Increased emphasis on risk management
As a result of the increasing complexity of projects, changing roles of market participants and more stringent regulation and reporting requirements, the emphasis on risk management has substantially increased. Risks for ARCADIS include:
– Market risks: markets in which ARCADIS operates may decline, temporarily or structurally, and changes in market conditions may lead to increased competition. These risks can be caused by cyclical downturns, changes in political priorities, changes in legislation and regulations, political instability, consolidation of clients and changes in tendering procedures.
– Operational risks: these occur during contract execution and include project overruns, claims as a result of errors or omissions, underutilization of staff and properties and risks related to partners and subcontractors, IT systems and health and safety.
– Financial risks: in general, these have a direct financial impact and include seasonal effects, currency exchange rate and interest rate risks, project development risks and risks related to work in progress, receivables, taxes, liquidity, pensions, options, as well as risks related to acquisitions.
– Financial reporting risks: this concerns the risks that the financial statements do not correctly represent the financial condition of the company.
– Other risks: these involve labor market risks and risks related to reputation, integrity, fraud and compliance.
Besides these risks, other risks might occur that could seriously impact ARCADIS or its business. A more extensive overview of risks and contract types under which services are offered can be found on the following pages:
Types of contracts
Risks
Risk Management
Entrepreneurship is one of ARCADIS' core values. It includes recognizing, assessing and managing risks involved. In general, frequent communication between the different levels of management in the organization is important for early identification and addressing of (potential) risks. Internal approval procedures and control systems are used to stimulate and maintain risk awareness and to sytematically address risk issues. ARCADIS has General Business Principles in place as a guideline for business decisions for all employees. In 2007, a global policy and management system to manage health and safety risks were implemented. The abovementioned section of our website provides an overview of ARCADIS' risk management processes.
The Executive Board is responsible for the design and functioning of the internal risk managemen and control systems. Although such systems are intended to optimally control risks, they can never, however well designed or functioning, provide absolute certainty that human errors, unforeseen circumstances, material losses, fraud or infringements of laws or regulations will not occur. In addition, the impact of risk management and control systems should be balanced with the costs of their implementation and maintenance.
Main risks and how these are managed
Based on our experience, we have identified three main risk categories in our business. These risks and the way they are managed can be summarized as follows:
- Imbalance between work load and staffing levels: a decrease in work load will lead to staff underutilization. Experience indicates that strong market downturns could lead to a 15% decrease in revenue within one year for a particular business line within a country. This obviously had a serious impact on margin and profitability. Risk management includes: monitoring order intake and billability; 10% to 15% of staff under flexible contracts, particularly in Europe (in the United States adjusting staff levels is easier); and on a more strategic level: portfolio management to get a good balance geographically between business lines and between client categories in order to spread market and strategic risks.
- Project-related risks: ARCADIS works on thousands of projects/contracts annually. Although in most cases project risks are limited, projects may have serious cos overruns; errors or omissions may lead to substantial claims; contractual conditions may cause considerable liabilities; and staff involved may be seriously injured in executing projects. Risk management involves project approval procedures, including the review of contract condition; special procedures for projects with higher risk profiles; regular project reviews; selection, training and procedures for project management; quality management systems; procedures for claims reporting and management; insurance policy and health and safety management. Project risks and claims are assessed on a quarterly basis, and using the valuation principles under IFRS, provisions are taken to cover those risks.
- Risks related to acquisitions: Growth through acquisitions is part of ARCADIS' strategy. All acquisitions involve risks, such as balance sheet misrepresentations, unforeseen claims, lagging performance, integration risks and retention of key people. Risk management includes central management of acquisition processes; verification of management quality and reputation; appropriate due diligence, usually with outside support, including a business review and an assessment of human resources conditions; proper representations and warranties; escrows to cover guarantees; employment and non-compete contracts; and dedicated management of a post-acquisition plan. Occasionally after-payments are used, but only for a limited period, so that integration and synergy are not hampered.
Although the above mentioned risks are considered the most relevant, it cannot be excluded that other risks have a similar or greater impact on the Company.
ARCADIS reported SOX compliance for its 2006 Annual Report
As ARCADIS was until mid-2007 a NASDAQ listed, the Company had to comply with Section 404 of the Sarbanes-Oxley Act. Therefore in 2004, a project was started to develop and implement a control framework to prevent or timely discover and repair - with a reasonable degree of certainty - material weaknesses in financial reporting. The internationally acknowledged COSO framework was used in this process. The relevant operating companies evaluated their operational processes and, for risks identified, established controls to manage these risks. Explicit attention was given to the prevention of fraud. By the end of 2006, the quality of this control framework was tested by management and later verified and certified by the external auditor. As a result, ARCADIS reported compliance with the requirements of SOX 404 in the 2006 Annual Report on Form 20-F.
From SOX to ARCADIS Control Framework
After publishing the 2006 Annual Report on Form 20-F, ARCADIS announced its withdrawal from the NASDAQ stock exchange as of June 2007, to be followed by deregistration form the U.S. Securities and Exchange Commission in June 2008. The reasons were the low trading volume of our shares on the NASDAQ and the high costs compared to the benefits. As ARCADIS is no longer required to comply with SOX, the ARCADIS control framework has been developed, which is based on the SOX requirements but with more focus and without unnecessary paperwork. It will apply to all operating companies and will regularly be verified by ARCADIS' internal auditors.
Risk management further improved
The introduction of SOX 404 helped improve risk and control awareness, not only in relation to financial reporting but also for business risks. In 2007, good progress was made in expanding the scope of ARCADIS' control framework to all operating companies. The new financial consolidation system that was introduced in 2006 helped to further improve the quality of consolidation and financial reporting. The internal audit reports and measures to address recommendations were discussed with the Audit Committee.
Statement regarding financial reporting risks
Based on an evaluation of the functioning of the internal control framework, we are of the opinion that the risk management and control systems provide a reasonable certainty that the financial reports do not contain any errors of material impact and that these systems have performed as required in the reporting year. There are no indications that these systems will not properly function in 2008 as well. Similar to the practices under SOX, we allow one year to bring sizeable acquisitions into our control framework.
