Huawei continued to design and implement an internal control system based on its organizational structure and operating model. The internal control framework and its management system apply to all business and financial processes of the company and its subsidiaries and business units. The internal control system is based on the five components of the COSO framework: Control Environment, Risk Assessment, Control Activities, Information & Communication, and Monitoring. It also covers internal controls of financial statements to ensure their truthfulness, integrity, and accuracy.
A control environment is the foundation of an internal control system. Huawei is committed to a corporate culture of integrity, business ethics, and compliance with laws and regulations. Huawei has issued the Business Conduct Guidelines (BCGs) to identify acceptable business conduct. The BCGs must be observed by all employees, including senior executives. Regular training programs are offered, and all employees are requested to sign the BCGs to ensure that the BCGs have been read, understood, and observed.
Huawei has implemented a mature governance structure, with clearly defined authorization and accountability mechanisms. The governance structure comprises the Board of Directors (BOD), its committees, group functions, and multi-level management teams. Huawei clearly defines the roles and responsibilities of its organizations to ensure the effective separation of authority and responsibilities as well as checks and balances through mutual oversight. The CFO of Huawei is in charge of internal controls. The business control department reports to the CFO for any possible defects and improvements already made in terms of internal controls, and assists the CFO in building the internal control environment. The internal audit department independently monitors and assesses the status of internal controls for all business operations.
Huawei has a department dedicated to internal controls and risk management to regularly assess risks to the company's global business processes. This department identifies, manages, and monitors significant risks, forecasts potential risks caused by changes to the internal and external environments, and submits risk management strategies along with risk mitigation measures for decision making. All process owners are responsible for identifying, assessing, and managing business risks and taking necessary internal control measures. Huawei has instituted a mechanism for improving internal controls and risk controls to efficiently manage critical risks.
Huawei has established the Global Process Management System and the Business Transformation Management System, released the global Business Process Architecture (BPA), and appointed Global Process Owners (GPOs) in line with the BPA.
Responsible for building processes and internal controls, GPOs:
Huawei has developed multi-dimensional information and communication channels to ensure the timely acquisition of external information from customers, suppliers, and other parties. It has also created formal channels for transferring internal information, and offered an online space, the Xinsheng Community, for employees to freely communicate their thoughts and ideas. Corporate management holds regular meetings with departments at all levels to effectively communicate management orientation to employees and ensure effective implementation of management decisions. All business policies and processes are available on the company's Intranet.
Managers and process owners regularly organize training programs on business processes and internal controls to ensure that up-to-date information is made available to all employees. The company has established a mechanism for process owners at all levels to regularly communicate with each other, review the execution of internal controls, follow up on internal control issues, and implement improvement plans.
Huawei has established an internal complaint channel, an investigation mechanism, an anti-corruption mechanism, and an accountability system. The Agreement on Honesty and Integrity that Huawei has signed with its suppliers clearly stipulates that suppliers may report improper conduct by Huawei employees through the channels stipulated in the Agreement to assist the company in monitoring the integrity of its employees. The internal audit department independently assesses the overall status of the company's internal controls, investigates any suspected violations of the BCGs, and reports the audit and investigation results to the AC and senior management. Huawei has also implemented a mechanism for internal control appraisals of GPOs and regional managers, holding them accountable and pursuing impeachment when and where necessary. The AC and the CFO regularly review the company's internal control status, and listen to and review reports on action plans for improving internal controls and plan execution progress. Both have the authority to request the relevant GPOs or business executives to explain their internal control issues and take corrective actions.