Fraser & Neave Holdings Bhd Annual Report 2020

126 FRASER & NEAVE HOLDINGS BHD Business impact analysis; Development of BCM strategies and plans; Business recovery procedures; Business continuity testing and exercise; and Monitoring and evaluation of the overall effectiveness of BCM. HUMAN CAPITAL Talent plays a pivotal role in achieving the business objectives of the Group. Hence, a process has been put in place to assess talent for career development and succession planning. Roles and responsibilities are clearly defined in the job description for each position. In addition, continuous improvement approach is implemented in the areas of operational efficiencies as well as manpower productivity. To ensure the performance evaluation process is carried out in a systematic manner, a performance management system which provides rating criteria for the assessment of employees’ performance based on agreed Key Result Areas and competencies defined is deployed. INFORMATION AND COMMUNICATIONS SYSTEMS The Group operates on an enterprise resource planning system which integrates various facets of the Group’s operations. The system provides management with data, analysis, variations, exceptions and other input relevant to the Group’s performance. Employees within the Group are guided by the Information Technology (IT) policies and procedures such as IT Security Policy, Access Management, Cyber Security Framework and End User Policy. As part of the measures to raise awareness, cyber security and ransomeware awareness mandatory training are conducted to all employees through online learning platform. BUSINESS CONTINUITY MANAGEMENT The Board is cognizant of the importance of business continuity management (“BCM”) in strengthening the Group’s resilience in response to the evolving business environment and enhancement of shareholders’ values. F&NHB has in place the following components within the BCM Framework to enable the Group’s operations to be prepared in the event of emergencies: The Group’s pandemic preparedness was further strengthened, as seen from the cohesive responses and teamwork amidst reduced workforce, work-from- home arrangement as well as collaboration and coordination with our external stakeholders such as our customers and suppliers impacted by the pandemic outbreak. The Framework and the BCM plans developed are reviewed on an annual basis and tested periodically to ensure that it is up-to-date and relevant to the business environment. In addition, annual testing on Disaster Recovery which involves IT, vendors and respective department are conducted to ensure systems are able to recover in an organised, efficient and effective manner. AUDIT COMMITTEE AND GROUP INTERNAL AUDIT Group Internal Audit performs periodic audits of subsidiaries within the Group in accordance with an annual internal audit plan, which is formulated through a comprehensive risk-based methodology and approved by the Audit Committee. The audits are designed to test the appropriateness of control design and implementation as well as compliance with the existing policies and procedures. Based on the audits performed, areas of improvement on control design and implementation are highlighted, on a quarterly basis, to the Audit Committee and Management to implement internal audit recommendations. Status of implementation of agreed audit recommendations is tracked until completion and quarterly updates are provided to the Audit Committee and Management. Further details on the activities of the Audit Committee and Group Internal Audit are set out in the Audit Committee Report. BOARD COMMENTARY AND OPINION The Board, through the SRMC and Audit Committee, has undertaken review of the adequacy and effectiveness of risk management and internal control system in accordance with the Terms of Reference during the year under review. The Board is of the view that the Group’s overall risk management and internal control system is sound and adequate in all material aspects, and has received the same assurance from both the CEO and CFO of the Group. The Board ensures that the risk management process in identifying, evaluating and managing significant risks is operating adequately and effectively throughout the financial year up to the date of approval of this Statement. It is in the Board’s opinion that the Group’s system of internal control during the year under review is adequate and effective to safeguard the Group’s assets and the interests of shareholders and stakeholders. REVIEW OF THE STATEMENT BY EXTERNAL AUDITORS The external auditors have reviewed this Statement on Risk Management and Internal Control pursuant to the scope set out in the Audit and Assurance Practice Guide (“AAPG”) 3, Guidance for Auditors on Engagements to Report on the Statement on Risk Management and Internal Control included in the Annual Report issued by the Malaysian Institute of Accountant for inclusion in the Annual Report of the Group for the year ended 30 September 2020, and reported to the Board that nothing has come to their attention that cause them to believe that the Statement intended to be included in the Annual Report of the Group, in all material respects: (a) has not been prepared in accordance with the disclosures required by paragraphs 41 and 42 of the Statement on Risk Management and Internal Control: Guidelines for Directors of Listed Issuers, or (b) is factually inaccurate. AAPG 3 does not require the external auditors to consider whether the Directors’ Statement on Risk Management and Internal Control covers all risks and controls, or to form an opinion on the adequacy and effectiveness of the Group’s risk management and internal control system including the assessment and opinion by the Board and Management thereon. The external auditors are also not required to consider whether the processes described to deal with material internal controls aspects of any significant problems disclosed in the Annual Report will, in fact, remedy the problems. This Statement is made in accordance with the resolution of the Board dated 3 November 2020. Statement on Risk Management and Internal Control (Cont’d.)