Internal control and risk management

Description of the main features of the internal control and risk management systems in relation to the financial reporting process

Affecto prepares consolidated financial statements and interim reports in accordance with the International Financial Reporting Standards, as adopted by EU, the Securities Markets Acts as well as the appropriate Financial Supervision Authority Standards and NASDAQ OMX Helsinki Ltd's rules. The Report of the Board of Directors of Affecto and parent company financial statements are prepared in accordance with Finnish Accounting Act and the opinions and guidelines of the Finnish Accounting Board.

Affecto's financial reporting process consists of external and internal accounting. Internal control and risk management systems and practices as described below are designed to ensure that the financial reports as disclosed by the company give correct information about the company finances in all material respect.

Internal control in Affecto

Affecto's internal control consists of business risk management and internal control systems pertaining to financial reporting. Internal control aims to ensure that Affecto's business activities are efficient and proficient, financial reporting is reliable and that applicable laws, regulations and company's internal policies are followed.

Affecto Board has approved operating principles of internal control, which have been prepared in accordance with the Code recommendation 48. Operating principles include the main features of risk management process, summary of risks, control objectives and common control points for financial reporting as well as roles and responsibilities in executing and monitoring internal control in Affecto.

The Board of Directors and the Audit Committee, which is appointed by the Board, supervise internal control and risk management. The CEO and CFO are together responsible for implementing the internal control and risk management together with the group management team, subsidiary management teams and finance managers.

Risk management process in Affecto

In Affecto's risk management process, subsidiaries in each country identify and assess business risks annually in accordance with a pre-defined model. The assessment includes also potential likelihood and impact of the identified risk. For the risks identified, Affecto prepares an action plan and responsibilities. Risk assessments prepared at the country level are consolidated in the group level and executive management team reviews the summary. Board of Directors reviews the summary and assesses the adequacy of action plans.

Internal control and risk management over financial reporting process

Affecto group has reporting manual which includes an overview of financial reporting process, key outputs, and roles and responsibilities within the process. Essential group policies, for example revenue recognition policy, intercompany transactions policy, transfer pricing policy are part of the reporting manual. The up-to-date versions of reporting manual, other internal guidelines for financial reporting and timetables can be found at group intranet.

Affecto's subsidiaries in each country have separate finance organisation and also business activities are local. Proper arrangement and monitoring of internal control is the responsibility of the local management in accordance with the group framework.

Affecto group uses a common chart of account and consolidation and reporting application. Subsidiaries submit external financial reporting to the group finance on a monthly basis. Reported figures are transferred through a common database to the reporting system which allows transparency of financial data in the subsidiary accounting and reporting.

The group finance has defined the significant processes relevant to internal control over financial reporting, e.g. revenue, purchasing, payroll expenses, project management, finance, and related IT systems. Within this process framework, financial reporting risks and control objectives have been defined and group wide common control points have been designed to mitigate financial reporting risks in a preventive or detective way. Common control points include for example authorisations, key accounting reconciliations, project management procedures, segregation of key financial duties and analysis of financial performance and figures in order to identify any irregularities or errors.

Common control points have been communicated and implemented to the subsidiaries. In connection with the implementation, responsible persons in each country prepared also a self-assessment of common controls and prepared action plan to enhance controls to the target level. Group finance supports subsidiaries by visiting subsidiaries frequently and by providing additional guidance. The subsidiaries together with the group finance conduct annually a self-evaluation of the internal control points, which is then presented to the Audit committee.

Financial reports prepared by the subsidiaries are analysed by Affecto group management and group finance to identify any irregularities or errors. In addition to the financial reports, subsidiary management prepares a written report of activities within the period in a standard form. Group management organises business review meetings at the country level half-yearly in which subsidiary operations and finances are reviewed. Group financial reports are prepared for the Affecto Board on a monthly basis. According its charter, the Board reviews and approves interim financial reports, financial statement releases and the financial statements.

Affecto does not have separate internal audit function. The function is generally carried out by financial administration staff. Any audit results are reported by the CFO to the Board's Audit Committee and to the CEO. If necessary, reports can also be addressed directly to the entire Board of Directors. The Audit Committee can engage external advisors to perform evaluations relating to control environment or other activities.

The group finance and subsidiary finance managers meet semi-annually to evaluate and adjust the procedures related to financial reporting and internal controls.

Assessment of risks and uncertainties

Extract from Financial statements bulletin published on 17 February 2011:

Affecto's bank loan has covenants based on net debt, result and cash flow. Breach of covenant may lead to higher financing costs or even the termination of the loan. Affecto needs to refinance the loan latest in 2012, when the current loan comes due. It is not certain that a new loan facility can be received with the same or better conditions than the current loan.

Affecto’s balance sheet includes a material amount of goodwill. Goodwill has been allocated to cash generating units. Cash generating units, to which goodwill has been allocated, are tested for impairment both annually and whenever there is an indication that the unit may be impaired. Potential impairment losses may have material effect on reported profit and value of assets. The greatest risk is related to Sweden, where Affecto has invested in reforming the organization and processes, which has weakened profitability in the short term.

The changes in the general economic conditions and the operating environments of its customers have direct impact in Affecto's markets. The competition in the markets also tightens continuously. This could have a negative effect on the business, operating results and financial condition of Affecto.

Affecto's success depends also on good customer relationships. Affecto has a well diversified customer base. Although none of the customers is critically large for the whole group, there are large customers in various countries who are significant for local business in the country.

Affecto's order backlog has traditionally been only for a few months, which decreases the reliability of longer-term forecasts. Slower investment decision making, postponing or cancellation of customers' IT investments may have negative impact on Affecto's profitability.

Approximately a half of Affecto's business is in Sweden, Norway and Denmark, thus the development of the currencies of these countries (SEK, NOK and DKK) may have impact on Affecto's profitability.
Affecto's continued success is very much dependent on its management team and personnel. The loss of the services of any member of its senior management or other key employee could have a negative impact on Affecto's business and the ability of the company to implement its strategy. In addition, Affecto's success depends on its ability to hire, develop, train, motivate and retain skilled professionals on its staff.

Affecto sells third party software licenses as part of its solutions. The license sales have most impact on the last month of each quarter and especially in the fourth quarter. This increases the fluctuation in sales between quarters and increases the difficulty of accurately forecasting the quarters. Affecto had license sales of approx. 13 MEUR in 2010.

Currently, corporate tax rates in Latvia and Lithuania are below those of several other member states of the European Union, and therefore Latvia and Lithuania provide a favorable environment for commercial enterprises. Furthermore, the income tax regulation of Latvia and Lithuania allow for local businesses to structure their operations in a cost-efficient way. For example, certain software development activities are treated as so-called creative activities, which is cost beneficial for the enterprises. When joining the European Union on 1 May 2004, Latvia and Lithuania committed to the ongoing harmonization of the laws and regulations of the member states. There is no assurance that the European Union will not impose requirements on its member states to harmonize their taxation system which, in the case of Latvia and Lithuania, could result in an increase in corporate tax rates. Furthermore, there can be no assurances that Latvia and Lithuania will not independently decide to implement tax reforms or that the interpretation of current tax laws by courts or fiscal authorities will not be changed retroactively with similar effects. Harmonization imposed by the European Union or domestic tax reforms or changes in the interpretation of current tax laws by courts or fiscal authorities in Latvia and Lithuania could have a material adverse effect on the business, operating results and financial condition of Affecto.

The Board of Directors and the Audit Committee, which is appointed by the Board, supervise internal control and risk management. The CEO and CFO are together responsible for implementing the internal control and risk management together with the group management team, subsidiary management teams and finance managers.

Updated: 9 March 2011