10. Internal Control, Risk Management & Internal Audit

Internal Control and Risk Management System

The Company has placed great emphasis on Internal Control and Risk
Management. Employees at every level in every unit share roles and
responsibilities. The authority and responsibility of Management and all
levels of operations regarding Internal Control and Risk Management are
clearly defined in the Company’s written statement. Such Internal
Control and Risk Management cover financial control, operational
control, management control, and governance, as well as compliance with
regulations, laws, and external regulations. These state that the
Company must possess reasonable assurance that the outcomes of its
operations keep the Company on course towards its goals, and that the
Company’s mission is achieved as follows:

1.  Strategies and goals are clearly defined and aligned to support the
    Company’s mission.

2.  Outcomes achieve their defined objectives, and resources are
    managed, and used efficiently and economically.

3.  All reports of significant information including financial,
    management, and operational information are correct and reliable.

4.  Operations and employee’s activities follow the Company’s rules and
    regulations and are in compliance with judicial laws and external
    regulations related to business operations.

5.  All human, physical, and information assets are properly
    safeguarded.

6.  Corporate governance and management is effective.

7.  Continuous improvement for all operations exists.

The Company has established an Internal Control and Risk Management
System following the integrated framework of the Committee of Sponsoring
Organisations of the Treadway Commission - Enterprise Risk Management
(COSO-ERM) Standard, which has been integrated into business operations
and management processes within the Company through the following eight
factors:

1. Internal Environment

The Company complies with its Corporate Governance Policy and adheres to
business ethics. In addition, employees at every level follow the
Company’s written Code of Conduct, regulations, and procedures. The
Company has appointed a Code of Conduct Committee and positioned
Management as role models of integrity and morality. The Company has
also established an appropriate organisational structure. All
stakeholders are treated well and with fairness, and in such a way that
complies with good corporate governance principles.

The Company has placed great emphasis on the continuous development of
employees. The Company has determined a Risk Management Plan and manages
risk continuously and systematically.

2. Objective Setting

The Company has clearly defined its written working objectives relating
to strategy, operations, policy reporting, rules and regulations, and
guidelines. These objectives are aligned with the Company’s goals and
risk appetite. The Company’s business plan, strategy, and objectives are
updated regularly in accordance with the current situation and changing
risk factors.

3. Event Identification

The Company regularly indicates any event identification or risk factor
that may have a negative impact on achieving the Company’s objectives.
In addition, the Company identifies events which have a positive impact
on its objectives by considering both internal and external factors, and
has monitoring systems in place to ensure that all risk factors are
appropriately identified according to changing activities, and that all
risks are reported to appropriate Management routinely.

4. Risk Assessment

The Company has established a Risk Management Manual and has
systematically defined risk assessment criteria for both qualitative and
quantitative risks in assessing Corporate Risk and Operational Risk in
terms of likelihood and impact. Both factors are used to consider risk
levels that can be high, medium, or low.

5. Risk Response

The Company has continual processes in place to systematically manage
risk by considering the most effective and economic choice, and by
determining the highest prioritised risk to be managed to reduce
likelihood and impact. Risk Management is always performed together with
the Internal Control System to ensure that it is consistent with ever
changing risks.

6. Control Activity

The Company has appropriately established sound internal control
activities for each process, mainly concentrating on preventive control
by setting relevant policies and procedures. Results are reported
regularly to ensure the effectiveness of Risk Management procedures, and
to ensure that risk strategies and internal control activities are
performed to meet objectives, and are achieved through quality and
economy of speed.

7. Information and Communication

The Company has an information network that can be used for timely
decision making. It also has an effective information security system to
provide an audit trail that can be partially reviewed. The system can
completely analyse, indicate, record, and report the incidence of risk
by systematically evaluating and managing such risk.

The Company has an efficient and effective communication channel that
can communicate throughout the organisation. Important information can
thus be communicated from management to employees rapidly. In addition,
the Company has a communication channel from employees to Management.

8. Monitoring

The Company has a good evaluating and monitoring system in place to
ensure that procedures and internal control activities are effective,
and respond to change appropriately and timely. It has also taken on the
activity of monitoring by leaders to follow up on employees.
Furthermore, the Company evaluates financial statements and operational
outcomes through an independent internal auditor, an independent
external auditor, and an independent appraiser.

The Company has a monitoring system and a warning system in place to
ensure that Risk Management is effective and sufficient, and that risk
levels remain at appetite risk levels. The Company has set a report
system for every management level including senior management. The
Company also sets regular meetings for the Board of Directors and for
senior management to review and monitor the outcomes of management
operations regardless of how the objectives are achieved.

Running a telecoms business in Thailand in 2007 was greatly affected by
a number of factors, namely consumer behaviour, political instability,
and laws and regulations of the telecoms industry. AIS, as a corporation
having the majority market share in Thailand, has always emphasised
enterprise risk management. Its Risk Management Committee, presided over
by the Chairman of the Company, the Chief Executive Officer and
executive management, is composed of twelve committees. The Risk
Management Committee arranges regular quarterly meetings to identify
risks, manage and control risk at an acceptable level, and more
importantly, enable the Company to accomplish its goals and create value
for all stakeholders. In addition, the Company provides training in Risk
Management in the form of e-learning which has been designed for
managers and employees across the board to be used as Risk Management
guidelines in operational activities.

Consequently, each quarter, the Risk Management Committee submits
details of Risk Management performance to the Audit Committee, the Board
of Directors, and the Executive Committee in order to ensure that risks
are thoroughly overseen, that risk levels are at an acceptable level,
and that the Company achieves its goal. The risk factors are summarised
and revealed in the part of risk factors.

The Board of Directors, including the Audit Committee, attended the
Board of Directors Meeting 2/2008 on 19 February 2008 and assessed the
Internal Control System by reviewing the Internal Control questionnaire
and by interviewing Management. The Board of Directors found that the
Company had implemented a complete and effective Internal Control
System.

In addition, PricewaterhouseCoopers ABAS Limited, the Company’s external
auditor and the auditor of the 2007 Financial Statement, have evaluated
the effectiveness of the Company’s Internal Control System, and
concluded that there were no material deficiencies.

Internal Audit

The Company has established an independent Internal Audit Office which
reports directly to the Audit Committee and administratively to the
Chairman of the Executive Committee. An Internal Audit Office Charter
has also been created to define the mission, scope, objectives,
accountability, and responsibility of activities, including Internal
Audit Office authority and an Internal Audit Manual for reference. The
Internal Audit Office Charter and Internal Audit Manual are updated
regularly to be consistent with current operations.

The duty of the Internal Audit Office relates to the auditing of
Internal Control, Risk Management, and Corporate Governance, and follows
the action plan approved by the Audit Committee using a risk based audit
approach. It also includes consultation with Operations and Solutions to
ensure that the Company’s objectives are achieved through various
strategies and goals. Furthermore, the Internal Audit Office regularly
performs monitoring activities to ensure that the Internal Control
System is working effectively and continuously, and that errors are
found and corrected in time.

In assessing the effectiveness of Risk Management, the Internal Audit
Office reviews event identification and risk factors which affect the
Company’s objectives, and then reviews the Risk Management approach.
This ensures the accuracy of both event identification and risk
assessment, and ensures that a systematic Risk Management approach
exists. It also ensures that risk is managed at the appetite level, is
reported timely to all relevant personnel, and is reviewed continuously.

In assessing the effectiveness of Internal Control, the Internal Audit
Office has developed a questionnaire for each process, and regularly
reviews the outcome of each operation to ensure that the Company’s
objectives are achieved efficiently and effectively, that rules and
regulations are strictly adhered to, and that the financial report is
accurate and reliable.

In assessing the effectiveness of corporate governance, the Internal
Audit Office performs audits following the “good corporate governance”
criteria of the Organisation for Economic Cooperation and Development
(OECD) and the Security Exchange Commission (SEC). This ensures that the
Company has the necessary infrastructure and supporting processes to
approach ‘good corporate governance’, and that the Company is
transparent, can achieve fairness for all stakeholders, and can
accomplish its objectives in order to create the greatest benefit for
stakeholders.

Moreover, the Chief Audit Executive (CAE) acts as a secretary to the
Audit Committee to enhance the effectiveness of its responsibility and
accountability to all functions of the Audit Committee assigned by the
Board of Directors, and arranges Audit Committee meetings once a month.
The CAE has the additional role of consulting by acting as a committee
member of the Risk Management Committee and the Security Committee with
the responsibility of advising the Company in matters of corporate risk
and information security, and arranging committee meetings quarterly.

The Internal Audit Office adheres to the framework of Standards for the
Professional Practice of Internal Auditing, COBIT, COSO-ERM, AS/NZ 4360,
ITIL, and ISO 177990. In addition, the Company continuously encourages
Internal Audit staff to work independently and objectively, comply with
pertinent standards, and emphasise quality and continuous development
through Individual Coaching Plans. Furthermore, Internal Audit staff
have been trained to acquire CIA (Certified Internal Auditor), CISA
(Certified Information System Auditor), CISSP (Certified Information
Systems Security Professional), and CISM (Certified Information Security
Manager) qualifications. At present there are five (5) CIA, four (4)
CISA, one (1) CISM, one (1) CISSP, three (3) CPA (Certified Public
Accountant), and one (1) TA (Tax Auditor) qualified staff. Each year,
additional Internal Audit officers take exams to acquire these
certificates.