Safeguarding future returns
The board of Debenhams is responsible for determining the nature and extent of the risks it is willing to take in achieving its strategic objectives. As part of its decision-making process, the board, which has overall responsibility for risk management and internal control, considers it important that there should be a regular and systematic approach to risk issues in order to provide assurance that strategic targets can be met. This approach includes the board’s own assessment of risk which takes into consideration factors identified through organisation-wide risk reviews.
Internal control
The board is responsible for the Company’s system of internal control and for reviewing the effectiveness of the internal control systems in place. Such systems are designed to manage rather than eliminate the risk of failure to achieve the business objectives and can only provide a reasonable and not an absolute assurance against material misstatement or loss. The board has conducted a review of the effectiveness of internal controls and is satisfied that the controls in place remain appropriate.
Debenhams maintains a framework of internal controls using the COSO model, which covers the following activities: control environment; risk assessment; information and communication; control activities; and monitoring. These activities are described in more detail below. In addition, the board takes into consideration relevant guidance provided by the Financial Reporting Council and other enterprise risk management best practices.
Control environment
The board demonstrates the control environment to Debenhams’ stakeholders through its compliance with the UK Corporate Governance Code, Debenhams’ own internally published risk management strategy, related policies and procedures and, in particular, the Debenhams’ Code of Business Conduct.
Risk assessment
Risks to the achievement of Debenhams’ strategic and operational goals have been identified through various organisation-wide reviews, the most recent of which was completed in October 2011. The senior management team, including the board, participated in this exercise which considered the business strategy, related objectives, internal and external risks to their achievement, changes in legislation and any new or emerging risks, together with existing and any new controls required to mitigate those risks. Risks were ranked according to a matrix of likelihood and impact of occurrence and plotted onto the Company risk map, an example of which is shown below.
The calculation of the impact and likelihood was supported by guideline bandings of how to classify the risk based on the overall change in performance across a number of KPIs to ensure consistency. The Group’s risk register was also updated and the internal audit plan adjusted accordingly.
Information and communication
The board reviews the key risks and relevant mitigation strategies annually, which could include that the risk is tolerated, transferred, treated or terminated, to ensure that all key issues are being managed effectively, taking action to strengthen where necessary. In addition, the Audit Committee satisfies itself that the key risks are being monitored by senior management and that the internal audit plan is focused on high priority areas.
The internal audit team updates the board and the Audit Committee on the effectiveness of risk management within each discrete area audited throughout the year. The Audit Committee will bring any areas of concern to the attention of the board.
Control activities
A series of control activities is used to mitigate the risks identified include risk transfer (through a third-party contract), financing the risk through insurance or consideration by management of re‑engineering the process in question.
In addition, only suitably qualified employees are responsible for each of the functions within Debenhams to ensure that each area operates effectively. Training, performance reviews and support mechanisms are also in place to ensure standards of performance are maintained.
Monitoring
The risks that have been identified are monitored through a variety of mechanisms which include: monthly management accounts, board meetings, the audit programme, fraud detection systems across point of sale and certain central data repositories including new developments for multi-channel operations, the critical and serious risk monitor, internal procedures such as stocktakes and stockfile counts, prevention tools such as CCTV and through management controls.
In addition, Debenhams operates a number of processes to test its financial information and controls. An operating plan is prepared in August of each year, shortly before the start of the financial year and a revised forecast is prepared each month of the financial year which analyses actual performance and highlights variances against the plan. In particular, performance is monitored through a series of key ratios. Daily sales, weekly sales and margin and monthly management accounts are prepared, all of which report on performance against the operating plan, last year and forecast. A treasury report is made to each board meeting which covers matters such as senior operating restrictions and covenant reporting and forecasting (under the Group’s banking facilities), exposure to foreign exchange and hedging arrangements, net debt and interest rate hedging, cash flow and cash flow forecasting and amounts deposited with counterparties.
Risk management and internal audit
Debenhams’ risk management function includes the internal audit, anti-fraud, insurance and profit protection departments. This combination enables the Company to maintain a cohesive approach to all aspects of risk management whilst allowing the internal audit team to benefit from the insights that other elements of the function can provide. The internal audit plan focuses on critical and serious risk testing of high priority areas.
An evaluation of the effectiveness of both internal and external audit teams was undertaken by an external company in August 2011. The respondents included all members of the Audit Committee, members of the board, function heads and senior retail managers.
In relation to the internal audit function, this evaluation considered effectiveness in a number of categories: interaction with the Audit Committee, robustness of audit, quality of delivery and quality of team. The categories for external audit were: robustness of audit, quality of delivery and quality of people and service. Whilst improvements can always be made, the overall feedback was very positive for both internal and external audit effectiveness.
Whistleblowing
All Debenhams’ employees are required to adhere to the Code of Business Conduct and the Anti-Bribery and Corruption Policy, with senior employees required to confirm their compliance in writing. These policies set out the ethical standards expected by the Company and include details of how matters can be raised in strict confidence. Two main routes are available to employees at all levels within the Company to raise concerns over malpractices. The first, “Employees’ guideline to problem solving”, encourages employees to talk to their line manager, their manager’s line manager or, if still concerned, to call HR Connect (the Debenhams’ central human resources team) directly. The second route is a confidential reporting line through which employees can speak to Debenhams’ anti-fraud team. If an employee feels that the matter is so serious that it cannot be discussed in any of these ways, they should contact the Company Secretary or the Head of Internal Audit and Risk Management directly and contact details are provided. The Company’s policy on whistleblowing and these methods of raising issues of concern are published on the Debenhams intranet and emphasised on posters. The policy is also reviewed annually by the Audit Committee. All serious matters identified are raised with the Chairman of the Audit Committee.
Principal risks and uncertainties
The risks detailed overleaf and in the Notes to the Financial Statements are the principal risks and uncertainties that may impact Debenhams’ ability to achieve its strategic and operational goals. Both external factors, such as the economic environment, and internal factors, such as the retention of key management, are included in the risks and uncertainties that could substantially impact performance. Relevant mitigation for each risk is also outlined. These risks are presented in no particular order. It should be noted that any system of risk management and internal control is designed to manage rather than eliminate the risk of failure to achieve business objectives and can only provide reasonable and not absolute assurance against material misstatement or loss.
