annual Report 2013

62 Maxis Berhad | Annual Report 2013 INTRODUCTION The Board affirms its overall responsibility for the Group’s system of internal control and risk management and for reviewing the adequacy and effectiveness of the system. The Board is pleased to share the main features of the Group’s risk management and internal control system in respect of the financial year ended 31 December 2013. In discharging its stewardship responsibilities, the Group has established a sound risk management framework and procedures of internal control. These procedures, which are embedded into the culture, processes and structures of the Group are subject to regular review by the Board, provide an ongoing process for identifying, evaluating and managing the significant risks faced by the Group that may affect the achievement of its business objectives and strategies. The Group’s risk management framework and internal control procedures, in all material aspects, are consistent with the guidance provided to Directors as set out in the “Statement on Risk Management and Internal Control: Guidelines for Directors of Listed Issuers”. BOARD RESPONSIBILITY The Board of Maxis, in discharging its responsibilities, is fully committed to articulating, implementing and reviewing a sound risk management and internal control environment. The Board is responsible for determining the Group’s level of risk tolerance and in conjunction with Management, to actively identify, assess and monitor key business risks in order to safeguard shareholders’ investments and the Group’s assets. The risk management and internal control systems are designed to identify, assess and manage risks that may impede the achievement of the Group’s business objectives and strategies rather than to eliminate these risks. They can only provide reasonable and not absolute assurance against fraud, material misstatement or loss, and this is achieved through a combination of preventive, detective and corrective measures. RISK MANAGEMENT The Board regards risk management as an integral part of the Group’s business operations and has oversight over this critical area through the Audit Committee. The Audit Committee, supported by the Internal Audit department, provides an independent assessment of the effectiveness of the Maxis Enterprise Risk Management (“ERM”) framework and reports to the Board on a half- yearly basis. The Maxis ERM framework is consistent with the ERM framework of the Committee of Sponsoring Organisations (“COSO”) and involves systematically identifying, analysing, measuring, monitoring and reporting on the risks that may affect the achievement of its business objectives. This framework helps to reduce the uncertainties surrounding the Group’s internal and external environment, thus allowing it to maximise opportunities and minimise adverse incidences that may arise. The major risks to which the Group is exposed to are strategic, operational, regulatory, financial, market, technological, products and reputational risks. MAXIS’ ENTERPRISE RISK MANAGEMENT FRAMEWORK The ERM process is based on the following principles: • Consider and manage risks enterprise-wide; • Integrate risk management into business activities; • Manage risk in accordance with the Risk Management framework; • Tailor responses to business circumstances; and • Communicate risks and responses to Management STATEMENT ON RISK MANAGEMENT AND INTERNAL CONTROL RISKS OBJECTIVE CONTROL A L I G N M E NT IDENTIFY & ANALYSE RESPOND MONITOR & REPORT