4.10 Internal Control, Risk Management and Internal Audit
Internal Control and Risk Management System
The Company has the risk management and internal control system aimed at provisioning a reasonable assurance in achieving goals and strategy of the Rosseti Group’s development, incl. reliable, high-quality and easy-access electricity supply as well as operational goals of financial and economic operations. The RM&ICS develops and functions using unified principles that are accepted and complied with by management bodies and employees of the Company at all management levels: consistency and complexity; goal orientation; integration into management; methodological unity; reasonable assurance; agility; responsiveness; records creation; dynamism; quality of information; prioritization; responsibility; division of powers and liabilities; cross-functional interaction; constant improvement.
The primary documents regulating the RM&ICS are the Risk Management and Internal Control Policy[64], Arrangement of Risk Management and Internal Control Procedures[65] and Determination of Risk Appetite Procedures[66].
To guarantee the RM&ICS efficiency and compliance with changing requirements and conditions, the Company’s internal auditor evaluates the RMSrisk management system efficiency whether it complies with the target status and maturity level. The Board of Directors has adopted the action plan to develop the RM&IC system[67].
During the reported period, the Company implemented the following key measures to improve the RM&ICS:
- The Board of Directors has adopted the Risk Management and Internal Control Policy and updated the risk appetite.
- RM&ICS Methodology base has been developed / updated:
- RM&IC Glossary and Typical list of risks have been approved.
- The action plan on the risk culture has been approved.
- Process related to revision of matrices of risks and control procedures of business processes / lines of business has been arranged.
- Integration of the existing anti-corruption compliance system into the overall RM&IC system is in progress: participation in anti-corruption control of procurements; expertise of bylaws in terms of their compliance with internal control requirements.
- Trainings for C-level executives and employees on the roll-out and functioning of the RM&ICS have been conducted.
In 2024, we plan to implement the following measures to improve the RM&ICS:
- Improvement of the methodology on corruption risk management.
- Improvement of the mechanism for the control of financial stability, support of contractors’ liquidation and bankruptcy procedures.
- Development of the risk awareness culture, conduct of trainings on RM&ICS roll-out and functioning.
| Indicator | MU | 2021 | 2022 | 2023 | 2023/2022, % |
|---|---|---|---|---|---|
| Number of conducted control activities focused on risk exposure and mitigation | pcs | 455 | 302 | 410 | 35.8 % |
| Number of examined procurement-related materials (items) | pcs | 3,462 | 2,179 | 4,177 | 91.7 % |
| Number of eliminated violations following the inspections conducted by external watchdogs | pcs (%) | 74.6 | 86.0 | 72.4% | -13.6 % |
| Total sum of annulled fines after appeals against decisions to impose administrative sanctions | RUBruble million | 9.6 | 7.6 | 19.5 | 61.1 % |
| Total funds received by the Company from contractors under liquidation and bankruptcy procedures | RUBruble million | 18.985 | 200 | 144.465 | -27.77 % |
The Internal Audit Department is a unit, liable for internal audit. The Internal Audit Department is responsible to the Company’s Board of Directors (via the Audit Committee). This means that the Board of Directors oversees and administers the unit (namely, adoption of the unit’s action plan, progress report, its budget as well as assignment, dismissal and remuneration of the unit head).
The goal of internal audit is to assist the Board of Directors and executive bodies of the Company in enhancing efficacy of governance and improving its financial and economic performance, by enforcing systematic and coherent approaches to analysis and evaluation of the systems of risk management, internal control and corporate governance as tools of reasonable assurance in Company’s goal achievement. Goals and objectives, principles of IA rollout and functioning, functions and authorities of the internal audit are stipulated by the Internal Audit Policy[68]. In 2023, 8 employees performed internal audit functions.
The Company has adopted the following principal documents regulating internal audit performance:
- Internal Audit Policy and Internal Auditor Ethics Code[69];
- Regulations on the Internal Audit Department[70];
- Guarantee and Enhanced Quality of Internal Audit Program[71];
- Internal audit standards and standards of practical application, developed in compliance with the International Professional Internal Audit Standards.
Pursuant to the Regulations on the Board of Directors’ Audit Committee[52] arrangement, efficiency evaluation and enforcement of independency and neutrality of internal audit fall within the remit of the Board of Directors’ Audit Committee. The Audit Committee’s feedback is delivered to the head of the internal audit unit through the head’s interaction with the Committee, incl. analysis of resolutions/ recommendations of the Committee on matters falling under the competence of the internal audit unit and questionnaire survey of the Committee members. Satiation of the Audit Committee with the performance of the internal audit unit (average weighted total points from the questionnaires / quantity of votes of the Committee members) in 2023 corresponds with “full compliance” estimation value in line with the Guarantee and Enhanced Quality of Internal Audit Program.
Pursuant to the Guarantee and Enhanced Quality of Internal Audit Program, the quality of the Company’s internal audit is evaluated by independent external expert at least once in 5 years. External independent evaluation of the IA’s performance was carried out by AOJoint-Stock Company KPMG in 2019. After the evaluation, AOJoint-Stock Company KPMG presented a report, certifying general compliance of the Company’s internal audit performance with the International Professional Internal Audit Standards, Ethics Code, Internal Audit Policy, and issued recommendations regarding improvements of internal audit practices. Using feedback from the Audit Committee’s questionnaires regarding areas of improvement and recommendations from the external independent expert, the Company has prepared and enforces the action plan on the development and improvement of the Company’s internal audit performance[72]. Pursuant to the action plan on the development and improvement of the Company’s internal audit performance we prepared the action plan on professional development of internal auditors for 2021-2024[73].