The DSM risk-management system is based on the COSO-ERM Framework. It aims to achieve maximum integration of the risk-management process in the normal business processes. It also provides for controls for those risks that commonly occur in the company. For a large part, these controls have been ’built into’ the standard business processes and tools have been developed to support their implementation and to monitor their effectiveness in operation. One of these tools is the system of letters of representation by top managers to report to the Managing Board the degree of compliance and effectiveness of risk management and internal controls. In this way, a high level of internal control can be achieved efficiently.

In 2007 the system was further enhanced and adapted to the Vision 2010 developments. Improvements include the introduction of better tools to check the occurrence of segregation-of-duty issues.

Other improvements include the introduction of better tools to check the occurrence of segregation-of-duty issues.

Practices and training programs were developed to support the operational units in embedding risk management in their daily operations while preventing this from becoming a bureaucratic ’tick the box’ affair. The practices focus on behavior and principles and connect with business process optimization actions. They were successfully piloted in a number of business groups and corporate training programs.

Much attention was given to the accessibility of the system, which is provided via the Corporate Risk Management intranet site. Part of the system is an improved Business Portal that can be used by business groups as a management-information system (including risk management).

A full description of the latest version of the DSM risk-management system can be found on the DSM Internet site.

For 2008, the focus will be on ’closing the risk control loop’, that is, on monitoring the effectiveness of the risk responses and controls as well as actions and system improvements to increase this effectiveness. These actions and system improvements will go hand in hand with business-process-optimization actions.