Increased emphasis on risk management
Increasingly complex projects, changing roles of market participants and more stringent regulation and reporting demands underscore the importance of risk management. Risks for ARCADIS include:
– Market risks: these include the risks that markets in which ARCADIS is active, temporarily or not, may decline and that change in market conditions can lead to increased competition. These risks can occur as a result of cyclical downturns, changes in political priorities or legislation and regulations, political instability or the consolidation/increase in proportion of clients and changes in their bidding behavior.
– Operational risks: these occur during the execution of our work. These include claims as a result of errors or shortcomings in activities, project losses, underutilization and vacant properties and risks related to partners and subcontractors, work in progress and receivables, as well as special projects, information and communication technology systems and health and safety.
– Financial risks: in general, these risks have a direct financial impact. They include seasonal effects, goodwill impairment, currency exchange rate and interest rate risks, project development risks, risks related to project assessments, taxes, liquidity, pensions, options, as well as risks related to acquisitions.
– Other risks: including risks related to the employment market, as well as risks related to reputation, integrity, fraud and compliance.

Risk management requires a healthy balance between entrepreneurship and recognizing and managing the risks that are associated with entrepreneurship. Important for good risk management at ARCADIS are (adherence to) internal approval and control systems, regular meetings with operating companies about business progress (including risks), the portfolio policy and account management, as well as measures related to information systems. The primary pillars in the management of operational risk are quality systems, the health and safety policy, contract management, project management, insurances, quality of employees and flexibility in staffing levels. An extensive explanation of the risks mentioned above; the way in which these risks are managed and a description of the different contract types under which ARCADIS offers its services can be found on the other webpages of Risks and risk management.
Types of contract
Risks
Risk Management

The Executive Board is responsible for the design and functioning of the internal risk management systems. Although such systems are intended to optimally control risks, they can never, however well designed or functioning, provide absolute certainty that human error, unforeseen circumstances, material losses, fraud or infringements of laws or regulations will not occur. In addition, continuous evaluations of the effects of risk management systems and the costs incurred must occur.

Implementation of SOX 404
To comply with Section 404 of the Sarbanes-Oxley Act, a system of unidirectional procedures and related controls for core processes was introduced in 2004 to, with a degree of certainty, prevent or timely discover and repair material weaknesses in financial reporting. The internal control systems and procedures were evaluated to ensure proper financial reporting. In this process, the internationally acknowledged COSO framework was used. The general controls of all our relevant operating companies were assessed in the areas of management and supervision, risk management, information systems, project control and human resources management.

For the risks identified in specific operational processes, controls were established to manage the identified risks in operational processes. Explicit attention was given to the prevention of fraud. ARCADIS verified the effective functioning of these controls. Non-effective controls were evaluated for their impact and probability for material weaknesses in financial reporting and where necessary were adjusted. Through this process, we are able to assess whether or not the primary financial reporting risks are sufficiently under control.

The quality of this control framework is tested annually by management and verified and certified annually by the external auditor, and the results are reported in the Annual Report on Form 20-F. This will occur for the first time in spring 2007 for the situation at year-end 2006. Based on the process through preparation of the IFRS financial statements for 2006, the internal risk management systems for financial reporting are adequate and effective.

Risk management improved
The introduction of SOX 404 helped improve awareness of risks and their control. Processes were modified, and management systems and procedures for procurement and authorization, documenting completed controls and tax and treasury guidelines were improved. 2006 also saw the introduction of a new consolidation system that improved the quality of the consolidation and financial reporting. Finally in 2006, preparations were completed for an Internal Audit function, which becomes effective in 2007. All these measures were discussed with the Audit Committee and the Supervisory Board.

Declaration regarding financial reporting risks
Based on our evaluation, we are of the opinion that the risk management and control systems provide a reasonable certainty that the financial reports do not contain any errors of material impact and that these systems have performed as required in the reporting year. There are no indications that these systems will not properly function in 2007 as well.