4.10 Internal Control, Risk Management and Internal Audit

Internal Control System

The Company’s internal control system is an integral element of the Company’s governing system, focused to ensure reasonable guarantees that the goals below are achieved:

• Company’s efficiency and performance, including achievement of financial and operational indicators, soundness of assets;
• Company’s compliance with applicable laws and Company’s enactments, incl. Company’s operations and accounting;
• Provision of integrity and timeliness of financial and other reporting.

The internal control system is risk-oriented, its control procedures shaped by risks and set in a way to ensure reasonable guarantee of an efficient and timely response to risks. The ICSinternal control system covers all lines of Company’s operations, with all processes regularly controlled at all management levels, under the “three lines of defense” model:

• First line of defense: management bodies (sole and collegiate executive bodies) and units in charge of control procedures due to their duties;
• Second line of defense: Company’s control units;
• Third line of defense: internal audit unit.

The Company has set up the Internal Control and Risk Management Section, which, under the Internal Control Policy and the Regulations on the Structural Unit, is liable for:

• development and enforcement of fundamental documents related to the roll-out and improvement of the ICSinternal control system;
• assistance to Company’s management in building the ICSinternal control system of business processes, elaboration of recommendations on description and implementation of control procedures in the processes and assignment of responsibility to officials;
• development of recommendations regarding improvement of control procedures, separate components (elements) of internal control and internal control system following internal audit of the process;
• preparation of information on the ICSinternal control system status for stakeholders.

To enforce implementation and maintenance of the efficient internal control system, consistent with generally accepted practices and standards of internal control and requirements of regulators as well as promoting the Company’s goals the Company has adopted the Internal Control Policy^[68], that stipulates goals, operational principles and elements of the ICSinternal control system, primary functions and responsibilities of ICSinternal control system participants, ICSinternal control system efficiency assessment procedure.

The Company enforced the Procedure of implementation of the Internal Control Policy, disclosing practical aspects related to application of the norms, set by the Internal Control Policy^[69]. Control procedures on core and auxiliary processes and subprocesses as well as governance processes are stipulated by control and risk matrices. The Board of Directors has adopted the action plan to maintain efficiency and develop internal control and risk management systems^[70] (enforced by the decree^[71]). To guarantee the ICSinternal control system efficiency and compliance with changing requirements and conditions, the Company’s internal auditor evaluates the efficiency of the system (whether it complies with its target status and maturity level). The maturity level in 2022, in comparison to 2021, was assessed between “Optimal” and “High” (5.3 points in 2021 and 5.3 points in 2022).

During the reported period the Company has implemented the following key measures related to ICSinternal control system improvement:

• the Procedure of implementation of the Internal Control Policy was updated^[72].
• the Regulations on registration of external watchdogs’ inspections^[73].
• the Procedure of implementation of the Internal Control Policy was updated in terms of updates of checklists on self-evalution of control procedures and ICSinternal control system of processes/subprocesses^[74].
• control and risk matrices, integrated in regulatory documents on processes and subprocesses due to the enactment of new business process model, were upgraded.
• trainings for management and employees on the roll-out and functioning of the ICSinternal control system were conducted.
• annual anonymous survey to improve practices combating corruption and preventing corruption risks was arranged and conducted^[75].
• Integration of the existing system of anti-corruption compliance into the IC&RMS: participation in anti-corruption control of procurements; examination of regulatory documents in terms of compliance with internal control requirements.

In 2023, we plan to implement the following measures to improve the ICSinternal control system:

1. Revision of the regulatory documents on internal control.
2. Conduct of trainings for management and employees on the roll-out and functioning of the ICSinternal control system.
3. Improvement of the tool for the control of financial stability, legal support of contractors’ liquidation and bankruptcy.

Internal Audit

The Internal Audit Department is a unit, liable for internal audit. The Internal Audit Department is responsible to the Company’s Board of Directors (via the Audit Committee). This means that the Board of Directors oversees and administers the unit (namely, adoption of the unit’s action plan, progress report, its budget as well as assignment, dismissal and remuneration of the unit head). The goal of internal audit is to assist the Board of Directors and executive bodies of the Company in enhancing efficacy of governance and improving its financial and economic performance, by enforcing systematic and coherent approaches to analysis and evaluation of the systems of risk management, internal control and corporate governance as tools of reasonable assurance in Company’s goal achievement. Goals and objectives, principles of IA rollout and functioning, functions and authorities of the internal audit are stipulated by the Internal Audit Policy^[85]. In 2022, 8 employees performed internal audit functions.

The Company has adopted the following principal documents regulating internal audit performance:

• Internal Audit Policy and Internal Auditor Ethics Code^[85];
• Regulations on the OAOOpen Joint-Stock Company IDGCInterregional Distribution Grid Company of Urals Internal Audit Department^[86];
• Guarantee and Enhanced Quality of Internal Audit Program^[87];
• Internal audit standards and standards of practical application, developed in compliance with the International Professional Internal Audit Standards.

Pursuant to the Regulations on the Board of Directors’ Audit Committee^[53] arrangement, efficiency evaluation and enforcement of independency and neutrality of internal audit fall within the remit of the Board of Directors’ Audit Committee. The Audit Committee’s feedback is delivered to the head of the internal audit unit through the head’s interaction with the Committee, incl. analysis of resolutions/ recommendations of the Committee on matters falling under the competence of the internal audit unit and questionnaire survey of the Committee members. Satiation of the Audit Committee with the performance of the internal audit unit (average weighted total points from the questionnaires / quantity of votes of the Committee members) in 2022 corresponds with “full compliance” estimation value in line with the Guarantee and Enhanced Quality of Internal Audit Program.

Pursuant to the Guarantee and Enhanced Quality of Internal Audit Program, the quality of the Company’s internal audit is evaluated by independent external expert at least once in 5 years. External independent evaluation of the IA’s performance was carried out by AOJoint-Stock Company KPMG in 2019. After the evaluation, AOJoint-Stock Company KPMG presented a report, certifying general compliance of the Company’s internal audit performance with the International Professional Internal Audit Standards, Ethics Code, Internal Audit Policy, and issued recommendations regarding improvements of internal audit practices. Using feedback from the Audit Committee’s questionnaires regarding areas of improvement and recommendations from the external independent expert, the Company has prepared and enforces the action plan on the development and improvement of the Company’s internal audit performance^[88]. Pursuant to the action plan on the development and improvement of the Company’s internal audit performance we prepared the action plan on professional development of internal auditors for 2021-2024^[89].