Introduction Background Enclosed are the instructions of Friesland Campina's Internal Control Framework (ICF). These instructions cover the most important procedures, responsibilities. timing and other relevant aspects relating to the ICF in 2014. These instructions are issued by the Internal Control Competence Centre (ICC Centre), which falls under the responsibility of Enterprise Risk Management (ERM). Important Notice Please make sure that these instructions are distributed to all employees in your organization involved in the ICF process and that they are fully understood and followed. Questions In case of questions about the content of these instructions, please do not hesitate to contact the IC C Cemre (I C FCorp@ FrieslandCampina.com) or your Business Group Risk s Control Manager. 1. Internal Control Framework FrieslandCampina's Internal Control Framework (ICF) is important to ensure ourselves and key stakeholders that relevant and effective controls in business processes are in place. Friesland Camping ICF stands for Internal Control Framework. Internal controls are the measures put in place by FrieslandCampina, to ensure its objectives are achieved. The objective of the ICF is to ensure ourselves and key stakeholders that relevant and effective controls in business processes are in place, so that the following risks remain within the agreed defined materiality or risk appetite: Losses in money and goods flows: financial loss resulting from a physical loss, obsolescence or misuse of assets (including products, materials and money), or from a change in value of assets or liabilities. Missing opportunities is not regarded as a financial loss Financial reporting risks: Risk of unintentional errors or omissions leading to incomplete, inaccurate and/or untimely reporting of legally required financial information to regulatory agencies Fraud: An intentional act of a person(s) employed or contracted, aimed at obtaining illegal personal or company gains or aimed at deceiving financial statement users through the misstatement of information, either by falsifying, omitting, adding or removing data. Breach of external (financial) laws or regulations: Failure to comply with external (financial) laws or regulations, which may result in a financial or business sanction or in a loss of reputation. Breach of authorization policies: Failure to comply with authorization policies, which may result in undesirable business transactions which are not being authorized in line with company policy. AThe risk appetite as mentioned on the previous page is the level of risk that Friesland Campina is prepared to accept. FrieslandCampina's risk appetite for each organizational level is presented below: Losses in Financial reporting risk Breach of money/ Misstatements Breach of Fraud authorization goods flows laws and policies in reporting regulations Business 2 6 5 million P&L impact 2 Significant loss Petty cash 2 6 2 ( 250.000 Group or 5% of 5% of actual of reputation 0 Other frauds EBIT loss budgeted EBIT E 10.000 EBIT* Or Equity impact 25% Operating 2 6 1,0 million P&L impact > 2 E 25.000 Petty cash 2 6 2 E 100.000 Company or 5% of 5% of actual penalty or 0 Other frauds EBIT loss budgeted EBIT significant loss > December, January, February, March March April May W1 W2 W3 W4 SoD reporting date Feb 28 BG SoD-reporting to ERM, Can-do March 31 ICF Reporting date, March 31 ICF Entity reporting (including follow-up on action plans) to BG's," Including support by ICC (deadline t.b.d. locally) ICF BG reporting to ERM, including support ICC for CPA and CBS) Apr 11 FrieslandCamping sie ICC Reporting calendar HY 2014 ICF reporting period -> April, May, June June July August W1 W2 W3 W4 SoD reporting date May 31 ICF reporting date June 30 ICF Entity reporting (including exceptions analysis and follow-up on action plans) to BG's, including support by ICC (deadline t.b.d locally) ICF BG reporting to ERM, including support ICC for CPA and CBS July 11 OpCo / BG Reporting of LOR and ICF Statement on Internal Control to ERM Jul 18 BG SoD-reporting to ERM, Can-do Jul 18 BG SoD-reporting to ERM, Did-do Jul 18 FrieslandCamping air ICC Reporting calendar Q3 2014 ICF reporting period -> July, August and September September October November AW1 W2 W3 W4 SoD reporting date Aug 31 BG SoD-reporting to ERM, Can-do Sep 30 ICF Reporting date, Sep 30; ICF Entity reporting (including follow-up on action plans) to BG's! including support by ICC (deadline) t.b.d. locally) ICF BG reporting to ERM, including support ICC for CPA and CBS) Oct 10, 104. ICF 3.0 In the course of 2013, the ICF 3.0 project was initiated. One of the main reasons for initiating this project was to align and embed the ICF with the standard Summit processes. Camping 4.1 Introduction 4.3 Implications for 2014 - OpCo's In the course of 2013, the ICF 3.0 project was During 2014, the following entities are initiated. The main reason for initiating this scheduled to implement ICF 3.0: project was to align the ICF with the standard Summit processes. The most significant Entities scheduled to implement changes of ICF 3.0 compared to the current ICF Summit in 2014; are Entities which have implemented ICF will be fully aligned with Summit prior to 2014 (retrofits). Summit processes; ICF 3.0 will make use of Currently the ICF 3.0 set is being finalized. The ICC Centre is in close contact with all the above standardized control- and entities regarding the timelines and procedures assessment designs. This will regarding the implementation of ICF 3.0. In imply that all entities will 2014, none of the other entities are required to implement similar control- and implement ICF 3.0. For these entities, the assessment designs; current set of controls will remain applicable. Selection method of controls which need to be implemented will be process-based. This implies that all controls for processes in place will have to be implemented mandatory. ICF 3.0 will make more use of automated controls. 4.2 Implications for 2014 - Corporate Departments Corporate Departments will implement the ICF 3.0 controls relevant for their departments in Q1, 2014. With each Corporate Department, specific meetings have been / will be set-up in which the implementation of the ICF 3.0 controls will be discussed. 115. Roles and Responsibilities Everyone in Friesland Campina has responsibility for internal control to some extent. In the overview below the ICF organizational structure is presented, which includes the roles and responsibilities regarding the ICF within FrieslandCampina. nestandCampina tie The ICF Organizational Structure EB Executive Board Ensure an adequately functioning risk management- and internal control system. Provision of management statement Internal Audit Third Line of Defense IA Independent review of the internal control effectiveness. Providing positive assurance (depending on review outcome). Internal Control Competence Center (ICC) Develop, maintain and communicate the ICF. Maintain and support the ICF tool (currently i CAT). Develop ICbest practices and standards. ICC Monitoring and reporting on ICF progress and outcomes of the follow-up of action plans, relating to IC gaps and SoD conflicts. Second Line of Defense Group Managing director and Financial Director Provision of management statement Business Group Risk & Control Manager BG Coordination of ICprocess, improvements and training at OpCo's. Communication in BG's, firstpoint of contactfor OpCo's. . Monitoring progress/status, quality, compliance and action plans (incl. SoD). Exchange of best practices wihtin and outside BG. Managing Director and Financial Director Provision of management statement First Line of Defense OpCo OpCo ICF coordinator Coordination of ICprocess and improvements at OpCo's. Communication in OpCo, firstcontact of BG R&Cmanager. Monitoring progress/status, compliance and action plans. First line support ControlAssessors and Control Owners. Control assessor Entity Self- assessmentexecution and documentation at the OpCo. Preparing and documenting action plans with Control owners. Control owner cution a 126. ICF Tooling The ICF is supported by iCAT (Internal Control Assessment Tool). iCAT is a software tool especially designed for FrieslandCampina to facilitate management in managing their internal controls, based on the FrieslandCam pina Internal Control Framework, and supports documenting the results of self-assessments. 6.1 iCAT The Internal Control Framework is supported by iCAT. In iCAT the local control- and assessment designs are approved and made available for all users. The self-assessment results and supporting evidence need to be uploaded in iCAT by the self-assessor. After completion all documentation is available for review and sharing. 6.2 Roles in iCAT In iCAT several roles are designed to support the Internal Control Process, namely Control Owner, Control Assessor, Reviewer, Reader, Internal (CIA) and Extemal (extemal auditors). For the Self assessment design in iCAT following roles are relevant: (1) The Control owner is responsible for performing the control activity; (2) The Control Assessor is responsible for checking the existence and proper working of the internal controls by performing self- assessments and documenting these in iCAT. For every control in iCAT. a Control Owner and a Control Assessor need to be assigned. 6.3 Reports in iCAT In iCAT several reports are available to support the monitoring of the Internal Control Framework, namely: . Action Plans: an overview of all action plans prepared per iCAT database; . My Outstanding Tasks: an overview of all unoompleted activities assigned to the user in iCAT; . Design Form Status: a list stating per database which controls are in the approved. evaluate or edit status as well as which employees are assigned as Control Owner and Self assessor to these controls; . Assessment Status: provides a summarized overview of the conclusion of the performed self-assessments: . Design Form Detail: gives the total number of controls in approved. edit and evaluate status; 13 50 Control and Self Assessment design status: 20 EURO gives an overview of the complete control- and self-assessment design details for the selected controls. This report is most useful when exporting to Excel for further editing; User rights: shows the users who have access to the database as well as their roles; Overview control and self-assessment designs: gives the totals for all databases, the number of controls in approved, edit and evaluate status; Examples control and self-assessment designs: report which allows users to view examples of control and self- assessment designs for all databases the user is assigned to 6.4 iCAT helpdesk The ICC Centre provides support to iCAT users. In case of iCAT related questions or technical problems, users can contact the iCAT helpdesk by sending an e-mail to: ICAT@frieslandcampina.com. In order to be able to answer all questions as efficient and effective as possible, users are requested to address all questions to the iCAT helpdesk, and not to individual ICC Centre team members. The iCAT helpdesk will assist users in for instance the following circumstances: Granting, changing or removing access rights; Releasing approved controls; Un completing self-assessments; Closing action plans; All sorts of technical issues regarding iCAT. The iCAT helpdesk will try to reply on all e-mails within 5 working days (during reporting periods the iCAT helpdesk will try to reply within 2 working days). R S K 147. Useful information A lot of information (manuals, templates etc.) is available for executing the different steps in ICF. In this chapter an overview of the available information is presented. Available information The following ICF related information can be found on the Intranet site of the ERM department (http://our.frieslandcampina.biz / disciplines / Enterprise Risk Management): . Corporate Manual . ICF Manual 2014 . ICF 2.0 Roadmaps . ICF reporting template and ICF consolidation template . iCAT Manuals (control owner, control assessor, reviewer and reporting) Self-assessment training . Self-assessment template (to be used for documenting assessments) Self-assessment review guidelines and template (to be used for quality review of assessments) . Frequently asked questions Contact Should you have any further questions, please contact: ICC Centre: ICF Corp@Frieslandcampina.com iCAT helpdesk: iCAT@frieslandcampina.com or contact your BG Risk & Control Manager or Local ICF Coordinator 15