Therefore, the Group introduced a systematic risk management process in 2005. Leveraging the experience gained during the first years of systematically monitoring risks, Nobel Biocare has established comprehensive Enterprise Risk Management (ERM), which was further reshaped throughout 2011.
The risk map contains 14 key risks with more than 80 different scenarios, which were identified by analyzing the value chain, the business environment and the product life cycle, and assessed in terms of likelihood and free cash flow at risk. Furthermore the current risk controls were qualified. Risk mitigation goals and strategies, as well as operational action plans, are defined and have been put in place for all risks. Key performance and key risk indicators are also defined in order to underpin the risk assessment and the quality of related controls.
The Executive Committee (EC) as well as the Board of Directors (BoD) has periodically reviewed the key risks, which were presented by the respective risk owner.
The risk owner is accountable for a drill-down of the risk management activities on a more operational level. This includes, for example, initiation or management of action plans, definition of operational risk standards, collection of data (indicators), management or monitoring of controls and tracking of incidents.
In addition to this Group-wide approach, various operational risk management initiatives were strengthened or newly implemented during the year.
Also during 2011, the Internal Controls System (ICS) was further enhanced and training occurred across the Group. The applied methodology provides high quality controls and reduces financial reporting, fraud, and compliance risks.
In addition, Nobel Biocare has undertaken to further integrate and strengthen its overall governance, risk and compliance (GRC) activities, also by focusing Internal Audit’s activities on this topic. The Audit Committee gets a periodic update on the Group compliance roadmap.
The Head of Internal Audit, Compliance and Risk Management co-ordinates all ERM and ICS activities. In this role, he reports directly to the CEO and to the Audit Committee.
At least once a year the risk map data are reported to the Executive Committee and the Board of Directors.
The risk categories are defined as follows:
