This area of our Corporate Governance section contains information on our Risk Management policies, processes and controls, covering:
Overall responsibility
The Audit Committee and the Board reviewed our risk management processes during the fiscal year.
The Audit Committee has oversight of the Company’s risk management policies, procedures and controls. The Audit Committee reviews, monitors and discusses these matters with the CEO, CFO, General Counsel and Director of Internal Audit. The Audit Committee, CEO, CFO and General
Counsel report periodically to the Board on the Company’s risk management policies, processes and controls.
The Audit Committee is supported in its oversight role by the policies put in place by management to oversee and manage material business risks, as well as the roles played by the Corporate, US and Asia Pacific Risk Management Committees, as described below, and internal and external audit functions. The internal and external audit functions are separate from and independent of each other and each has a direct reporting line to the Audit Committee.
At a management level, the GMT (comprising in fiscal year 2011 the CEO, CFO, General Counsel, Executive General Manager USA, Executive General Manager International and the Vice President of Investor and Media Relations) is the primary management forum for risk assessment and management within the Company.
Objective
The Company considers that a sound framework of risk management policies, procedures and controls produces a system of risk oversight, risk management and internal control that is fundamental to good corporate governance and creation of shareholder value. The objective of the Company’s risk management policies, procedures and controls is to ensure that:
- our risk management systems are effective;
- our principal strategic, operational and financial risks are identified;
- effective systems are in place to monitor and manage risks; and
- reporting systems, internal controls and arrangements for monitoring compliance with laws and regulations are adequate.
Risk management does not involve avoiding all risks. The Company’s risk management policies seek to strike a balance between ensuring that the Company continues to generate financial returns and simultaneously manages risks appropriately by setting appropriate strategies and objectives.
Policies for management of material business risks
Management has put in place a number of key policies, processes and independent controls to provide assurance as to the integrity of our systems of internal control and risk management. In addition to the
measures described elsewhere in this report, the more significant policies, processes or controls adopted by the Company for oversight and management of material business risks are:
- quarterly meetings of the corporate, US and Asia Pacific Risk Management Committees to assess the key strategic, operations, reporting and compliance risks facing the Company, the level of risk and the processes implemented to manage each of these key risks over the upcoming twelve months;
- quarterly reporting to the GMT, Audit Committee, and annual reporting to the Board, of the Risk Management Committees’ assessment regarding the key strategic, operations, reporting and compliance risks facing the Company;
- a program for the Audit Committee to review in detail each year all items identified by the Risk Management Committees as high level risks;
- meetings of the Financial Statements Disclosure Committee to review all quarterly and annual results;
- a planning process involving the preparation of three-year strategic plans and a rolling twelve month forecast;
- annual budgeting and monthly reporting to monitor performance;
- an internal audit department with a reporting line direct to the Chairman of the Audit Committee;
- regular monitoring of the Company’s liquidity and status of finance facilities;
- maintaining an appropriate insurance program;
- maintaining policies and procedures in relation to treasury operations, including the use of financial derivatives;
- issuing and revising standards and procedures in relation to environmental and health and safety matters;
- implementing and maintaining training programs in relation to legal issues such as trade practices/antitrust, trade secrecy, and intellectual property protection;
- issuing procedures requiring significant capital and recurring expenditure to be approved at the appropriate levels; and
- documenting detailed accounting policies, procedures and guidance for the group in a single group finance manual.
A summary of these policies, processes and controls is available in the Investor Relations area of our website (www.jameshardie.com). During the fiscal year, the Audit Committee and, through it, the Board
received a number of reports on the operation and effectiveness of the policies, processes and controls described in this section. This included a review of the Company’s current compliance programs and disclosure controls and processes, how they compare with best practices and the steps proposed by management to continue cultivating the Company’s risk management culture.
Risk Management Committee
During the fiscal year, the Risk Management Committee was divided into three separate committees, one for Corporate, one for the US business and one for the non-US business, to allow each committee to focus on individual risks in greater detail. Each Committee comprises a crossfunctional group of employees and reviews and monitors the risks facing the Company in their area of responsibility. The Risk Committees are coordinated by the Director of Internal Audit and report on a quarterly basis to the GMT. The Risk Committees also provide quarterly reports to the Audit Committee on the procedures in place for identifying, monitoring, managing and reporting on the principal strategic, operational, financial
and legal risks facing the Company.
Internal audit
The Director of Internal Audit heads the internal audit department. The Internal Audit charter sets out the independence of the internal audit department, its scope of work, responsibilities and audit plan. The internal audit department’s workplan is approved annually by the Audit Committee. The Director of Internal Audit reports to the Chairman of the Audit Committee and meets quarterly with the Audit Committee and Board in executive sessions.
External audit
The external auditor reviews each quarterly and half-year consolidated financial statements and audits the full year consolidated financial statements. The external auditor attends each meeting of the Audit
Committee, including an executive session where only members of the Audit Committee and Board directors are present. The Audit Committee has approved policies to ensure that all non-audit services performed by the external auditor, including the amount of fees payable for those services, receive prior approval. The Audit Committee also reviews the remuneration paid to the external auditor and makes recommendations to the Board regarding the maximum compensation to be paid to the external auditor.
The Audit Committee reviews and approves management representations made to the external auditor as part of the audit of the full year results
Financial statements disclosure committee
The Financial Statements Disclosure Committee is a management committee comprising senior finance, accounting, compliance, legal, tax, treasury and investor relations executives in the Company, which meets with the CEO, CFO and General Counsel prior to the Board’s consideration of any quarterly or annual results. The Financial Statements Disclosure Committee is a forum for the CEO, CFO and General Counsel to discuss, and, on the basis of those discussions, report to the Audit Committee, about a range of risk management procedures, policies and controls, covering the draft results materials, business unit financial performance and the current status of legal, tax, treasury, accounting, compliance, internal audit, complaints and disclosure control matters.
CEO and CFO certification of financial reports
Under SEC rules and the Company’s internal control arrangements, our CEO and CFO provide certain certifications with respect to our full year financial statements, disclosure controls and procedures and internal controls over financial reporting. These certifications are more comprehensive and detailed than those required under the Australian Corporations Act and are considered appropriate given that the Company’s financial reports are prepared in accordance with US GAAP.
The Board in turn receives quarterly assurance from the Financial Statements Disclosure Committee relating to the Company’s disclosure controls and procedures and internal controls over financial reporting. This assurance is supported by written quarterly and annual sub-certifications from the General Managers and Chief Financial Officers of each business unit, the Director Treasury and the Corporate Controller and the annual certifications from the Group Management Team.
Internal controls and SOX 404
Each fiscal year, the members of the GMT, and key members of the Company’s business and corporate functions, complete an internal control certificate that seeks to confirm that adequate internal controls are in place and are operating effectively, and evaluate any failings and weaknesses.
Management's annual report on internal control over financial reporting
Our management is responsible for establishing and maintaining adequate internal control over financial reporting as defined in Rule 13a-15(f) of the Exchange Act. Because of its inherent limitations, internal control over financial reporting may not prevent or detect all misstatements. Also, projections of any evaluation of effectiveness to future periods are subject to the risk that controls may become inadequate because of changes in conditions, or that the degree of compliance with the policies or procedures may deteriorate.
We assessed the effectiveness of our internal control over financial reporting as of 31 March 2011. In making this assessment, we used the criteria set forth by the Committee of Sponsoring Organizations of the Treadway Commission in Internal Control – Integrated Framework. Based on our assessment using those criteria, we concluded that our internal control over financial reporting was effective as of 31 March 2011. The effectiveness of our internal control over financial reporting as of 31 March 2011 has been audited by Ernst & Young LLP, an independent registered public accounting firm, as stated in their report.
Statement on risk management and control
James Hardie has designed its internal risk management and control systems to provide reasonable (but not absolute) assurance to ensure compliance with regulatory matters and to safeguard reliability of the financial reporting and its disclosures. Having assessed our internal risk management and control systems, the CEO and CFO believe that:
- the risk management and control systems provide reasonable assurance that this annual report does not contain any material inaccuracies; and
- no material failings in the risk management and control systems were discovered in our fiscal year 2010.
This statement is not a statement in accordance with the requirements of Section 404 of the US Sarbanes-Oxley Act. Our analysis of our internal risk management and control systems for purposes of the Dutch Code is different from the report that we are required to prepare in the United States pursuant to Section 404 of the Sarbanes-Oxley Act.
Limitations of control systems
Despite the steps outlined above, our management does not expect that our internal risk management and control systems will prevent or detect all error and all fraud. No matter how well it is designed and operated, a control system can provide only reasonable, not absolute, assurance that the control system’s objectives will be met.
The design of a control system must reflect the fact that there are resource constraints, and the benefits of controls must be considered relative to their costs. Further, because of the inherent limitations in all control systems, no evaluation of controls can provide absolute assurance that misstatements due to error or fraud will not occur or that all control issues and instances of fraud, if any, within the company have been detected.
These inherent limitations include the realities that judgments in decision-making can be faulty and that breakdowns can occur because of simple error or mistake. Controls can also be circumvented by the individual acts of some persons, by collusion of two or more people, or by management override of the controls. The design of any system of controls is based in part on certain assumptions about the likelihood of future events, and there can be no assurance that any design will succeed in achieving its stated goals under all potential future conditions. Projections of any evaluation of controls’ effectiveness to future periods are subject to risks. Over time, controls may become inadequate because of changes in conditions or deterioration in the degree of compliance with policies or procedures.
