Risk management and internal control
In order to understand the risks and potential control issues facing the Company, the following sections as well as risk factors in the Operating and Financial Review should be considered. The system of internal control and, in particular our risk management policies, has been designed to manage rather than eliminate material risks to the achievement of our strategic and business objectives while also recognising that any such process can provide only reasonable, and not absolute, assurance against material misstatement or loss. This process complies with the Turnbull working party guidance (revised October 2005) in this matter and, in addition, contributes toward our compliance with our obligations under the Sarbanes-Oxley Act as well as other internal assurance activities.
The Board considers that a sound system of internal control contributes to safeguarding the Company’s assets and reputation, and, as a result, the interests of our shareholders. Effective operational and financial controls, including the maintenance of qualitative financial records, are an important element of internal control.
In accordance with the Combined Code and the Schedule of Matters Reserved for the Board, the Board retains overall responsibility for the Company’s system of internal control and monitoring its effectiveness. There is an established system of internal control throughout the Company and its businesses. This system depends on thorough and systematic processes for the identification and assessment of business-critical risks and their management and monitoring over time. In depth reports are provided from both line managers and certain internal assurance providers such as Internal Audit and Risk & Compliance. These reports are provided to Board Committees in relation to their specific areas of responsibility. The Board’s Committees then provide reports to the Board in this regard.
The Board reviews the internal control process and its effectiveness on an annual basis to ensure it remains robust and to identify any control weaknesses. The latest review covered the financial year to 31 March 2009 and included the period to the approval of this Annual Report and Accounts.
This review includes:
- the receipt of a Letter of Assurance from the Chief Executive, which consolidates key matters of interest raised through the year-end assurance process;
- assurance from its Committees as appropriate, with particular reference to the reports received from the Audit Committee and Risk & Responsibility Committee on the reviews undertaken by them at their respective Committee meetings; and
- assurances in relation to the Certifications required to be given under the US Sarbanes-Oxley Act, required as a result of the Company’s New York Stock Exchange listing.
Internal control – information assurance
The Board considers that it is imperative to have accurate and reliable information within the Company to enable informed decisions to be taken that further the Company’s objectives. This is supported by a risk-based approach that deals with information assurance as a business critical function. Key elements in managing information assurance risks are education, training and awareness. These initiatives emphasise the importance of information security, the quality of data collection and the affirmation process that supports our business transactions, evidencing our decisions and actions. The Company continues to work collaboratively with a variety of organisations and professional bodies to develop and implement best practice.
Internal control over financial reporting – Sarbanes-Oxley
National Grid has carried out an assessment of its internal control over financial reporting pursuant to s404 of the Sarbanes-Oxley Act 2002. The management of the Company, which is responsible under the Act for establishing and maintaining an adequate system of internal control over financial reporting, evaluated the effectiveness of that system using the Committee of Sponsoring Organizations of the Treadway Commission (COSO) framework. Based on that evaluation, the management of the Company expects to conclude in its Annual Report on Form 20-F filing with the US Securities and Exchange Commission that the system of internal control over financial reporting was effective as at 31 March 2009.