9. Internal Control

Internal Controls and Internal Audit

1. Internal Controls

SCG places high priority on internal control by stipulating that the
Audit Committee is accountable for review of internal control systems to
ensure they are sufficient and appropriate for the Company’s business
operations. To that effect, the Internal Control-Integrated and
Enterprise Risk Management-Integrated Frameworks of the Committee of
Sponsoring Organization of the Treadway Commission (COSO) are used as
management tools to synergize the risk management process and internal
control efforts. This corresponds to SCG’s business operations and the
eight components of enterprise risk management including internal
environment, objective setting, event identification, risk assessment,
risk response, control activities, information and communication, and
monitoring. Moreover, control self assessment (CSA) has been
implemented, allowing employees to use it as a management tool for their
work, to improve the internal control of work systems, to monitor and
follow up work under their responsibilities completely, and to solve any
problems promptly to achieve the established goals in an efficient
manner.

In 2011, apart from the aforementioned internal control activities, SCG
developed various systems to ensure the efficiency and effectiveness of
the control system and to promote sustainable development. These work
systems can be summarized as follows:

1.  Raising employees’ awareness about establishing preventive measures

  SCG realizes the importance of preventive measures which employees and
  the internal control system play a key role in success in implementing
  and executing the measures. Hence, SCG has established an appropriate
  and strict internal control system, preventive measures, audit
  activities and corrective measures in order to mitigate risks and
  potential impacts. This runs concurrent with instilling ethical values
  into employees at all levels and developing employees’ good
  understanding of corporate governance, starting from their first day
  of employment. Apart from an orientation program, employees undergo
  constant training and participate in workshops on compliance with the
  Company’s Corporate Governance Policy and Code of Conduct. The Company
  has established a sound oversight system, having the Board of
  Directors to act as role models for all employees. In addition, SCG
  has developed work procedures, fraud prevention manuals and guidelines
  for all major business functions to promote employees’ understanding,
  awareness, and observance of high ethical standards in performing
  their duties. Further, SCG has stipulated the use of Control Self
  Assessment (CSA) and established a whistleblower system in order to
  allow employees to report suspicious fraudulent acts or non-compliance
  with rules, regulations and laws. Where there is sufficient evidence
  of a fraudulent act, the Company appoints an investigation committee
  to ensure fairness to all concerned parties. Each instance of fraud
  will be used to help define preventive measures and as a case study.

1.  Developing Customized Control Self Assessment (CCSA) Systems

  SCG has implemented control self assessment (CSA) systems in the
  operations of various functions, which has met with sustained success.
  In 2011, to ensure that the control self assessment encompasses the
  key performance indicators (KPI) as well as the key internal controls
  of each business unit, and corresponds to the changing business
  environment, the Company enhanced the existing CSA system and
  customized it to better fit the nature of each business unit. The
  Company added assessment of key controls in line with the COSO
  guidelines defined internal control warning signals, prepared an
  executive summary, and developed a self-check template so as to
  facilitate easier assessments by employees. Further, appropriate
  persons were designated to conduct assessments according to each
  specific type of internal control, i.e., a monthly operational control
  and a quarterly general control, in addition to monitoring the
  assessment results and improvement of controls.

1.  Developing continuous monitoring and continuous auditing system for
    the business units

  To ensure that the business units have tools for use as mechanisms to
  control and prevent fraud risks and to monitor the performance of each
  function efficiently, the Audit Office has developed a continuous
  monitoring and continuous auditing system using information technology
  (IT) to link the databases of different systems and detect
  transactions that show abnormal signs or potential problems that need
  to be kept track of or fixed. This keeps the persons in charge
  promptly informed while ensuring a more efficient internal control and
  audit system.

2. Internal Audit

The Audit Committee supervises the Audit Office to ensure that it works
with independence, integrity, and proper ethics under the Audit Office
charter, which clearly prescribes the mission, scope of work, authority,
duty, and responsibility as well as the operating and auditing
guidelines. The Audit Committee also assesses the sufficiency and
efficiency of internal control systems and enterprise risks so as to
ensure that the operations are in line with SCG’s vision and the
constantly-changing business environment. This enables employees at all
levels to perform their duties efficiently and effectively. In 2011, the
efforts can be summarized as follows:

1.  Audit enhancement to create high value services

  In addition to focusing on providing independent and objective
  assurance and consulting services creating values for SCG and
  contributing to operational improvements, the Audit Office has
  committed to audit enhancement to create high value services in a
  sustainable and continuous manner. To achieve this goal, the Office
  prepared the annual risk-based audit plan and promoted ‘Global
  Auditing Excellence’ by benchmarking SCG’s internal audit practices
  against those of leading professional audit firms with the focus on
  implementation. The high value services are as follows:

  2.1.1 Organized team for high-risk projects by integrating computer
  audit, business unit audit and audit development. All concerned
  parties collaborate to assess risks and provide recommendations for
  improving business processes. Information technology is used to
  enhance efficiency of the audit process and facilitate monitoring and
  detection of abnormal signs.

  2.1.2 Performed proactive preventive audit by examining the
  shortcomings in operations in order to develop an appropriate system
  and also made suggestions to the management of each business unit or
  function , or other involved departments to prevent the errors from
  happening among other companies in the Group.

  2.1.3 Acted as the business partner of each company with the focus on
  providing consultancy and application. To do so, the Audit Office
  provided information and suggestions on accurate work procedures and
  the internal controls appropriate for the nature of each business
  every time the Office carried out an audit at a company and found
  points needing improvement. The audit results from the company were
  encapsulated into the lessons learned for application and use in
  workshops to prevent mistakes from happening again.

  2.2 Auditors’ competency development

  At present, internal audit work develops rapidly with a stronger
  emphasis on professionalism to enhance the knowledge, skills, and
  competency of auditors to reach international standards, enabling them
  to work more efficiently and effectively and with better quality. This
  helps add more value to the organization. The Audit Office provides
  constant training to equip internal auditors with professional and
  business knowledge as a means to enhance their competence. In addition
  to systematic knowledge management, the internal auditors are
  encouraged to attain major international audit certifications. The
  knowledge provided for auditors is specified as follows:

  2.2.1 Global IA knowledge

-   Exchanged and learned internal audit practices from multinational
    conglomerates and the world’s leading audit firms (Big 4) to compare
    SCG’s audit practices and those of leading corporations and use the
    results to streamline SCG’s audit work in line with the nature of
    SCG’s business.

-   Encouraged the internal auditors to develop and undergo both
    in-house and outside training continuously so they are equipped with
    knowledge, competence, and expertise in internal auditing as well as
    other skills needed at SCG.

-   Stimulated and supported the internal auditors to develop themselves
    to achieve major professional audit certifications or attain other
    related professional certifications.

  2.2.2 Business knowledge

-   Enhanced the internal auditors’ business acumen by inviting
    representatives of each business unit to share knowledge about the
    business and its major changes, enabling the auditors to assess
    risks and provide practical consultancy.

-   Set up a policy to recruit auditors by transferring employees with
    knowledge and expertise in operations from other departments and
    rotating out auditors to provide them opportunities to increase
    other areas of knowledge.

-   Organized activities to present and share interesting issues or
    material findings in audit work.

  2.2.3 IT knowledge

-   Developed a web application for collecting information on computer
    applications used by each business unit for using in planning IT
    audits and developing auditors’ skills and knowledge in line with
    the technology used for developing such computer applications.

-   Developed a web-based audit performance and satisfactory appraisal
    application for managing the information rapidly and systematically,
    enabling the enhancement of audit efficiency and effectiveness.

The Audit Committee’s Report

The Audit Committee performed its duties as assigned by the Board of
Directors in accordance with the Charter of the Audit Committee. These
duties included: reviewing the financial statements, good corporate
governance practices, assessment of risk management, internal controls,
internal audit systems and fraud investigations, as well as proposing
the appointment of external auditors for 2012. In 2011, the committee
held 8 meetings and its members’ attendance was 91%, near the previous
year’s record. The Committee’s performance of its duties is summarized
as follows:

1. Review of financial reporting system The Audit Committee reviewed
significant information for the Company’s quarterly and annual financial
statements for the year 2011 as well as consolidated financial
statements of the Siam Cement Public Company Limited and its
subsidiaries, all of which were prepared in accordance with the Thai
Financial Reporting Standards (TFRS) which complies with the
International Financial Reporting Standards (IFRS). The Committee
reviewed material items and special items. It received clarifications
and confirmation from the external auditors, the management, and the
director of the Audit Office that information in the financial
statements was compliant with laws and financial reporting standards and
that the notes to financial statements contained sufficient disclosure.
The Audit Committee thereby approved the financial statements, which the
auditor reviewed, audited, and issued an unqualified audit report.

In addition, the Committee held a meeting with the external auditors
without the presence of SCG management so as to freely discuss important
issues in the preparation of the financial statements and the disclosure
of information which were in accordance with the financial reporting
standards and were beneficial to users of these financial statements, as
well as to hear whether there was any suspicious information which
indicated potential fraud, in accordance with the section 89/25 of the
Securities and Exchange Act B.E. 2535 amended by the Securities and
Exchange Act (NO.4) B.E. 2551. In 2011, the auditor did not discover any
material misstatements or indications of suspicious incidents. Moreover,
to confirm that no such suspicious incidents were found, the Audit
Committee resolved to have the president report the results received
from all business units in the final meeting of 2011. The

president confirmed that no indications of suspicious incidents were
found, which corresponded to the confirmation of the external auditor.
Thus, the preparation of the financial statements and consolidated
financial statements was conducted with reliability, transparency, and
verifiability.

2. Review of corporate governance The Audit Committee reviewed the
compliance with the SCG Code of Conduct and SCG Corporate Governance
policy and found that the directors and employees have strictly followed
the prescribed principles. The Board of Directors constantly instilled
ethics and morals into employees at all levels, which resulted in SCG
receiving numerous important awards, as listed in the Annual Report’s
section on corporate governance. Additionally, SCG strictly reviewed its
practices to ensure compliance with the laws relating to securities and
stock exchange, regulations of the Stock Exchange of Thailand as well as
the laws relating to other businesses, especially in terms of connected
transactions and those that might result in conflict of interest. These
were disclosed to the Stock Exchange of Thailand in a timely manner.

The Audit Committee also conducted an annual assessment of the
performance of the collective membership (as a whole) and of each
individual member (self assessment). This assessment had a highly
satisfactory result similar to that of last year. The assessment covered
such matters as the Committee’s preparedness, financial reports, the
review of connected transactions, the information disclosure in other
reports, risk management and internal control, committee meetings and
the performance of the Audit Office and the secretary.

3. Review of assessment of risk management The Audit Committee reviewed
the assessment of risk management of all business units on a quarterly
basis according to the principles outlined in the Risk Management
Manual. Risks arose from significant changes in the regional and world
economies, from overseas investments and from business interruption.
Such factors as likelihood, impacts, and manageability levels were
assessed and supported by preventive measures for business units and SCG
overall. Criteria for distinguishing risk warning signals which are the
risks that approach a critical point have been established when the
Company spots a risk warning signal, it must take corrective measures.
The results of risk assessment showed that many countries including
Thailand have been affected by the world economic crisis, and that the
country faced its worst flood crisis in many decades. However, this
crisis had an only minimal impact on SCG’s business operations. SCG gave
considerable assistance to its staff and other people affected by flood
by providing donations and necessary items. This assistance was in line
with SCG’s policy and business principles that mandate doing business
with ethics and concern for social responsibility. One result of
demonstrating this commitment is that SCG has been classified in the
Gold Class level of the Dow Jones Sustainability Indexes (DJSI) for four
consecutive years, becoming the Sector Leader in 2011. The key risk
factors and management strategies of each business unit are described in
the Annual Report’s section on risk management.

4. Review of internal control system and internal audit The Audit
Committee reviewed the results of the internal control system assessment
that the Audit Office reported to the Committee on both a monthly and
quarterly basis. The results showed that these systems are appropriate
to the Company’s operations. This corresponds to the external auditor’s
opinion stating that there were no material deficiencies impacting the
Company’s financial statements. To enhance the efficiency of the
internal control systems, the Company has developed preventive audit
approaches and fraud prevention guidelines, implemented self-assessment
control for information technology, and developed continuous monitoring
and auditing systems.

As for the internal audit function, the Audit Committee has reviewed the
operations of the Audit Office according to the medium-term plan and the
annual plan, which have already been approved. This evaluation showed
that the target KPIs were achieved. On an annual basis, the Committee
has reviewed the appropriateness of such key points as the
organizational chart, the audit process, manpower, capital expenditure
and administrative expense budgets. In addition, the Committee oversaw
the implementation of sustainable and consistent value-added audit by
applying integration audit method; leveraged the knowledge and
competency of auditors, enhanced information technology audit systems
and developed audit practices in accordance with the International
Standards for the Professional Practice of Internal Auditing and
international internal audit practices.

5. Review of fraud investigations The Audit Committee reviewed the
result of fraud investigations on a monthly and quarterly basis. The
Committee also reviewed the preventive measures and fraud prevention
guidelines for each work-process, fraud audit based on risk assessment
and investigation protocols to ensure that they are up-to-date and
appropriate for business operations. In 2011, there were a total of 27
incidents reported through the Company’s whistleblower system, which
enables employees to report suspicious fraudulent behavior. Most
incidents were thoroughly investigated. Six of the total reported
incidents were found to be fraudulent but the losses were insignificant.
The cases were examined in order to improve preventive guidelines
onward.

6. Appointment of the external auditor and audit fee review for 2012
KPMG Phoomchai Audit Ltd. has been appointed as the external auditor of
SCG for the three-year period from 2012 through 2014 after consideration
of four candidates. Based on the satisfactory results of performance
appraisal and the review of auditor’s qualifications, the Audit
Committee recommended KPMG Phoomchai to the Board of Directors, and the
Board of Directors agreed to seek approval at the Shareholders’ Meeting
for the appointment of Mr. Supot Singhasaneh, Certified Public
Accountant Registration No. 2826; and/or Mr. Winid Silamongkol,
Certified Public Accountant Registration No. 3378; and/or Mr. Charoen
Phosamritlert, Certified Public Accountant Registration No. 4068; and/or
Ms. Sureerat Thongarunsang, Certified Public Accountant Registration No.
4409; all of KPMG Phoomchai Audit Ltd., as the Company’s auditors for
the year 2012. Likewise the Audit Committee recommended to the Board of
Directors, and the Board agreed, to seek approval of the Company’s audit
fee for the fiscal year 2012 amounting to 0.25 million Baht, and
acknowledgement of annual and quarterly audit fees for the Company
subsidiaries and consolidated financial statements amounting to 27.1
million Baht.

On behalf of the Audit Committee

  []

  Air Chief Marshal

  (Kamthon Sindhvananda)

  Chairman of the Audit Committee