The risk management policy should document all relevant aspects regarding risk management within MAHLE Metal Leve S/A (MAHLE) to assure a common understanding for the MAHLE Management Board (executive officers), the risk committee, the risk management organization and all relevant managers and employees that are affected in respect to risk management.
The main contents are to describe, explain and document:
The policy is valid for MAHLE and for all companies that MAHLE holds the majority stake directly or indirectly. All employees of these companies and their boards must adhere to this manual and they must ensure its implementation. Furthermore it is applicable to foreign companies of MAHLE, provided that MAHLE holds a direct or indirect majority of voting rights. If a direct application of the regulation is not possible due to deviating country specific legal regulations, then adequate regulations must be specified and documented by the foreign company controlled by MAHLE.
The rules are adapted to MAHLE risk level in order to fulfill the CVM (Comissão de Valores Mobiliarios) requirements.
Within this policy risk is defined as any internal or external development that jeopardizes the achievement of the goals and objectives of the MAHLE. Risk can be of a strategic nature (“Are we doing the right things?”) as well as of an operative nature (“Are we doing things in the right way?”). More precisely, risk is the possible negative deviation of the planned/budgeted profit within the business planning process of the MAHLE.
Risk management is the process of systematically identifying and controlling threats that might impact the company’s goals. This process needs to be consistently applied across all sections of MAHLE (see scope chapter 1) and it should be cost effective and proportionate to the risks being managed.
The MAHLE risk strategy determines that risks should only be taken to increase the enterprise value but to avoid risks that would endanger the continuous existence of the company. To comply with this risk strategy, risk-related actions should be in line with the following risk policy principles for MAHLE itself including all the subsidiary companies (see scope, chapter 1) and all employees:
Chart 1: Comprehensive view of risks
MAHLE Metal Leve S/A (MAHLE) is listed on the Highest Corporate Governance Level named “Novo Mercado” at the B3 stock exchange in São Paulo.
Therefore the specific regulations of the Securities Commission of Brazil (CVM, currently CVM 552) are relevant for the company and its subsidiaries.
According to the aforementioned regulations MAHLE has to describe within the disclosure of the Reference Form to the commission the following main topics at least in annual basis:
As part of the existing organizational form, the following functions of risk management are responsible on the several levels of the group. In particular these are:
The board of directors of MAHLE is responsible to control the MAHLE management board regarding the implementation of an appropriate risk management system for MAHLE and consequently approve the risk management policy.
The management board is responsible for the lawful implementation and continuous functionality of the risk management system considering the efficiency and adequacy of the individual measures. Within this responsibility the board also has to define the corporate targets, the risk policy, the risk fields, the risk appetite and the general guidelines for risk management. According to COSO (Committee of Sponsoring Organizations of the Treadway Commission) risk appetite is the amount of risk, on a broad level, an organization is willing to accept in increasing the company value. Each organization has various objectives to add value and should broadly understand the risk it is willing to undertake in doing so.
Furthermore the board has the task to understand the most significant risks as well as to manage the organization in a crisis. The integration of the risk management system into the organization of the company has to be assured by the management board as well as to take measures for the advancement of the risk culture within MAHLE.
If topics arise which need to be decided immediately, ad-hoc meetings of management board take place. Risk management topics regarding changes in documentation, communication, responsibilities etc. are determined by the management board, following the main instructions from the Board of Directors. The management board is responsible for the monitoring of mitigating activities and taking the appropriate measures of counteractions.
The task of the risk manager is to develop the risk management system and keep it up to date. Besides that he/she is responsible for the documentation of the internal risk policies & structures and the coordination of the risk management activities. Preparing reports for the Management Board as well as compiling risk information is also duty of the risk manager. Furthermore the task includes for instance the
Within MAHLE the risk experts usually are the heads of Business Units, Profit Centers, group companies, functions etc., which have to assure the implementation and correct application of appropriate risk management systems to detect and control risks in their area. Furthermore, they have to report the risks within their area of responsibility according to the reporting requests within the risk management process and/or have to validate the reported risks of their risk coordinators and risk reporters.
Both the development of a risk-based internal audit program and the audit of risk processes across the organization are tasks of the Internal Audit. Besides that the department is responsible for the reporting on the efficiency and effectiveness of internal controls and risk management systems.
The external auditor is responsible for the examination of the adequacy and functionality of the risk management system as an external body during the audit of the annual financial statement.
Every single employee within MAHLE has to understand, accept and implement the relevant risk management processes defined within the present manual. Therefore the employees have to report proactively current or future possible inefficient, unnecessary or unworkable controls and loss events. To achieve the listed objectives a close cooperation between the management and the employees on incident investigations and other aspects is necessary. ¨ In addition, MAHLE must provide the necessary trainings and communications to the employees.
The next chapters comprise the main relevant steps of the risk management process at MAHLE:
The risks are identified based on risk assessment workshops organized by the Risk Manager involving the risk experts defined by the management board. Within the workshops the risk questionnaires are assessed and further risks can be added. It is recommended that the questionnaires be previously filled by the risk experts in order to increase the efficiency of the workshops.
Such risks are translated in monetary amounts and likelihood scales (see topic 6.2). To identify risks main following instructions must be regarded (same structure as the initial questionnaire):
In addition, individual employees must report at any time new risks or changes in the risk assessment to the respective risk experts who will evaluate and report to the Risk Manager in case the amounts reach the thresholds mentioned in the topic 6.4.
The criteria for risk assessment aim to combine both quantitative (financial impact) and qualitative (e.g. image) factors:
Figure 1: Criteria for risk assessment
The figure demonstrates that the impact and likelihood are the main drivers for calculating the risk value, which are influenced by risk factors: image, speed, detection, occurrence and mitigation. The criteria are described below.
The categories for the profit risk impact are:
| Range | BRL (Mio) |
|---|---|
| 1 | 2-4 |
| 2 | 5-20 |
| 3 | 21-40 |
| 4 | 41-100 |
| 5 | 101-200 |
| 6 | 201-400 |
| 7 | 401-1.000 |
| 8 | 1.001-1.600 |
| 9 | > 1.600 |
The criteria for likelihood of future events are:
| Range | % | Occurrence |
|---|---|---|
| 1 | 1%-2% | Less than once in 50 years |
| 2 | 3%-10% | Once in 10-50 years |
| 3 | 11%-30% | Once in 5-10 years |
| 4 | 31%-50% | Once in 3-5 years |
| 5 | 51%-70% | Once in 2-3 years |
| 6 | 71%-90% | Once in 1-2 years |
| 7 | > 90% | Once a year |
The profit risk impact will be multiplied by the likelihood and then the individual risk value for each risk per participant is calculated. The following factors are used to better support the profit risk impact and likelihood.
a) Image impact caused by risk materialization:
| Range | Description |
|---|---|
| 1 | Negligible |
| 2 | Low |
| 3 | Moderate |
| 4 | High |
| 5 | Critical |
b) Speed between event occurrence and possible impact:
| Range | Description |
|---|---|
| 1 | Outside the horizon |
| 2 | Long Term |
| 3 | Medium Term |
| 4 | Short Term |
| 5 | Immediate |
c) Detection is the control level to enable the identification of the risk occurrence (e.g. regular monitoring performed by head of the department to evaluate the past transactions).:
| Range | Description |
|---|---|
| 1 | Control very robust |
| 2 | Control with high effectiveness |
| 3 | Control with moderate effectiveness |
| 4 | Control with low effectiveness |
| 5 | Control ineffective or not existing |
d) Occurrence based on past events:
| Range | Description |
|---|---|
| 1 | Once in 20-50 years |
| 2 | Once in 10-20 years |
| 3 | Once in 5-10 years |
| 4 | Once in 2-5 years |
| 5 | Once a year |
e) Mitigation level of the controls in place to reduce or eliminate exposure and / or impact:
| Range | Description |
|---|---|
| 1 | Control very robust |
| 2 | Control with high effectiveness |
| 3 | Control with moderate effectiveness |
| 4 | Control with low effectiveness |
| 5 | Control ineffective or not existing |
The evaluation of the risk factors above should be reflected in the risk calculation of impact and likelihood e.g. a high score attributed to image risk should lead to a high profit risk impact. An eventual score model combining the risk factors and the respective impact and likelihood can be defined by MAHLE Management Board aiming at a more accurate risk assessment.
There must be countermeasures (mitigation controls) assigned by the risk experts following the thresholds in the attachment 2. The countermeasures (mitigation controls) must follow minimum attributes:
Based on all the risks reported and the respective countermeasures, the risk manager will review the consistency and set-up a consolidated risk versus mitigation control matrix. Such matrix will be the basis for the future risk assessment and can also be used either by risk expert to self-assess the risks or by Internal or External audits to perform the internal controls tests.
Depending on the area of responsibility of each participant the overall risk impacts, likelihoods and risk values per risk are consolidated. The risk manager will consolidate the risks according to the responsibility and avoid duplication.
The risks reported by the risk expert are reviewed by the Risk Manager and Management Board. Afterwards, the Risk Manager is in charge of consolidating the reported risks.
The single risk tolerance for a consolidated risk (e.g. due to the same risk can be report by different business units) from the total MAHLE perspective is fixed by the management board (refer to attachment 2). So no individual risk should exceed this value. In case there would be a higher risk immediate actions have to be started to reduce the risk value. More details are described under chapter 6.4 regarding the reporting and control of risks.
The maximum risk exposure is determined by management board (refer to attachment 2). In case the maximum risk exposure is exceeded the risk manager has to inform the management board about this situation. Provisions and insurance coverage here has to be deducted to calculate the risk exposure (for the identification of individual risks this is not allowed to assure that all problem fields are regarded within the risk management process, see chapter 6.1). Furthermore, the risk exposure is shown in the regular risk report described in chapter 6.4. Once a year the management board reviews the maximum risk exposure and adjusts it in case of new perceptions.
The consolidated risks are summarized in risk report on a regular basis. Depending on the risk level, risks are reported in the management board risk report. Further risks are part of a report which has to be under the focus by the risk management organization. For the top risks (refer to attachment 2) the general control systems has to be documented and measure plans with clear responsibilities has to be defined and followed up by the risk management organization.
The main determinations by the management board regarding the content of the risk reports and the reporting cycle are:
The Risk expert is in charge of self-assessing if the countermeasure (mitigation control) has been applied in accordance with the mitigation control design. In case of any countermeasure weakness, the risk expert must inform the supervisor and the risk manager.
The next picture demonstrates an overview of the risk management process:
Figure 2: Overview of Risk Management process
This policy is disclosed to all the employees through the Intranet (webpage: Brasil Finanças e Controladoria / Gestão de Riscos).
In addition, the policy is communicated to the executives (EL) and managers (ML1) through training sessions/workshops who must accept and be committed to comply with the requirements.
