Description of the Key Features of the Internal Control and Risk Management System
In relation to the Group Accounting Process (Section 289, Subsection 5, and Section 315, Subsection 2, No. 5, of the German Commercial Code [HGB])
Definitions and Elements of the Internal Control and Risk Management System at the Sartorius Group
The internal control system of Sartorius AG and the Sartorius Group encompasses all of the principles, procedures and measures adopted to ensure the organizational implementation of management decisions. The main priority of the system as it relates to Sartorius AG’s and the Group’s accounting process is to make sure that accounting is effective, cost-efficient and formally correct and that it complies with the pertinent legal provisions.
The internal control system of the Sartorius AG and the Sartorius Group consists of a combination of process-integrated and non-process-integrated monitoring measures. The process-integrated safeguarding measures are subdivided, in turn, into organizational measures, such as the "four eyes principle" for double verification and access restrictions in relation to IT, and control measures, such as manual target | actual checks and programmed plausibility checks in the software used. The Supervisory Board, in this case specifically the Audit Committee of Sartorius AG, and the Internal Control Systems & Compliance unit with its Group Auditing department are involved in the Sartorius Group’s internal control system through their non-process-integrated audit activities.
The independent Group auditors and other auditing authorities also play a role in the control environment of the Sartorius Group through their non-process-integrated audit activities. In particular, the review of the consolidated financial statements by the independent Group auditors and the audit of the individual financial statements of the Sartorius Group companies included in the consolidated financial statements constitute the key non-process-integrated monitoring measures in relation to the Group accounting process.
The Finance unit represents another important element of the internal control system through its analysis of the monthly reports from the subsidiaries.
The risk management system concentrates in the context of Group accounting primarily on the risk of misstatements in the Group’s bookkeeping and in external reporting. It includes both operational risk management, which involves activities such as the transfer of risk to insurance companies through coverage for damage and liability risks and the arrangement of suitable hedges to limit currency and interest rate risks, and the monitoring system operated by the Sartorius Group for early group-wide detection of risks with the potential to jeopardize the company’s continued existence as defined in Section 91, Subsection 2, of the German Stock Corporation Law (AktG). The efficacy of the early risk detection system, which the Sartorius Group adapts promptly in response to any relevant changes in circumstances, is assessed by the independent Group auditors in accordance with Section 317, Subsection 4, of the German Commercial Code (HGB). Regular system reviews are also carried out to verify that the system remains functional and effective.
Use of IT Systems
Most transactions of relevance for accounting are recorded in the individual financial statements of the subsidiaries of Sartorius AG using software systems that are used worldwide. For the process of preparing the consolidated financial statements of Sartorius AG, Group companies add supplementary information to their individual financial statements to create standardized reporting packages, which are then submitted by all Group companies to the consolidated reporting system. Sartorius AG’s consolidated financial statements are then prepared using the consolidation routines in the consolidated reporting system, most of which have been developed by Sartorius AG itself and are supplemented by manual adaptation. Both in-house auditors and the independent Group auditors of Sartorius AG regularly verify that the reporting packages submitted to the consolidated reporting system concur with the individual companies’ financial statements on which the audit is based in each case. All of the consolidation procedures necessary to prepare the consolidated financial statements of Sartorius AG, such as the consolidation of investments, the elimination of intercompany payables and receivables and the elimination of intercompany revenue and expense, are performed using, and documented in, the consolidated reporting system. All components of Sartorius AG’s consolidated financial statements, including the details presented in the notes, are developed using the consolidated reporting system, which also provides a wide range of analysis options.
Key Supervision and Control Activities to Ensure Proper and Reliable Group Accounting
The internal control system measures designed to maintain proper and reliable Group accounting ensure that transactions are recorded in full and in a timely manner in accordance with the applicable provisions of the law and the articles of association. In addition, these measures ensure that inventories are taken properly and that assets and liabilities are recognized, assessed and reported appropriately in the consolidated financial statements.
The employees involved in the accounting process meet qualitative standards and receive regular training. Duties and responsibilities are clearly assigned to different specialized units, companies and regional units. This segregation of duties and the four-eyes principle – i.e., review by two individuals – are strictly implemented. Complex evaluations, such as actuarial reports and company valuations or purchase price allocations are assigned to specialized service providers who involve specially qualified in-house staff.
Examples of the control activities performed to ensure proper and reliable accounting include the analysis of situations and developments with reference to specific key indicators. The separation of administrative, executive, settlement and approval functions reduces the possibility of fraud. The organizational measures are also intended to record company- or Group-wide restructuring steps or changes in the nature of the operations of individual business areas promptly and accurately in Group accounting. Finally, the internal control system also ensures that changes in the Sartorius Group’s economic or legal environment are mapped and that new or amended legal provisions are applied in Group accounting.
The Sartorius Group accounting principles govern the standard recognition and measurement principles for the German and non-German companies included in the Sartorius consolidated financial statements. In addition to the general recognition principles and methods, the rules applied to the statement of financial position, statement of profit or loss, notes, Group management report, statement of cash flows and to the segment reports have been established in compliance with EU legislation and are primarily those of the IFRS and German commercial law.
The Sartorius Group accounting rules also govern specific formal requirements placed on consolidated financial statements. These include the mandatory use of a standardized and complete reporting package. The Group Accounting department assists the local units in resolving complex accounting issues, such as measuring fair value, to ensure consistent and accurate reporting in the consolidated financial statements.
The scope of regulation at Group level also extends to the central definition of measurement rules and parameters, among other factors. Additional data for the presentation of external information in the notes and Group management report is also prepared and aggregated at Group level.
The specific control activities performed to ensure proper and reliable Group accounting encompass the analysis and, where applicable, correction of the individual financial statements submitted by the Sartorius Group companies, in line with the reports authored by the independent auditors. Reporting packages containing errors are identified and, corrected at Group level on the basis of a large number of control mechanisms already incorporated into the consolidated reporting system. Impairment tests are conducted centrally for the specific cash-generating units, known as CGUs, from the Group's perspective to ensure that consistent, standardized evaluation criteria are applied.
A manual on the company's internal control system that focuses on the company's business processes further contributes toward strengthening the internal control (ICS) system. Based on the current rules, this manual has combined all ICS-relevant requirements on the business processes we define into one standardized document for the first time and is supplemented by further appropriate rules as necessary.
The internal control and risk management system enables the complete recording, processing and evaluation of company-related matters, on the basis of the organizational, control and monitoring structures defined in the Sartorius Group, as well as their accurate presentation in Group accounting.
In particular, decisions based personal judgment, erroneous controls, criminal acts and other circumstances that can impair the efficacy and reliability of the internal control and risk management system in place cannot be ruled out, however, so even the application throughout the Group of the systems adopted cannot provide an absolute assurance as to the accurate, complete and timely recording of matters in Group accounting.
The statements made relate solely to the subsidiaries included in the consolidated financial statements of Sartorius AG, whose financial and business policies Sartorius AG can directly or indirectly determine in order to obtain benefits from their activities.