Explanatory Report of the Management Board of Demag Cranes AG, Düsseldorf, on the Disclosures under Section 289 (5) and Section 315 (2) 5 of the German Commercial Code (Main Features of the Internal Control System and of the Risk Management Systems in Relation to the Financial Reporting Process)

According to the explanatory memorandum to the German Accounting Law Modernisation Act (BilMoG), the internal control system encompasses the policies, processes and tasks that help ensure effective and efficient financial reporting, the quality of financial reporting and compliance with applicable law. This also includes the internal audit system to the extent that it relates to financial reporting.

The risk management system in relation to the financial reporting process encompasses, as part of and hence in the same way as the internal control system, financial reporting control and monitoring processes in particular with regard to items on the statement of financial position associated with the management of risk.

Main Features of the Internal Control System and of the Risk Management System in Relation to the Financial Reporting Process

The main features of the internal control and risk management system at Demag Cranes AG and in the Demag Crane Group in relation to the (Group) financial reporting process may be described as follows:

• The Demag Cranes Group has a clear organisational, corporate, control and monitoring structure.
• Coordinated Group-wide planning, reporting, financial control and early warning systems and processes ensure integrated analysis and management of earnings-related risk factors and going-concern risks.
• Functional responsibilities (e.g. accounting, financial control and internal audit) are clearly assigned for all parts of the financial reporting process.
• Accounting IT systems are secured against unauthorised access.
• Most finance systems in deployment are standard software.
• A suitable system of internal policies (including on Group-wide risk management and accounting) is in place and subject to ongoing refinement in line with developing needs.
• Departments involved in the financial reporting process meet quantitative and qualitative requirements.
• The completeness and accuracy of accounting data are regularly verified by sampling and plausibility checks performed both manually and by the software used. A risk controller for each segment supports the risk management process at segment level and checks the data for plausibility.
• Key processes related to financial reporting are subject to regular analysis. The Group-wide risk management system is continuously adapted in line with current developments and regularly tested for effectiveness.
• The dual control system is applied throughout in all processes related to financial reporting.
• Processes related to financial reporting are subject to scrutiny by the internal audit function.
• The Supervisory Board supervises matters including key aspects of financial reporting, risk management and the audit mandate together with its main points of focus.

Explanatory Notes on the Main Features of the Internal Control System and of the Risk Management System in Relation to the Financial Reporting Process

The internal control and risk management system in relation to the financial reporting process as set out above ensures that matters pertaining to the business are fully and accurately recognised, presented and measured in the accounts and so are included in external financial reporting.

The internal control and risk management system at Demag Cranes AG also ensures that financial reporting in the Demag Cranes Group is uniform and in compliance with legal and statutory requirements as well as internal corporate policies. The central tasks performed by Demag Cranes AG include consolidating the figures, checking differences between actual and budgeted amounts, assessing recognised goodwill for impairment and examining the accounts to determine whether these have been kept correctly, the Group-wide accounting and financial controlling policies have been observed and the financial data thus meet regulatory requirements. This ongoing process is assured through the preparation of monthly accounts, in which the final amounts are checked by various units for plausibility, completeness and variance from the monthly budget. In addition to the accounting and financial controlling functions, this involves operations managers and, in some cases, internal audit as required by the annual audit plan.

The purpose of the uniform Group risk management system, which fully meets the statutory requirements, is to identify risks in good time, assess them and communicate them appropriately. Report users are thus provided with accurate, relevant and reliable information. All Group member companies submit their financial data to Demag Cranes AG for consolidation in accordance with the uniform Group reporting calendar.

The effectiveness of the internal control system in relation to the financial reporting process is regularly reviewed by internal audit, which has access to all data and audits individual areas and Group member companies in detail using sampling methods. In doing so, it examines whether the internal control system was implemented in this context, i.e. whether transactions were checked, and whether the dual control system was applied in all areas, for example.

The uniform Group IT system incorporates authorisation procedures; if a subsidiary is audited by internal audit, these authorisation procedures and their implementation are also assessed. Automated controls and plausibility checks ensure the completeness and accuracy of data entries. In some cases, data are validated fully automatically and discrepancies highlighted.