
18 Annual Report 2023 Aalborg Portland A/S
MANAGEMENT’S REVIEW FINANCIAL STATEMENTS SIGNATURES COMPANY INFORMATION
Risks and uncertainties
INTERNAL CONTROL AND RISK MANAGEMENT SYSTEM
Aalborg Portland is integrated with the Cementir Group’s Internal Control
and Risk Management System, defined as the set of tools, organisational
structure, procedures and company rules to guarantee, through an adequate
process of identification, measurement, management and monitoring of the
main risks, correct and consistent business management with objectives
set in terms of:
• compliance with laws and regulations;
• safeguarding of corporate assets;
• operating activity effectiveness and efficiency;
• reporting accuracy and completeness.
The Internal Control and Risk Management System adopts a ”top-down”
and ”risk-based” approach that starts from the definition of the Cementir
Group’s Industrial Plan. It ensures that the main risks are identified, asses-
sed and monitored taking into account each business unit, to create a fully
integrated risk management process. Risks are assessed with quantitative
and qualitative tools considering both the probability of occurrence and the
impacts that would be generated in a given time horizon if the risk were
to occur. It also ensures that all necessary measures are taken to control
risks that could threaten the Group’s assets, its ability to generate profits or
achieve its objectives.
Roles and responsibilities in risk management have been defined starting
from the Company’s Board of Directors, which defines strategy, policy and
risk appetite, supported by the Audit Committee and the Sustainability
Committee. In addition, management teams from the Group companies
are involved, with responsibility for risk management within their area of
expertise.
Below is a summary of the people and bodies involved and their
responsibilities:
• The Board of Directors plays the central role, defining the Company’s
risk appetite, the nature and level of risk. In addition, it carries out an
assessment of the risks related to climate change ensuring the constant
compatibility of management and strategic objectives.
• The Cementir Group’s Audit Committee and the Sustainability Committee
(corporate bodies relevant in the risk definition process) support the
Board of Directors, subject to a favourable opinion, in the definition and
management of risks;
• CEO & Chairman: implements the general guidelines of the Board of
Directors, ensuring the identification, management and monitoring of the
main risks;
• Risk owners, or the first level of control, are primarily responsible for
internal control and risk management activities;
• Finally, Risk Management and Internal Audit are the main responsible for
the internal control and risk management system (second and third level
of control). They are responsible for verifying that the Internal Control
and Risk Management System is functioning and adequate with respect
to the size and operations of the Group, verifying, in particular, that the
Management has identified the main risks, that they have been evaluated
in a consistent manner and that the appropriate mitigation actions have
been defined and implemented.
The Cementir Group’s Internal Control and Risk Management System is
integrated into the Group’s organisational, administrative, accounting and
governance structure and has been prepared on the basis of the principles
laid down by the Enterprise Risk Management - Integrated Framework, an
international standard developed by the Committee of Sponsoring Organi-
zations of the Treadway Commission (COSO Report), also ensuring greater
detail in the identification of the risks of the companies and Group and
integration with the results of the Audit activities. The methodology followed
involves an iterative process consisting of the following steps:
• Risk identification: the process starts with the definition of the Industrial
Plan and focuses on the main risks that could compromise the achieve-
ment of the Group’s objectives;
• Risk assessment: for each identified risk, management gives an inherent
risk assessment (in the absence of controls/mitigation actions), in terms
of probability and impact during the horizon of the Industrial Plan, using a
5-level assessment system (scoring):
› Impact: scale from 1 (Negligible) to 5 (Extreme);
› Probability: scale from 1 (Rare) to 5 (More than Likely)
• With regard to impact, three parameters are considered: economic (quan-
titative), operational (qualitative), reputational (qualitative). Management
at Region and Group level assesses the potential impacts and likelihood
of major risks that could have a material adverse effect on the company’s
current or future operations. For sustainability and climate-related risks,
the time horizon was extended to a long-term view for the analysis of the
various threats that could jeopardise the success of the “10-year Roadmap
to Sustainability”. For more details, see the 2023 Non-Financial Statement;
• Identification and assessment of the adequacy of the existing principals:
for each identified risk, all the controls/actions currently in place for risk
mitigation are identified with the management;
• Residual Risk Assessment: taking into account the individual controls
for each risk and the relative adequacy, the residual risk is calculated by
applying a uniform calculation methodology to all Group companies;
• Identification of further actions: in the event that the residual risk is
higher than the predefined level of risk appetite, further actions are
agreed with management to mitigate the risk and contain it within
acceptable levels. The initiatives are taken promptly and within budget
limits, to effectively contribute to risk mitigation;
• Risk mitigation: mitigation strategies are defined with specific action
plans for key risks;
• Reporting: reports are prepared at the company and Group level, showing
the main risks and initiatives taken by management to reduce the risks to
acceptable levels;
• Monitoring: the following are reviewed periodically: existing risk as-
sessments, assessment parameters, and new risks can be identified if
necessary.
The model, as described, subject to further and future updates, aims to
provide support for the decision-making and operational processes of the
company management, so as to reduce the possibility that specific events
could compromise the Group’s ordinary operations or the achievement of its
strategic objectives.
To this end, the risk appetite level adopted in relation to strategic risks is
consistent with the vision of creating value, while always respecting the
environment and promoting integration with local communities. In relation