The Board’s policy is to have systems in place which optimise the Group’s ability to manage risk in an effective and appropriate manner. The Board has delegated to the Executive Committee responsibility for identifying, evaluating and monitoring the risks facing the Group and for deciding how these are to be managed. In addition to a formal quarterly review of risk management by the Executive Committee, members are expected to report to the Committee as necessary the occurrence of any material control issues, serious accidents or events that have had a major commercial impact, or any significant new risks which have been identified. Such matters are reported to the next Board meeting and/or Audit Committee meeting as appropriate. As part of its remit, the Governance and Risk Sub-Committee develops strategy for and provides oversight and direction on all matters relating to risk management. It reports formally on an annual basis to the Executive Committee and to the Board.

Continuing processes under the oversight of the Executive Committee and its Governance and Risk Sub-Committee are in place for all parts of the Group to assess the major risks to which their operations are exposed and the way in which such risks are monitored, managed and controlled. The risks covered by these processes include those relating to strategy, operational performance, credit risk and the financial viability of customers and suppliers, finance (including risk financing and fraud), product engineering, business reputation, human resources, health and safety, and the environment. These processes are summarised in a ‘risk map’ which is reviewed annually by the Audit Committee. A summary of those risks which could have a material impact on the future performance of the Group is given on pages 37 to 39 of the 2008 Annual Report.

Each year all Group businesses are required formally to review their business risks and to report on whether there has been any material breakdown in their internal controls. This formal review is supplemented by an interim review conducted at the half year. Companies also have to confirm annually whether they have complied with statutory and regulatory obligations as well as with the policies which support the GKN Code.

As part of GKN's enterprise risk management programme, risk profiling is undertaken across all subsidiaries to identify business, reputational and accidental risks and highlight action required to mitigate such risks.

This process is aided by the use of a risk profiling software tool which provides a consistent set of risk definitions, a common approach to probability and impact, and strengthens the ability to consolidate measurement of risk.

The objective of the Group’s risk management processes is to ensure the sustainable development of GKN through the conduct of its business in a way which:

• satisfies its customers;
• develops environmentally friendly products and processes;
• provides a safe and healthy workplace;
• protects against losses from unforeseen causes;
• minimises the cost and consumption of increasingly scarce resources;
• prevents pollution and waste;
• maintains proper relationships with our suppliers and contractors; and
• maintains a positive relationship with the communities in which we do business.

The Group’s systems and procedures are designed to identify, manage and, where practicable, reduce and mitigate the effects of the risk of failure to achieve business objectives. They are not designed to eliminate such risk, recognising that any system can only provide reasonable and not absolute assurance against material misstatement or loss.

The review process
The Board reviews the Group’s systems of internal control and risk management on an ongoing basis by:

• setting the strategy of the business at both Group and divisional level and, within the framework of this, approving an annual budget and medium term projections. Central to this exercise is a review of the risks and opportunities facing each business and the steps being taken to manage these;
• reviewing on a regular basis operational performance and updated forecasts for the current year. Comparisons are made with budget and the prior year and appropriate action plans put in place to optimise operational and financial performance;
• retaining primary responsibility for acquisition and divestment policy, and the approval of major capital expenditure, major contracts and financing arrangements. Below Board level there are clearly defined management authorities for the approval of capital expenditure, major contracts, acquisitions, investments and divestments, together with an established framework for their appraisal, which includes a risk analysis and post-implementation plan, and where appropriate, a post-acquisition review;
• receiving regular reports on the Group’s treasury activities, having approved the operating policies and controls for this function, and keeping under review the Group’s pension fund arrangements;
• performing at least annually a review of the Group's insurance and risk management programmes;
• receiving an annual report, following its review by the Executive Committee, on corporate social responsibility matters, which includes the environmental, health and safety performance of the Group’s operations; and
• reviewing an annual management development and succession plan. The Executive Committee also reviews management development issues at least annually.

The Board receives an annual report from the Audit Committee concerning the operation of the systems of internal control and risk management. This report, together with the reviews by the Board during the year of the matters described above, enables the Board to form its own view on the effectiveness of the systems.

The Audit Committee is responsible for reviewing the ongoing control processes, and the actions undertaken by the Committee during 2008 to discharge this responsibility are described in the Audit Committee’s report on page 59 and 60 of the 2008 Annual Report. To assist it in this role the Committee liaises closely with the internal audit department which, using a risk-based audit programme, reviews and tests the systems, controls, processes, procedures and practices across the Group. The Head of Internal Audit, who reports directly to the Finance Director, meets regularly with the Chairman of the Audit Committee, the Group Chairman and the Chief Executive. The department’s reports are seen by the relevant members of the Executive Committee and are summarised quarterly for the Audit Committee. The resolution of any control issues raised by Board members or in reports reviewed by the Audit Committee is discussed in Committee with management.

The Board has reviewed the effectiveness of the Group’s systems of internal control and risk management during the period covered by this annual report. It confirms that the processes described above, which accord with the guidance on internal control appended to the Code (the revised Turnbull Guidance), have been in place throughout that period and up to the date of approval of the annual report. The Board also confirms that no significant failings or weaknesses were identified in relation to the review.