Risk management rules

The Group’s enterprise risk management process is inspired by solutions based on best practices in risk management: ISO 31000, COSO II, FERMA, as well as the specific nature of the Group’s business.

Risk management is a continuous process and is subject to continuous improvements, covering both the organisation’s strategy as well as procedures for implementing this strategy. It methodically resolves issues related to threats to the organisation’s operations that took place in the past, are currently present and are the most likely to occur in the future.

The Group has a comprehensive enterprise risk management system consisting of a policy and procedure for enterprise risk management. These updated documents describe a systemic approach to risk, cover material risks that are applicable to the Group’s operations and meet the highest ERM standards, thus contributing to the Group’s reputation on the market. The ERM system is a tool supporting management processes, allowing a comprehensive approach to identifying, evaluating and managing risk.

The ERM system constitutes a set of rules concerning risks to the Company’s activities and covers:

Risk management is a continuous process that is subject to modifications resulting from the Group’s changing economic environment and changes concerning the impact of specific risks on the Group’s business objectives. It is carried out at every cell within the Company’s organisational structure and in all categories and areas of its operations, including: operational, strategic, financial, commercial, legal and regulatory.

Information on potential and changing threats to the Group is systematically reported to the Management Board, Audit Committee and Supervisory Board. Next, audit work is conducted, consisting of verifying and evaluating the effects of actions taken and introducing adjustments in the risk management process in order to increase its effectiveness.

A planned and cyclical approach to risk management results in identified key risks that have considerable potential impact on the Group’s operations, results or financial situation and can lead to a decline in value and share price. Given the above, there is a strong need for monitoring and periodically verifying the effectiveness of existing control and risk response mechanisms.