
In 2024 the risk and control framework was reviewed by the
Management Board. Based on this review, the assessment of impact
and likelihood was adjusted in some instances. Some risks have
been rede ned to better re ect the actual risk. The completeness of
the identi ed risks was discussed with the Audit Committee.
Risk assessment and monitoring
NSI measures and assesses risks using tools including scenario
analysis models in which the impact of variables can be set. The
outcome of these models results in more awareness of the sensi-
tivity of our business model and strategy. In addition, budgets and
the periodically updated forecasts are based on the actual state of
affairs in order to generate scenarios containing the most up-to-
date information.
High-impact risks are risks that could have a material impact on
NSI’s income statement and / or the balance sheet, the company’s
nancing covenants or its reputation.
Low impact risks have a limited impact on the company’s results or
nancial position. Risks that have an average impact could have a
large enough impact to require an explanation should they occur,
although not large enough to have a material impact on results.
The likelihood of a risk occurring may be low but the possible
impact may be high, as may be the case in the event of a large
calamity. For this reason, NSI actively monitors risks that are less
and more likely to occur. NSI monitors the high-impact risks more
frequently. By monitoring throughout the year, NSI also assesses
whether the estimated impact of all identi ed risks is still in line
with the actual situation.
Risk management and control in 2024
In line with stabilising market conditions with, however, still lack of
liquidity in the market, the valuation of NSI’s properties was about
at par with 2023.
Balance sheet management is well installed. In January 2024, the
development project Laanderpoort, Amsterdam, was sold to ING.
Due to lower required funding, NSI terminated its secured loan
with BerlinHyp. The rst loan set to expire is now in January 2026,
the average loan maturity is 3.5 years at 31 December 2024.
At the end of 2024 NSI reported an LTV of 33.8% and an ICR of
5.1x, well within the covenants of respectively maximum 60.0% for
LTV and higher than 2.0x for ICR.
Internal audit
NSI appointed a third party to assist (co-sourcing) in ful lling the
internal audit function and engaged a specialized rm to do a scan
on Treasury. This is not in line with best practice provision 1.3.1 of
the Dutch Corporate Governance Code and a deliberate choice to
balance audit expertise, relatively low required hours for internal
audit activities, independence of the auditor to other activities at
NSI and cost ef ciency.
At the end of 2021, a new internal audit plan was drawn for the
period 2022 to 2024. The plan is based on a high-level risk assess-
ment of NSI’s primary and supporting processes. The risk factors
applied are based on qualitative factors like sensitivity to fraud,
manual input, nature of the process, possible impact and number
of transactions. This internal audit plan was discussed with and
approved by the Audit Committee. For 2025 – 2027, an overall internal
audit plan was also discussed and approved by the Audit Committee.
For key and / or high-risk processes, this was a full scope review,
aimed at the effectiveness of the design of the process as well as
the effectiveness of the control measures. For a full scope audit,
extensive testing of control measures and transactions took place.
For medium or low risk processes a limited scope review was done,
with a focus on reviewing the design of the control measures with
limited testing of these measures.
Based on the outcome, an action plan was made to make adjust-
ments or improvements to the internal control procedures.
Follow-up audits were performed on an annual basis to review
whether prior year management actions were indeed taken.
In 2024, the following processes were reviewed:
• Procurement to payment (full scope);
• Tax (limited scope);
• Governance and compliance (limited scope);
• Treasury (full scope / deepdive).
Overall, no signi cant ndings were found in the audit of the
design, implementation and operational effectiveness of the
internal controls of the respective processes. Furthermore, a review
of fraud risks in relation to the above-mentioned processes is also in
scope of these audits. Also, no signi cant ndings came out of this
review process.
A follow-up review on the ndings and recommendations of the
processes reviewed from 2021 to 2023 (and not being part of
review 2024) was also performed. The progress with respect to the
follow-up of the prior year audits was: 85% of the recommenda-
tions were completed, whereas 15% is still in progress. None of the
recommendations that are still pending are considered signi cant.
The results and ndings of the audits were discussed with the Audit
Committee, after which the outcome was shared with the external
auditor.
Fraud risk assessment
The management of fraud risks is an integral part of NSI's risk
management. In 2024, NSI has conducted a separate fraud risk anal-
ysis in order to assess whether potential fraud risks are adequately
mitigated or controlled within NSI's internal control environment, to
identify if there are any risks that are not (yet) adequately mitigated,
and if there are shortcomings for which additional measures should
be taken. Amongst others, for the fraud risk analysis, NSI used the
information as presented in the publication by IVBN ‘Beheersing van
frauderisico’s in de vastgoedsector’ (February 2018).
As part of the fraud risk analysis, NSI organised a brainstorm
session with all of its employees on the matter, leading to both
input for the fraud overview and heightened awareness amongst
the employees on acceptable behaviour. The fraud themes most
mentioned by our employees relate to misuse of the expense
policy, the procurement to pay process, possible theft of company
property and dealings with suppliers in the investments and asset
management process. No fully new topics were identi ed.
In the further fraud risk analysis, for each process / activity, the
potential fraud risks that could apply, and the control measures that
37 NSI Annual report 2024
Management board report Governance Financial statements Supplementary informationOther informationIntroduction