Risk management and internal control system

STRUCTURE OF THE RISK MANAGEMENT SYSTEM AND INTERNAL CONTROL SYSTEM AT VOLKSWAGEN

The organizational design of the Volkswagen Group’s RMS/ ICS is based on the internationally recognized COSO framework for enterprise risk management (COSO: Committee of Sponsoring Organizations of the Treadway Commission). Structuring the RMS/ICS in accordance with the COSO frame-work for enterprise risk management ensures that potential risk areas are covered in full. Uniform Group principles are used as the basis for managing risks in a standardized manner. Opportunities are not recorded.

Another key element of the RMS/ICS at Volkswagen is the three lines of defense model, a basic element required, among other bodies, by the European Confederation of Institutes of Internal Auditing (ECIIA). In line with this model the Volkswagen Group’s RMS/ICS has three lines of defense that are designed to protect the Company from significant risks occurring.

THE THREE LINES OF DEFENSE MODEL

First line of defense: operational risk management

The primary line of defense comprises the operational risk management and internal control systems at the individual Group companies and business units. The RMS/ICS is an integral part of the Volkswagen Group’s structure and workflows. Events that may give rise to risk are identified and assessed locally in the divisions and at the investees. Countermeasures are introduced immediately, their effects assessed, and the information incorporated into the planning in a timely manner. The results of the operational risk management process are incorporated into budget planning and financial control on an ongoing basis. The targets agreed in the budget planning rounds are continually reviewed in revolving planning updates.

At the same time, the results of risk mitigation measures that have already been taken are incorporated into the monthly forecasts on further business development in a timely manner. This means that the Board of Management also has access to an overall picture of the current risk situation via the documented reporting channels during the year.

The minimum requirements for the operational risk management and internal control system are set out for the entire Group in uniform guidelines. These also include a process for the timely reporting of material risks.

Operational risk management also includes compliance with the Golden Rules in the areas of control unit software development, emission classification and escalation management. These rules are the minimum requirements in the organization, processes and tools & systems categories. We continued to reinforce the internal control system in the area of product compliance in 2018.

Second line of defense: identifying and reporting systemic and current risks using Group-wide processes

In addition to the ongoing operational risk management, the Group Risk Management department each year sends standardized surveys on the risk situation and the effectiveness of the RMS/ICS to the significant Group companies and units worldwide (regular Governance, Risk & Compliance (GRC) process). The feedback is used to update the overall picture of the potential risk situation and assess the effectiveness of the system.

Each systemic risk reported is assessed using the expected likelihood of occurrence and various risk criteria (financial and nonfinancial). In addition, the measures taken to manage and control risk are documented at management level. This means that risks are assessed in the context of any risk management measures initiated, i.e. in a net analysis. In addition to strategic, operational and reporting risks, risks arising from potential compliance violations are also integrated into this process. Moreover, the effectiveness of key risk management and control measures is tested and any weaknesses identified in the process are reported and rectified.

All Group companies and units selected from among the entities in the consolidated Group on the basis of materiality and risk criteria were subject to the regular GRC process in fiscal year 2018.

In addition to the ad hoc and annual risk assessment, the Board of Management also receives quarterly risk reports. Similar to the annual standard GRC process, the assessment takes risk-minimizing control measures into account (net assessment). All Group brands are included in this process along with Porsche Holding Salzburg, Volkswagen Financial Services AG and Volkswagen Bank GmbH.

Information on relevant systemic and current risks is regularly reported to the Group Board of Management and the Audit Committee of the Supervisory Board of Volkswagen AG.

In addition, the Company set up the Group Board of Management Committee for Risk Management in 2017. This met quarterly in the reporting year. The committee has the following tasks, among others:

• to further increase transparency in relation to significant risks to the Group and their management,
• to explain specific issues where these constitute a significant risk to the Group,
• to make recommendations on the further development of the RMS/ICS,
• to support the open approach to dealing with risks and promote an open risk culture.

The Scania brand was incorporated into the standard GRC process in 2018. The brand has already been included in quarterly risk reporting since 2016.

ANNUAL STANDARD GOVERNANCE, RISK AND COMPLIANCE PROCESS

Third line of defense: checks by Group Internal Audit

Group Internal Audit helps the Board of Management to monitor the various divisions and corporate units within the Group. It regularly checks the risk early warning system and the structure and implementation of the RMS/ICS and the compliance management system (CMS) as part of its independent audit procedures.

RISK EARLY WARNING SYSTEM IN LINE WITH THE KONTRAG

The Company’s risk situation is ascertained, assessed and documented in accordance with the requirements of the Gesetz zur Kontrolle und Transparenz im Unternehmensbereich (KonTraG – German Act on Control and Transparency in Business). The requirements for a risk early warning system are met by means of the RMS/ICS elements described above (first and second lines of defense). Independently of this, the external auditors check both the processes and procedures implemented in this respect and the adequacy of the documentation on an annual basis. The plausibility and adequacy of the risk reports are examined on a random basis in detailed interviews with the divisions and companies concerned that also involve the external auditors. The latter assessed our risk early warning system based on this volume of data and ascertained that the risks identified were presented and communicated accurately. The risk early warning system meets the requirements of the KonTraG.

In addition, scheduled examinations as part of the audit of the annual financial statements are conducted at companies in the Financial Services Division. As a credit institution, Volkswagen Bank GmbH, including its subsidiaries, is subject to supervision by the European Central Bank, while Volkswagen Leasing GmbH as a financial services institution and Volkswagen Versicherung AG as an insurance company are subject to supervision by the relevant division of the Bundesanstalt für Finanzdienstleistungsaufsicht (BaFin – the German Federal Financial Supervisory Authority). As part of the scheduled supervisory process and unscheduled audits, the competent supervisory authority assesses whether the requirements, strategies, processes and mechanisms ensure solid risk management and solid risk cover. Furthermore, the Prüfungsverband deutscher Banken (Auditing Association of German Banks) audits Volkswagen Bank GmbH from time to time.

Volkswagen Financial Services AG, which is responsible for the leasing, insurance, services and mobility business and the lending business outside Europe, operates a risk early warning and management system. This system ensures that the locally applicable regulatory requirements are adhered to and at the same time enables appropriate and effective risk management at Group level. Important components of it are regularly reviewed as part of the audit of the annual financial statements.

Monitoring the effectiveness of the risk management system and the internal control system

To ensure the effectiveness of the RMS/ICS, we regularly optimize it as part of our continuous monitoring and improvement processes. In the process, we give equal consideration to both internal and external requirements. On a case-by-case basis, external experts assist in the continuous enhancement of our RMS/ICS. The results culminate in both regular and event-driven reporting to the Board of Management and Supervisory Board of Volkswagen AG.

THE RISK MANAGEMENT AND INTEGRATED INTERNAL CONTROL SYSTEM IN THE CONTEXT OF THE FINANCIAL REPORTING PROCESS

The accounting-related part of the RMS/ICS that is relevant for the financial statements of Volkswagen AG and the Volkswagen Group as well as its subsidiaries comprises measures intended to ensure that the information required for the preparation of the financial statements of Volkswagen AG, the consolidated financial statements and the combined management report of the Volkswagen Group and Volkswagen AG is complete, accurate and transmitted in a timely manner. These measures are designed to minimize the risk of material misstatement in the accounts and in the external reporting.

Main features of the risk management and integrated internal control system relevant for the financial reporting process

The Volkswagen Group’s accounting is essentially organized along decentralized lines. For the most part, accounting duties are performed by the consolidated companies themselves or entrusted to the Group’s shared service centers. In principle, the audited financial statements of Volkswagen AG and its subsidiaries prepared in accordance with IFRSs and the Volkswagen IFRS accounting manual are transmitted to the Group in encrypted form. A standard market product is used for encryption.

The Volkswagen IFRS Accounting Manual, which has been prepared using external expert opinions in certain cases, ensures the application and assessment of uniform accounting policies based on the requirements applicable to the parent. In particular, it includes more detailed guidance on the application of legal requirements and industry-specific issues. Components of the reporting packages required to be prepared by the Group companies are also set out in detail there and requirements established for the presentation and settlement of intragroup transactions and the balance reconciliation process that builds on this.

Control activities at Group level include analyzing and, if necessary, adjusting the data reported in the financial statements presented by the subsidiaries, taking into account the reports submitted by the auditors and the outcome of the meetings on the financial statements with representatives of the individual companies. These discussions address both the reasonableness of the single-entity financial statements and specific significant issues at the subsidiaries. Alongside reasonableness reviews, other control mechanisms applied during the preparation of the single-entity and consolidated financial statements of Volkswagen AG include the clear delineation of areas of responsibility and the application of the dual control principle.

The combined management report of the Volkswagen Group and Volkswagen AG is prepared – in accordance with the applicable requirements and regulations – centrally but with the involvement of and in consultation with the Group units and companies.

In addition, the accounting-related internal control system is independently reviewed by Group Internal Audit in Germany and abroad.

Integrated consolidation and planning system

The Volkswagen consolidation and corporate management system (VoKUs) enables the Volkswagen Group to consolidate and analyze both Financial Reporting’s backward-looking data and Controlling’s budget data. VoKUs offers centralized master data management, uniform reporting, an authorization concept and maximum flexibility with regard to changes to the legal environment, providing a future-proof technical platform that benefits Group Financial Reporting and Group Controlling in equal measure. To verify data consistency, VoKUs has a multi-level validation system that primarily checks content plausibility between the balance sheet, the income statement and the notes.