EVRAZ

CONTROLS

Consistent with its governance policies, the Group continues to improve the process through which the effectiveness of its internal control system can be regularly reviewed as required by provision C.2.1 of the UK Corporate Governance Code (former Combined Code). The process enables the Board of Directors and the Audit Committee to assess the system of internal controls in place within the Group to manage significant business, operational and financial risks (including social, environmental, safety and ethical risks) throughout the year.

This process has the normal limitations, in that any internal control system can only be directed at the management of risk rather than the elimination of risk. An effective internal control system can only provide reasonable and not absolute assurance against material misstatement or loss.

For more information on Internal Control process in 2010 please kindly refer to the Annual Report 2010 of the Group

INTERNAL AUDIT

Internal Audit is an independent appraisal function established by the Board of Directors to evaluate the adequacy and effectiveness of controls, systems and procedures, within EVRAZ Group, in order to reduce business risks to an acceptable level in a cost effective manner.

The present version of Internal Audit Charter was approved by the Board of Directors on April 27, 2011.

The mission of internal audit at EVRAZ Group is to provide an independent, objective, innovative, responsive and effective value-added internal audit service through a systematic and disciplined approach by assisting management in controlling risks, monitoring compliance, improving the efficiency and effectiveness of internal control systems and governance processes.

In 2010, EVRAZ’s Head of Internal Audit attended all the meetings of the Audit Committee and addressed any reported deficiencies in internal control as required by the Audit Committee. The Audit Committee continued to engage with executive management during the year to monitor the effectiveness of internal control and accordingly considered certain deficiencies that had been identified in internal control together with management’s response to such deficiencies. The Audit Committee also agreed timelines for effecting the proposed corrective actions in respect of the aforementioned deficiencies.

The annual internal audit programme is predominately risk-based and in 2010 incorporated particular assignments and priorities agreed by the Audit Committee. Further, the scope of the 2010 annual internal audit scope included a review of the internal control systems of newly acquired subsidiaries as considered appropriate for effective risk management.

The Company’s internal audit is structured on a regional basis, reflecting the developing geographic diversity of the Group’s operations. In the light of this the head office internal audit function has furthered implementation of common internal audit practices throughout the Group. During 2010 the internal audit function worked in close cooperation with Ernst & Young, EVRAZ’s external auditor, on a joint review of internal controls and an appraisement of the general competence, independence and professional objectivity of the Group’s internal audit resource. In 2010 the internal audit function in the Russian Federation and Ukraine passed through the external quality review. Management of the internal audit function is planning actions to respond to observations and recommendations made by the reviewer.

RISK MANAGEMENT

The Group’s business and operations are exposed to various business risks. While a number of these risks are operational or procedural in nature, several of these risks are inherent in the character and jurisdiction of the Group’s international business activities, while others relate to changes in the global economy and are largely outside management’s control.

With regard to risk management disciplines, the Group’s executives seek to ensure management awareness and appropriate risk mitigation planning and actions, defined and monitored within an enterprise risk management process (ERM). As a structured and coordinated Group-wide governance approach, the Group’s executives have created an ERM process designed to identify, quantify, respond to and monitor the consequences of an executive agreed risk schedule that encompasses both internal and external critical risks. This process is consistent with the listing rules published by the UK Financial Services Authority and is based on the Turnbull Guidance on Internal Control.

The ERM process is fully supported by EVRAZ Group’s Board, the Audit Committee and executive management.

Senior management, tasked with the development of the ERM process, identified key risk elements and, in order to further risk management accountability, assigned ownership of the relevant risk areas to senior managers according to their designated functions.

As a result of the ERM process, a Risk Committee, under the chairmanship of the Audit Committee Chairman and including within its membership the Group CEO and Vice Presidents, is established and mandated to have oversight of the Group’s risk profile and supervise the entire risk management process including response procedures.

During 2010 , the Risk Committee reviewed and updated the Group’s risk matrix together with related risk mitigating actions and delivered its proposals to the Board of Directors for consideration and adoption. The Committee also recommended the development of a risk appetite profile based on the Group’s Impact and Probability risk matrix. Both the risk appetite and the Probability risk matrix with mitigating actions were adopted.

The Group’s executive management is charged with embedding the agreed Risk Management related internal controls and mitigating actions throughout the entirety of the Group’s business and operations and through all levels of management and supervisory personnel. Such practices serve to encourage a risk conscious business culture. During 2010 the Risk Committee reviewed plans to extend the risk management process to the entity-level during 2011-2012.

While the Risk Committee has the primary responsibility for determination of the Group’s risk, the formulation of the consequential appropriate internal controls and the embedment of risk management throughout the Group, the Audit Committee has the oversight of the effectiveness and scope of the Group-wide set of risk management and internal control policies and procedures.

We apply the following core principles to the identification, monitoring and management of risk throughout the organisation:

• Risks are identified, documented, assessed, monitored, tested and the risk profile communicated to the relevant risk management team on a regular basis;
• Business management and the risk management team are primarily responsible for ERM and accountable for all risks assumed in their operations;
• The Board is responsible for assessing the optimum balance of risk through the alignment of business strategy and risk tolerance on an enterprise-wide basis.

The Internal Audit Directorate examines on a regular basis EVRAZ Group’s management of risk efficiency and functionality. The Audit Committee consults regularly on risk management issues.

 Principal Risks and Uncertainties in 2010 (40.4 kb)