Group-Wide Opportunities and Risk Management System

Conscientious management of opportunities and risks is part of responsible corporate governance and is the foundation of sustainable growth and financial success. This includes the ability to systematically identify and take advantage of opportunities while managing risks at the same time. The entrepreneurial decisions we make daily in the course of business processes are based on balancing opportunities and risks. We therefore regard the management of our opportunities and risks as an integral part of our overall business management system rather than as the task of a specific corporate function. Risk management at Covestro also includes nonfinancial risks, which are managed in our Group-wide risk management system.

Opportunities and risk management system

Our opportunity and risk management begins with strategy and planning processes, from which relevant external and internal opportunities and risks of an economic, ecological, or social nature are derived. Financial and nonfinancial opportunities and risks are identified by observing and analyzing trends along with macroeconomic, industry-specific, regional, and local developments.

The identified opportunities and risks are subsequently evaluated and incorporated into our strategic and operational processes. We aim to avoid or mitigate risks by taking appropriate countermeasures, or to transfer them to third parties (such as insurers) to the extent possible and economically acceptable. At the same time, we strive to take maximum advantage of opportunities by incorporating them into our entrepreneurial decisions. We consciously accept and bear manageable and controllable risks that are in reasonable proportion to the anticipated opportunities. Covestro regards these as the general risks of doing business. Opportunities and risks are continuously monitored so that, for example, changes in the economic or legal environment can be identified at an early stage and suitable countermeasures can be initiated, if necessary.

To enable the Board of Management and the Supervisory Board to monitor material business risks as legally required, the following systems are in place: an internal control system ensuring proper and effective financial reporting pursuant to Section 289, Paragraph 4 and Section 315, Paragraph 4 of the German Commercial Code (HGB); a compliance management system; and a risk early warning system pursuant to Section 91, Paragraph 2 of the German Stock Corporation Act (AktG).

The various management systems are based on different risk types, risk characteristics, and timelines. Different processes, methods, and IT systems are therefore applied to identify, evaluate, manage, and monitor risks. The principles underlying the various systems are documented in Group policies that are integrated into our central document control processes and are accessible to all employees via the intranet. Covestro’s Board of Management is primarily responsible for supervising the Group’s risk management. The Chief Financial Officer of Covestro AG is responsible for the effectiveness and appropriateness of the system as a whole in accordance with the areas of responsibilities.

The various systems are described below.

Internal Control System for (Group) Accounting and Financial Reporting (Report pursuant to Section 289, Paragraph 4 and Section 315, Paragraph 4 of the German Commercial Code)

The purpose of our internal control system (ICS) for the (Group) accounting and financial reporting process is to ensure proper and effective accounting and financial reporting in accordance with Section 289, Paragraph 4 and Section 315, Paragraph 4 of the German Commercial Code.

The ICS is designed to guarantee timely, uniform, and accurate accounting for all business processes and transactions based on applicable statutory regulations, accounting and financial reporting standards, and the internal Group regulations that are binding on all consolidated companies.

The ICS concept is based on two frameworks: the Internal Control – Integrated Framework (2013) of the Committee of the Sponsoring Organizations of the Treadway Commission (COSO) and the Control Objectives for Information and Related Technology (COBIT) framework. It is designed to address the risk of misreporting in the (consolidated) financial statements. Risks are identified and evaluated, and steps are taken to counter them. ICS standards mandatory throughout the Covestro Group, such as system-based and manual reconciliation processes and functional separation, have been derived from these frameworks and stipulated by the corporate Accounting function.

The management of each Covestro Group company is responsible for implementing the ICS standards at the local level.

The effectiveness of the ICS processes for accounting and financial reporting is evaluated on the basis of a cascaded self-assessment system that starts with the persons directly involved in the processes, then involves the principal managers responsible for accounting and financial reporting, and ends with Covestro AG’s Board of Management. The IT systems in use throughout the Covestro Group ensure the uniform and audit-proof documentation and transparent presentation of the risks, controls, and effectiveness evaluations associated with all ICS-relevant business processes. It should generally be noted that, however carefully designed, an internal control system cannot provide absolute assurance that material misstatements in the accounting will be avoided or identified in a timely manner.

Continually ensuring the effectiveness and suitability of our ICS considering process changes, new business models, acquisitions and divestitures, and technical specifications requires regular reviews and updating of the controls applied. To identify possible potential for improvement in the area of our nonfinancial performance indicators we analyzed our existing ICS in this regard in fiscal 2021.

In fulfillment of the Chief Financial Officer’s responsibilities, the CFO of Covestro AG has confirmed the criteria and the effective functioning of the internal control system for accounting and financial reporting for fiscal 2021.

Internal Control System to Ensure Compliance

Compliance risks are systematically identified and assessed as part of Covestro’s Group-wide risk management. Risk owners assess the compliance risks that have been identified. A risk matrix is used to define focal points of compliance tasks at Covestro. The findings of a risk-based analysis enabled Covestro to identify four key topics: antitrust law, corruption, data protection, and foreign trade law. The General Counsel/Chief Compliance Officer is the risk owner responsible for breaches of antitrust law and corruption, while the Global Export Control Officer oversees the risk of breaches of foreign trade law, and the Group Data Protection Officer is assigned to handling the risk of loss and improper handling of personal data. With respect to corruption, areas including gifts and invitations, relationships with government officials, and relationships with certain business partners such as sales agents were identified as being especially risk-relevant. A corruption risk analysis was performed in the year 2020 for all companies in which Covestro holds a majority interest. In the reporting year, we focused on the operational implementation of the updated instructions on handling conflicts of interest.

Many controls have been implemented at both the global and local levels to reduce the number of compliance risks. To the extent possible, we integrate the compliance controls into our internal control system. The effectiveness of the compliance controls is evaluated on the basis of a cascaded self-assessment system, as are the ICS processes for accounting and financial reporting. The results of the effectiveness evaluations are documented in the global system for the ICS processes. The Corporate Audit function carries out dedicated compliance checks at regular intervals in the larger companies. In the smaller companies, compliance aspects are part of a general review.

Risk Early Warning System (Report Pursuant to Section 91, Paragraph 2 of the German Stock Corporation Act)

Covestro has implemented a structured process for the early identification of any potentially disadvantageous developments that could have a material impact on our business or endanger the continued existence of the company. This process satisfies the legal requirements regarding an early warning system for risks pursuant to Section 91, Paragraph 2 of the German Stock Corporation Act, and is aligned with the international risk management standard COSO II Enterprise Risk Management – Integrated Framework (2004). A central unit defines, coordinates, and monitors the framework and standards for this risk early warning system. In this context, our risk early warning system was modified in fiscal 2021 in line with the updates to the Auditing Standard 340 of the Institute of Public Auditors in Germany (IDW). Covestro now uses a software package that simplifies the aggregation of risks, provides displays of various interdependencies, and compares individual risks to the newly defined risk bearing capacity.

Throughout the year, various global subcommittees provide new and updated information about identified risks. The Covestro Corporate Risk Committee met three times in fiscal 2021 to review the risk landscape as well as the various risk management and monitoring mechanisms that are in place, and to take any necessary measures. Additionally, we conduct an ad-hoc process for newly identified risks throughout the year so that these are immediately incorporated into the risk management system. These ad-hoc risks are identified and their handling is determined based on risk assessments and depending on the defined thresholds.

Risks are evaluated using estimates of the potential impact after taking into account countermeasures, the likelihood of their occurrence, and their relevance for our external stakeholders. The potential economic losses are projected using the expected EBITDA loss. All material risks and their countermeasures are documented in a new Group-wide database that is at the heart of the new software. The risk early warning system is reviewed regularly over the course of the year. Significant changes must be promptly entered in the database and reported to the Board of Management. In addition, a report on the risk portfolio is submitted to the Audit Committee several times a year and to the Supervisory Board at least once a year.

The probabilities of occurrence revised in the previous year and the cumulative loss amounts (€50 million or more) were transferred to a new software.

The following matrix illustrates the direct financial and indirect financial criteria for rating a weighted risk as high, medium or low. The same applies to the classification of nonfinancial risks.

Rating matrix

Criteria for the classification of indirect financial impact

Process-Independent Monitoring

The effectiveness of our management systems is evaluated at regular intervals by the Corporate Audit function, which performs an independent and objective audit focused on verifying compliance with laws and policies. Corporate Audit also supports the company in achieving its goals by systematically evaluating the efficiency and effectiveness of governance, risk management, and control processes and helping to improve them. The selection of audit targets follows a risk-based approach. Corporate Audit performs its duties according to internationally recognized standards. The Supervisory Board’s Audit Committee is regularly informed about the results of audits and also receives an annual report on the internal control system and its effectiveness.

Risks in the areas of occupational health and safety, plant safety, environmental protection, and product quality are assessed through specific health, safety, environment, energy, and quality (HSEQ) audits.

The external auditor assesses the early warning system for risks as part of its audit of the annual financial statements, focusing on whether the system is fundamentally suitable for identifying at an early stage any risks that could endanger the company’s continued existence so that suitable countermeasures can be taken. The auditor also reports at regular intervals to Covestro AG’s Board of Management and the Audit Committee as well as the Supervisory Board on the results of the audit and any weaknesses identified in the internal control system. Audit outcomes are also taken into account in the continuous improvement of our management processes.