Risk Management

Risk Committee

The Board has ultimate responsibility for ensuring that the Group has an effective framework in place for managing its risks. The Risk Committee structure supports the Board in fulfilling these responsibilities.

The Group's Risk Committee meets three to four times a year and in 2008 was attended by head office senior and executive management, as well as senior representatives from both Aegis Media and Synovate.

The Committee provides a forum for the discussion of key risks faced by the Group, the development of risk assessment techniques and the consideration and approval of risk management action plans.

Recognising that responsibility for the management of operational risks lies with the divisions, we have introduced two additional Risk Committee bodies, one for Aegis Media and one for Synovate. Each has a varied range of senior representatives (from different markets, disciplines and business streams). The principal duties of these two Risk Committees are to ensure that risks within their divisions are being identified and appropriately managed and to approve minimum standards and procedures to enhance the control environment. The head of Group internal audit attends all meetings to ensure a cohesive approach and shared learnings of risks amongst the three Committees. The risks identified, and the control mechanisms applicable to each risk and how well they are being managed, are maintained in a risk register.

The members of the Risk Committee review the Group's key risks on an ongoing basis and receive input from internal audit reports and the risk-self assessment process on how well these are being managed. A summary of the Group's principal risks and uncertainties is included in the financial review in the Annual Report and Accounts 2008.

Internal audit reports

The Group's internal audit function is charged with assessing whether controls expected to mitigate risks are being implemented and operating effectively. Where any common gaps are identified across a number of business units, a solution is agreed through discussion at the Risk Committee meetings and a risk champion is assigned to improve the required controls, as appropriate. Given that the Group operates in a fast-moving environment with frequent new offerings to clients, particularly via acquisitions, we accept that risks are constantly evolving and additional controls are required as a result. To try and identify these risks as quickly as possible, the internal audit functions' remit is to visit newly acquired subsidiary companies within 12 months of their joining the Group.

Risk self-assessments

Aegis Media and Synovate operate under different business models, so the risk self-assessment questionnaires are tailored for each of our divisions. Each year, the risks to be included are reviewed to make sure they are up-to-date and relevant to each business and that they will help management to assess how well their operations are run. The committees will provide input into the risks to be included in their separate risk self-assessment surveys and will assign risk champions as required for any risks not being appropriately managed.