Risk Management and Internal Control
The “CAEPCO” JSC Group of Companies operates a corporate risk management system (RMS) and an internal control system (ICS). They help to identify in good time, and to manage, events that could hinder reliable operation and the achievement of the Group's objectives. Both systems are built on the COSO and ISO 31000 international standards and cover all subsidiaries and all levels of management.
Purpose of risk management
The Risk Management Policy, approved by the Board of Directors of “CAEPCO” JSC and implemented across the Group of Companies, defines the Group's attitude to risk and sets out the general principles on which the RMS is built and operates, its goals and objectives, and the main approaches to organising, implementing and controlling risk management processes.
The Group's main objectives in risk management are to identify, assess and reduce in good time the negative impact of events (risks) that threaten the effective conduct of business and the reputation of the Group of Companies, the health of employees, the environment and the property interests of shareholders and investors, and to realise favourable opportunities that ensure sustainable, uninterrupted operation and development and give reasonable assurance that the Group's strategic and operational objectives will be achieved.
Principles
To manage risks effectively, the Group of Companies seeks to follow these principles at every level:
Risk management process
The principles are put into practice through a continuous risk management process that covers the entire Group of Companies and has four stages:
- 01Stage 1
Risk identification
Detecting risks and entering them in the corporate Risk Register for further assessment and management. Appointing risk owners.
- 02Stage 2
Risk analysis and assessment
Determining how critical a risk's impact is on the Group's operational, financial and economic performance.
- 03Stage 3
Risk treatment
Identifying, assessing and choosing the most effective way to achieve objectives by maximising positive and minimising negative events that affect the Group's operations.
- 04Stage 4
Risk monitoring
Monitoring the Risk Management Action Plan (the regularity, timeliness, and quality of the implementation of activities).
Risk appetite
Decisions at the risk assessment and treatment stages take risk appetite into account: risk management measures must bring risks in line with a level acceptable to the Group of Companies.
Risk appetite is the maximum level of risk that the Group of Companies considers acceptable and seeks to maintain while pursuing its objectives. It is an additional management tool that sets the boundaries for operating, financial and investment activities at an acceptable level of risk; staying within them gives reasonable assurance that the Group's strategic objectives will be achieved.
- Definition / reviewapproved by the Board of Directors
- Formalisation and communicationNotifying employees
- Monitoringchecked against current business conditions
Risk appetite statements by risk group
Extracts from the Risk Appetite Statement of the “CAEPCO” JSC Group of Companies, approved by decision of the Board of Directors
Regulatory framework
The Group's approach to risk management is set out in its internal documents, which are based on international standards:
International
COSO — Committee of Sponsoring Organizations of the Treadway Commission
- “Enterprise Risk Management — Integrating with Strategy and Performance”
- “Developing Key Risk Indicators to Strengthen Enterprise Risk Management”
- “Understanding and Communicating Risk Appetite”
ISO — International Organization for Standardization
- ISO 31000:2018 “Risk management — Guidelines”
Corporate
- Risk Management Policy of the Group of Companies
- Methodology for Organising the Risk Management System in the Group of Companies
- Methodology for Determining and Monitoring Risk Appetite in the Group of Companies
- Regulations on Interaction between Units on the Risk Management System in the Group of Companies
Internal control system
The Group of Companies has implemented an internal control system (ICS): a set of policies, processes, procedures, standards of conduct and actions combined into a single continuous process. The ICS is part of the governance of the Group of Companies exercised by the Board of Directors, the Management Board, all executive bodies of the subsidiaries, the control bodies and employees.
The Group of Companies seeks to ensure that all its activities are adequately controlled in order to reduce risks. Control procedures are in place at every level of management.
Areas of internal control
The ICS provides reasonable assurance that the Group's objectives are achieved in four areas:
Operational control
Applies to the Group's core business objectives, including productivity and profitability
Financial control
Covers the preparation of reliable financial statements, including interim and condensed financial reports
Compliance control
Ensures compliance with the laws and regulations that govern the organisation's activities
Safeguarding of assets
Aims to safeguard the Group's assets and to prevent fraud and unlawful acts
Control environment
The control environment is the core element of the ICS.
Management at every level creates an effective control environment by:
- making employees of the Group of Companies understand why internal control procedures are needed and follow them;
- maintaining a strong corporate culture and demonstrating integrity and competence;
- raising the professionalism and competence of the Group's employees;
- ensuring effective interaction between business units and employees;
- ensuring an effective allocation of authority and responsibility;
- building mechanisms to prevent fraud;
- organising the work of the internal control bodies.
Regulatory framework
The Group's approach to internal control is set out in its internal documents, which are based on an international standard:
International
COSO — Committee of Sponsoring Organizations of the Treadway Commission
- “Internal Control — Integrated Framework”
Corporate
- Internal Control System Policy of the Group of Companies
- Regulations on Interaction between Units of the Group of Companies on the Internal Control System
- Methodology for Organising the Internal Control System in the Group of Companies
Participants and responsibilities
Risk management and internal control in the “CAEPCO” JSC Group of Companies are a shared task of the governing bodies and of employees at every level. How responsibility is divided between the participants and how they interact is set out in internal documents approved by the Board of Directors. The Board of Directors oversees the system through the Audit Committee, to which the Risk Management Department and the Internal Audit Department report functionally.