and special items, and the sales and pur- chase process. Carlsberg’s financial control framework reporting covers relevant Group companies and functions to the level where high-risk accounts are covered at least 80% and medium-risk accounts at least 60%. Low-risk accounts are not covered. 

## Control activities 

The Group has implemented a formalised financial reporting process for the strategy process, budget process, quarterly estimates and monthly reporting on actual performance. The accounting information reported by all Group companies is reviewed both by con- trollers with regional or functional in-depth knowledge of the individual companies/ functions and by technical accounting special- ists. In addition, significant Group companies have controllers with extensive commercial and/or accounting knowledge and insight. 

Based on the risk assessment, the Group has established minimum requirements for the conducting and documentation of IT and manual control activities to mitigate identi- fied significant financial reporting risks. Carls- berg’s financial control framework covers 132 controls relating to 23 accounting processes and areas. 

The relevant Group companies and functions must ensure that Carlsberg’s financial control framework is implemented in their business and that individual controls are designed to cover the predefined specific risk. The local management is responsible for ensuring that the internal control activities are performed and documented, and is required to report the compliance quarterly to the Group’s finance organisation. 

The entities in the Group are dependent on IT systems. Any weaknesses in the system controls or IT environment are compensated for by manual controls in order to mitigate any significant risk relating to the financial reporting. This includes the implementation of compensating controls during the imple- mentation of the supply chain integration and business standardisation project given that an increased number of people will have access to systems. Sweden was the first country to implement the project in the spring of 2013. 

## Information and communication 

The Group has established information and communication systems to ensure that ac- counting and internal control compliance are established, including a Finance Manual, a Controller Manual and internal control requirements. 

Besides this, the Group has implemented a formalised reporting process for reporting monthly, quarterly, budget and estimate figures from all countries and functions. 

## Monitoring 

The Audit Committee’s monitoring covers both the internal control environment and business risk. The monitoring of the internal control environment is covered by Carlsberg’s financial control framework. The business risk is assessed and reviewed at multiple levels in the Group, such as periodic review of control documentation, controller visits and audits performed by Group Internal Audit. 

Additionally, business risks are discussed and monitored at business review meetings between the Executive Committee, regional management and local management at which potential financial impacts are identified. 

The Audit Committee’s Terms of Reference outline its roles and responsibilities concerning supervision and monitoring of the internal con- trol and risk management systems related to financial reporting. The monitoring is performed on the basis of periodic reporting from the fi- nance organisation, internal and external audit. 

## GROUP INTERNAL AUDIT 

The Internal Audit department ensures objective and independent assessment of the adequacy, effectiveness and quality of the Group’s internal controls. The head of Group Internal Audit reports to the Chairman of the Audit Committee. The Audit Committee must approve the appointment and potential dismissal of the head of Group Internal Audit as well as changes to his or her terms. Group Internal Audit works in accordance with a charter and Terms of Reference approved by the Audit Committee. 

Group Internal Audit conducts an annual review of business risks. On the basis of this and input from the Supervisory Board, the Audit Committee and senior executives in the Group, an audit plan is drawn up for the year. The plan is reviewed and approved by the Audit Committee and the Supervisory Board. Group Internal Audit is responsible for planning, executing and reporting on the audit performed. The reporting includes observations and conclusions, together with suggestions for improvements to the internal controls in each area audited. 

When conducting an audit, Group Internal Audit assesses whether the audited entity/ function has well-established accounting practices, written policies and procedures in all important business areas, and adequate internal control procedures. This includes the 

assessment of whether controls in relation to key IT systems are satisfactory and whether they comply with the IT Policy. 

The Carlsberg Group has a whistleblower system that enables employees to report activities that may involve criminal conduct or violations of the Carlsberg Group’s policies and guidelines. 

The whistleblower system consists of a web- site and a hotline set up by an independent third party to ensure the highest level of secu- rity and confidentiality. Reports filed through the whistleblower system are handled by a few specific employees within Group Internal Audit who are charged with the responsibility of evaluating any potential violation. Group Internal Audit regularly, and at least every quarter, reports to the Audit Committee on issues reported via the whistleblower system and action taken as a result thereof. In 2013, 26 reports were made to the system. 

Since the establishment of the whistle- blower system in April 2010, some reports and their subsequent investigation have led to various disciplinary sanctions for one or more employees, including dismissals on the basis of violation of Group policies and, in some cases, relevant criminal laws. 

Most of these matters related to isolated incidents of fraud carried out by individual employees in the Group. The incidents have not had any material impact on the financial results of the Group or the Group company in question. 

