Group Management Report

Risk management and internal control system

STRUCTURE OF THE RISK MANAGEMENT SYSTEM AND INTERNAL CONTROL SYSTEM AT VOLKSWAGEN

The organizational design of the Volkswagen Group’s RMS/ICS is based on the internationally recognized COSO framework for enterprise risk management (COSO: Committee of Sponsoring Organizations of the Treadway Commission). The purpose of structuring the RMS/ICS in accordance with the COSO framework for enterprise risk management is so that

potential risk areas are covered in full. Uniform Group principles are used as the basis for managing risks in a standardized manner. Opportunities are not recorded in the RMS/ICS processes.

Another key element of the RMS/ICS at Volkswagen is the Three Lines Model, a basic element required by, among other bodies, the European Confederation of Institutes of Internal Auditing (ECIIA). In line with this model, the Volkswagen Group’s RMS/ICS has three lines designed to protect the Company from significant risks occurring.

The minimum requirements for the RMS/ICS, including the Three Lines Model, are set out in guidelines for the entire Group.

Following completion of the implementation of the Risk Radar risk management IT system in 2020 and of the standardization of the ICS for business processes associated with risk at significant companies, the RMS/ICS will continue to be developed in future.

First line: Operational risk management

The first line comprises the operational risk management and internal control systems at the individual Group companies and business units. The RMS/ICS is an integral part of the Volkswagen Group’s structure and workflows. Events that may give rise to risk are identified and assessed locally in the divisions and at the investees. Countermeasures are introduced, the remaining potential impact is assessed, and the information incorporated into the planning in a timely manner. Material risks are reported to the relevant committees on an ad hoc basis. The results of the operational risk management process are incorporated into budget planning and financial control on an ongoing basis. The targets agreed in the budget planning rounds are continually reviewed in revolving planning updates. At the same time, the results of risk mitigation measures are promptly incorporated into the monthly forecasts regarding further business development. This means that the Board of Management also has access to an overall picture of the current risk situation via the documented reporting channels during the year.

Second line: Group-wide standardized quarterly risk identification and reporting

Each quarter, in addition to the ongoing operational risk management, the Group Risk Management department sends standardized surveys regarding the risk situation and the implementation of countermeasures to all Group brands, to significant Group companies and to Volkswagen Financial Services AG and Volkswagen Bank GmbH.

Acute risks for the Volkswagen Group are reported in this survey of the risk situation – the quarterly risk process (QRP). The responses are used to update the picture of the potential risk situation. The assessment of risks from the QRP is conducted in the Risk Radar IT system

The methodology for aggregating risks and assessing the Volkswagen Group’s risk-bearing capacity was developed further in 2021. The aggregated risk situation and risk-bearing capacity are compared at half-yearly intervals. There were no indications of insufficient risk-bearing capacity at the Volkswagen Group in the 2021 fiscal year.

A score is calculated for each risk by multiplying the likelihood of occurrence (Prob) by the potential extent of the damage. This enables comparison of the risks. The extent of the damage is calculated from the criteria of financial loss (Mat) and reputational damage (Rep) and the potential threat to adherence to external legal requirements (Req). A score between 0 and 10 is assigned to each of these criteria. The measures taken to manage and control risk are taken into account in the risk assessment (net perspective).

The score for a likelihood of occurrence of more than 50 % in the analysis period is classified as high; for a medium classification, the likelihood of occurrence is at least 25 %. For the criterion of financial loss, the score rises in line with the loss; the highest score of 10 is reached when the potential loss is upwards of €1 billion. The criterion of reputational damage can have characteristics ranging from local erosion of confidence and loss of trust at local level to loss of reputation at regional or international level. The potential threat to adherence to external legal requirements is classified based on the influence on the local company, the brand or the Group.

In addition to strategic, operational and reporting risks, risks arising from potential compliance violations (compliance risks) are also integrated into this process.

Risk reporting to the committees of Volkswagen AG depends on materiality thresholds. Acute risks from a risk score of 40 or potential financial loss of €1 billion or more are regularly presented to the Board of Management and the Audit Committee of the Supervisory Board of Volkswagen AG. In addition, the reporting includes all risks from the QRP with a risk score of 20.

In addition, significant changes to the risk situation that can arise in the short term, for instance from unexpected external events, are reported to the Board of Management as required. This is necessary if the risk may lead to potential financial loss of €1 billion or more and the likelihood of occurrence is estimated at greater than 50 %.

In recent years, a standardized ICS has been developed that goes significantly beyond the requirements for the ICS posed by financial reporting. In 22 catalogs of controls, the companies within its scope are presented with requirements in respect of the process risks and control objectives to be covered in order to protect the value chain in a standardized manner. In addition to financial reporting issues, for example, their content addresses process risks in development, production or compliance.

Key controls to cover process risks and control objectives are also tested for their effectiveness; any weaknesses identified are reported to the responsible bodies at Volkswagen AG and resolved in the departments. Like the quarterly risk process, the standardized ICS is fully supported by the Risk Radar IT system.

In terms of its content and organizational aspects, the standardized ICS thus offers broader protection than the regular governance, risk and compliance (GRC) process used in the past. With the introduction of the standardized ICS in further companies in 2021, the regular GRC process is being gradually shut down.

A separate Group Board of Management Committee for Risk Management examines the key aspects of the RMS/ICS every quarter. Its tasks are as follows:

to further increase transparency in relation to significant risks to the Group and their management,
to explain specific issues where these constitute a significant risk to the Group,
to make recommendations on the further development of the RMS/ICS,
to support the open approach to dealing with risks and promote an open risk culture.

Third line: Review by Group Internal Audit

Group Internal Audit helps the Board of Management to monitor the various divisions and corporate units within the Group. It regularly checks the risk early warning system and the structure and implementation of the RMS/ICS and compliance management system (CMS) as part of its independent audit procedures. The audit plan adopted by the Board of Management includes the first and second lines, i.e. the risk-mitigating functions in addition to the operational units.

RISK EARLY WARNING SYSTEM

The Company’s risk situation is ascertained, assessed and documented in accordance with the legal requirements. The requirements for a risk early warning system are met by means of the RMS/ICS elements described above (first and second line). Independently of this, the external auditors check both the processes and procedures implemented in this respect and the adequacy of the documentation on an annual basis. The plausibility and adequacy of the risk reports are examined via spot checks in detailed interviews with the divisions and companies concerned together with the external auditors. The auditor examines the risk early warning system integrated in the risk management system with respect to its fundamental suitability of being able to identify risks that might jeopardize the Company’s continued existence at an early stage and assesses the functionality of the risk early warning and monitoring systems in accordance with section 317(4) of the HGB.

In addition, scheduled examinations as part of the audit of the annual financial statements are conducted at companies in the Financial Services Division. As a credit institution, Volkswagen Bank GmbH, including its subsidiaries, is subject to supervision by the European Central Bank, while Volkswagen Leasing GmbH as a financial services institution and Volkswagen Versicherung AG as an insurance company are subject to supervision by the relevant division of the Bundesanstalt für Finanzdienstleistungsaufsicht (BaFin – the German Federal Financial Supervisory Authority). As part of the scheduled supervisory process and unscheduled audits, the competent supervisory authority assesses whether the requirements, strategies, processes and mechanisms ensure solid risk management and solid risk cover. Furthermore, the Prüfungsverband deutscher Banken (Auditing Association of German Banks) audits Volkswagen Bank GmbH from time to time.

Volkswagen Financial Services AG operates a risk early warning and management system. Its aim is to ensure that the locally applicable regulatory requirements are adhered to and at the same time to enable appropriate and effective risk management at Group level. Important components of it are regularly reviewed as part of the audit of the annual financial statements.

Monitoring the effectiveness of the risk management system and the internal control system

To ensure the effectiveness of the RMS/ICS, we regularly optimize it as part of our continuous monitoring and improvement processes. In the process, we give equal consideration to both internal and external requirements. External experts assist in the continuous enhancement of our RMS/ICS on a case-by-case basis. The results culminate in regular reporting to the Board of Management and Supervisory Board of Volkswagen AG.

THE RISK MANAGEMENT AND INTEGRATED INTERNAL CONTROL SYSTEM IN THE CONTEXT OF THE FINANCIAL REPORTING PROCESS

The accounting-related part of the RMS/ICS that is relevant for the financial statements of Volkswagen AG and the Volkswagen Group as well as its subsidiaries comprises measures intended to ensure that the information required for the preparation of the financial statements of Volkswagen AG, the consolidated financial statements and the combined management report of the Volkswagen Group and Volkswagen AG is complete, accurate and transmitted in a timely manner. These measures are designed to minimize the risk of material misstatement in the accounts and in external reporting.

Main features of the risk management and integrated internal control system in the context of the financial reporting process

The Volkswagen Group’s accounting is essentially organized along decentralized lines. For the most part, accounting duties are performed by the consolidated companies themselves or entrusted to the Group’s shared service centers. In principle, the financial statements of Volkswagen AG and its subsidiaries prepared in accordance with IFRSs and the Volkswagen IFRS Accounting Manual are transmitted to the Group in encrypted form. A standard market product is used for encryption.

The Volkswagen IFRS Accounting Manual, which has been prepared in line with external expert opinions in certain cases, is intended to ensure the application and assessment of uniform accounting policies based on the requirements applicable to the parent. In particular, it includes more detailed guidance on the application of legal requirements and industry-specific issues. Components of the reporting packages that are required to be prepared by the Group companies are also set out in detail there, and requirements have been established for the presentation and settlement of intragroup transactions and the balance reconciliation process that is based on these.

Control activities at Group level include analyzing and, if necessary, adjusting the data reported in the financial statements presented by the subsidiaries, taking into account the reports submitted by the auditors and the outcome of the meetings on the financial statements with representatives of the individual companies. These discussions address both the plausibility of the single-entity financial statements and specific significant issues at the subsidiaries. Alongside plausibility checks, other control mechanisms applied during the preparation of the single-entity and consolidated financial statements of Volkswagen AG include the clear delineation of areas of responsibility and the application of the “four eyes” principle.

The effectiveness of the internal control system in the context of the accounting process is systematically assessed in significant companies as part of the standardized ICS. This begins with a risk analysis and definition of controls with the aim of identifying significant risks for the financial reporting process. Regular tests based on samples are performed to evaluate the effectiveness of the controls. These form the basis for a self-evaluation of whether the controls are appropriately designed and effective.

The combined management report of the Volkswagen Group and Volkswagen AG is prepared – in accordance with the applicable requirements and regulations – centrally but with the involvement of and in consultation with the Group units and companies.

In addition, the accounting-related internal control system is independently reviewed by Group Internal Audit in Germany and abroad.

Integrated consolidation and planning system

The Volkswagen consolidation and corporate management system (VoKUs) enables the Volkswagen Group to consolidate and analyze both Financial Reporting’s backward-looking data and Controlling’s forward-looking data. VoKUs offers centralized master data management, uniform reporting, an authorization concept and the required flexibility with regard to changes to the legal environment, providing a technical platform that benefits Group Financial Reporting and Group Controlling in equal measure. To verify data consistency, VoKUs has a multi-level validation system that primarily checks content plausibility between the balance sheet, the income statement and the notes.