9. Internal controls

PTTEP recognizes that effective risk management and internal controls
are crucial to efficient business operations as they prevent and
mitigate risks that lead to major losses which impact its business
operations and ensure its compliance with relevant laws and regulations.

PTTEP has designed, implemented, assessed and continuously improved its
internal control system based on the five components of the regulations
of The Committee of Sponsoring Organizations of the Treadway Commission
(COSO) which are summarized below:

(1) Control environment

-   In place is a clear, suitable organization structure and line of
    command that are compatible with its current and future business
    execution.

-   In place is a mechanism to clearly define corporate objectives and
    goals, as is another to define key performance indicators (KPIs) at
    the corporate, unit, and individual levels.

-   In place are a clear corporate governance policy and a clear code of
    business conduct, both in writing, with an annual review for
    possible amendment; also in place is a unit-level assessment of
    conformance to the code.

-   The Corporate Governance Committee devises a CG policy and monitors
    its implementation.

-   PTTEP has a written policy on acknowledgment of complaints and
    protection of whistle-blowers.

-   In place is a competency-based training and development system.

(2) Risk assessment

-   Annual and long-term plans are in place with due regard for external
    risks (oil price and foreign exchange rates) and internal ones
    (including exploration, new venture, and safety risks).

-   The Risk Management Committee devises the corporate risk management
    policy and a related framework apart from ensuring successful
    corporate and project risk management, meeting 12 times this year.

-   The Operation Risk Committee manages technical aspects and supports
    project operations for greater efficiency, meeting 10 times this
    year.

(3) Control activities

-   In place are procedure manuals and an authorization manual, which
    are constantly amended to suit business execution

-   Business processes are amended for greater clarity and are
    standardized for the petroleum exploration and production business.
    In place is a Value Assurance Check panel with systematic approvers
    for individual work stages.

-   A corporate governance framework has been developed for the
    corporate unit for PTTEP’s various projects for clarity in roles and
    responsibilities among them.

-   In place is a compliance unit responsible for inspecting and
    supervising business for strict compliance with laws and regulations
    to minimize risks of non-compliance. It also notifies all parties
    involved about upcoming laws and regulations.

-   In place is employee training on governance and internal controls,
    as is self-assessment of internal controls. Corporate units and
    PTTEP-operated projects in other countries conduct the assessment of
    key business processes under COSO’s approach so that these units may
    appreciate the importance of internal controls, are confident that
    business processes accompany adequate governance and internal
    controls, and devise internal control improvement plans once defects
    are detected.

-   In place is a knowledge management unit designed to constantly
    promote employee education.

(4) Information and communication

-   In place are a communication system and channels inside and outside
    the organization.

-   In place is clear job segregation and designation of responsible
    people for assorted business systems

-   Rights for access to confidential information are classified for all
    units for control of access to data files.

-   In place is an information technology (IT) system, with the SAP
    software applied to enterprise resource planning to link business
    systems to one single system for efficient analysis and assessment
    of outcomes, as well as for planning purposes. These units include
    finance and accounting, procurement, human resources, inventory, and
    maintenance.

(5) Monitoring and assessment

-   In place are clear monitoring and assessment mechanisms in
    comparison with KPIs. Assessment findings are reported to the
    Management every month and to the Board every quarter.

-   The Audit Committee and Internal Audit review business processes and
    monitor plans to upgrade oversight and internal controls, based on
    self-assessment findings of different units and projects to ensure
    that its internal control oversight system is adequate and
    effective.

At the Meeting No. 1/2012/344 of January 30, 2012, which the Audit
Committee also attend. The Board endorsed the Audit Committee’s opinion
on the adequacy of internal controls, that is, PTTEP had designed and
conformed to its internal controls adequately to minimize key risks
potentially harming its operations, and once defects had been detected,
it constantly formulated and improved the system to suit its business,
both current and future, in conformance to relevant laws and
regulations.

In addition, the financial statements of PTTEP and its subsidiaries for
2011, audited by the Office of the Auditor General—the independent and
external auditor, have not identified any significant weakness in
internal controls which may have an impact or cause disruption in
business operations.