Corporate Governance

Internal control and risk management

The internal control and risk management system developed by TenneT is based on the following assumptions:

• risk management has an independent position within TenneT;    
• TenneT takes an integrated approach to risk management;    
• risks and management measures are related to TenneT's company values;    
• the system is aimed at managing risks that have an effect on the achievement of company objectives.

TenneT's internal control and risk management system is based on COSO II and was fully implemented in 2008. COSO II is an international risk management model used by numerous organisations all over the world.

Strategic, operational and project risks

Risk analysis at TenneT is carried out on a strategic and operational level. An organisation-wide analysis of operational risks was performed in 2008. The strategic risks were also reviewed at the Board of Management level. Strategically important projects like TenneXT, Randstad 380 kV and BritNed are subject to specific risk analysis on a quarterly basis.

A large number of risk management measures was put in place in 2008. Once every three months, the responsible managers report to the Board of Management on any risks that have been identified and how they are being controlled.

Audits

Audits, both internal and external (e.g. by the Office of Energy Regulation or the Netherlands Court of Audit), form an integral part of TenneT's risk management system. Internal audits provide an insight into the way in which and the extent to which the risks are managed. These audits are the final step in the management system and help management gain insight into the operation of the internal control system during a particular period. The Internal Audit department reports the results of the audits to the client and the Board of Management. Reports on the audits performed in the year in question are also submitted to the Supervisory Board once a year. Responsible staff members at department level are charged with ensuring that the findings from internal and external audits are addressed. Progress reports on the implementation of the recommendations in the audits are provided in the quarterly reports.

A three-yearly risk-based audit plan was also produced in 2008, and will be implemented over the next few years. Some of the processes that form part of the internal audits are also certified by the external auditors (PricewaterhouseCoopers), resulting in an assurance report on the internal management of the process concerned.