Internal control

Wärtsilä has defined its objectives for internal control according to the international COSO framework. Wärtsilä defines internal control as a process implemented by Wärtsilä’s Board of Directors, the management, the Boards of Directors of Group companies, and other personnel, designed to provide reasonable assurance regarding the achievement of objectives.

Internal control covers all the policies, processes, procedures and organisational structures within Wärtsilä that help the management, and ultimately the Board, to ensure that Wärtsilä is achieving its objectives, that the business conduct is ethical and in compliance with all applicable laws and regulations, that the company’s assets, including its brand, are safeguarded, and that its financial reporting is correct. Internal control is not a separate process or set of activities but is embedded in Wärtsilä’s operations. 

The tone from Wärtsilä management and emphasis on management and employee integrity and control awareness is the starting point for the structure of the internal control framework in Wärtsilä. Entity-level controls ensure clear standards of behaviour, accountability, adequacy of corporate policies, manuals and instructions and clearly defined oversight roles.  

Wärtsilä’s management performs monitoring as part of its regular supervisory activities. Business management is responsible for ensuring that all relevant laws and regulations are complied with in their respective responsibility areas. The Legal and Compliance function monitors adherence to the compliance policies of the Group

The system of internal control operates at all levels of Wärtsilä. Wärtsilä maintains and develops its internal control system with the ultimate aim of improving its business performance and, at the same time, complying with laws and regulations in the countries where it operates. 

The control environment in Wärtsilä is the foundation for the internal control processes and control activities over financial and sustainability reporting. The Wärtsilä internal control environment over financial and sustainability reporting is based on the COSO framework structure: 

  • Risk assessment
  • Control activities
  • Information and communication
  • Monitoring

Roles and accountabilities are structured according to the COSO framework three lines of defence:

  • Business processes, management control measures 
  • Corporate governance, risk management, management systems, and internal control
  • Internal audit

Main components of Wärtsilä's internal control


Values and the control environment 

The foundation of Wärtsilä’s internal control system lies with the company’s values: customer success, passion, and performance. Wärtsilä’s values are reflected in its day-to-day relations with its suppliers, customers, and investors, as well as in internal guidelines, policies, manuals, processes, and practices. The control environment sets the tone for internal control within Wärtsilä and influences the control awareness of its people. It provides discipline and structure for all the other components of internal control. The elements of Wärtsilä’s control environment are included in the corporate culture; in the integrity, ethical values and competence of Wärtsilä’s personnel; as well as in the attention and direction provided to the personnel by the Board of Directors.

Wärtsilä’s values and control environment provide Wärtsilä’s Board of Directors and management the basis for reasonable assurance regarding achievement of the objectives of internal control. The President & CEO and the Board of Management define Wärtsilä’s values and ethical principles, which are reflected in the Code of Conduct approved by the Board of Directors, and set an example for the corporate culture, which together create the basis for the control environment. They, together with the business management, are responsible for communicating Wärtsilä’s values to the organisation.

Management systems

The Board of Management is responsible for developing and implementing Wärtsilä’s management systems, continuously improving their performance and ensuring that they operate effectively. Wärtsilä’s management systems cover all global processes and management procedures within Wärtsilä related to fulfilling customer requirements. The proper functioning of the management systems ensures, for their part, the attainment of Wärtsilä’s internal control objectives. 

Guidelines and manuals 

The components of Wärtsilä’s internal control system, including for example corporate governance, management systems, the performance management process, as well as business and other processes, are described in various guidelines and manuals. The essential Group level policies and guidelines are compiled in Wärtsilä’s Corporate Manual. Wärtsilä’s Group level Accounting Manual and Sustainability Accounting Manual contain instructions and guidance on accounting and reporting to be applied in all Wärtsilä Group companies. These manuals support the achievement of objectives related to the reliability of Wärtsilä’s financial reporting. Wärtsilä’s Group level policies, and any changes to them, shall be approved by a member of the Board of Management. 

In addition to the Group level guidelines and manuals, the businesses have issued related guidelines and instructions for their own, specific purposes. The business level guidelines and manuals are aligned with, and do not contradict, the Group level guidelines and manuals. 

Business processes 

The controls embedded in Wärtsilä’s business processes play a key role in ensuring effective internal control within the company. Controls in the business processes help ensure the achievement of all the objectives of internal control within Wärtsilä, especially those related to the efficiency of operations and safeguarding the company’s profitability and reputation. 

The business management is responsible for ensuring that, within its area of responsibility, the defined Group level processes and controls are implemented and complied with. Where no Group level processes and controls exist, the business management is responsible for ensuring that efficient business level processes with adequate controls have been defined and implemented. 

Internal control over financial and sustainability reporting

Risk Assessment

Wärtsilä applies a risk-based approach to identifying and securing an adequate control environment. The risk identification is based on analysis of the end-to-end financial and sustainability reporting processes and their relation to risk for material misstatements in the reporting. Risk assessments are performed on a regular basis to ensure adequate risk identification in existing processes as well as identification of new possible risks. 

Control activities are designed to mitigate identified key risks and thus ensure correctness and compliance of financial and sustainability reporting. The control structure is also designed to support the company in achieving its targets. The risks related to the achievement of targets need to be identified and evaluated in order for them to be managed. Thus, the identification and assessment of risks is a prerequisite for internal control within Wärtsilä.

Values and control environment

The internal control activities are designed to support the company in achieving its objectives. Wärtsilä’s internal control mechanisms and procedures provide assurance to the management, that the risk management activities are carried out as intended. Wärtsilä has defined and implemented entity level and process level control activities, as well as information system controls. Control activities at different levels are implemented to directly mitigate risks at the respective levels. 

The Wärtsilä’s finance and control processes are essential for the functioning of internal control over financial and sustainability reporting. The performance of control activities is the responsibility of business and support functions. They are responsible to ensure control activities adhere to the control requirements set out by Corporate Finance & Control. Control and process owners in the business and support functions are responsible for the implementation, quality, efficiency and adequate documentation of the relevant controls. 

The controls are designed as an integrated part of the finance and control  as well as business processes to both add value to the business controlling and finance processes as well as to serve the purpose of adequate risk mitigation. The control activities are performed as integral parts of the process, as automated solutions, as part of the monthly reporting and controlling tasks and as part of the quarterly reporting. The control activities, review and analytical procedures performed ensure correctness and reliability of the financial reporting. 

The Board of Directors regularly assesses the adequacy and effectiveness of Wärtsilä’s internal controls and risk management. It is also responsible for ensuring that the internal control of accounting and financial administration is arranged appropriately. The Audit Committee of Wärtsilä’s Board of Directors is responsible for overseeing the financial reporting process.

Information and communication

An effective internal control system needs sufficient, timely, and reliable information to enable the management to assess the achievement of the company’s objectives. Both financial and non-financial information is needed, relating to both internal and external events and activities. 

Wärtsilä’s financial reporting is carried out in a harmonised way in all major Group companies, using a single instance ERP system and a common chart of accounts. Internal control activities related to financial and sustainability reporting are performed and documented in a harmonised way. Regular and structured communication between Corporate Finance & Control, businesses and other support functions, as well as control owners and performers, is essential to continuously uphold the quality of control procedures.

Monitoring

Monitoring is a process that assesses the quality of Wärtsilä’s internal control system and its performance over time. Monitoring is performed both on an ongoing basis and through separate evaluations that include internal, external, and quality audits.  

Management monitoring includes review of financial performance against targets, follow up of control performance and effectiveness as well as analysis of key performance indicators.      

The Corporate Finance & Control function oversees the financial reporting processes and controls to ensure that they are followed. Corporate Finance & Control, together with businesses, monitors the control performance on monthly basis to ensure the required level of internal control procedures. Corporate Finance & Control also monitors the correctness of all external and internal financial reporting. 

The Audit Committee of the Board of Directors assesses and assures the adequacy and effectiveness of Wärtsilä’s internal controls and risk management. The Corporate Internal Audit function assists the Audit Committee in this work. Wärtsilä’s external auditor audits Wärtsilä’s financial statements, which includes the consolidated financial statements. In addition, Wärtsilä’s external auditor and other assurance providers, such as quality auditors, conduct their evaluations of Wärtsilä’s internal controls.