The Supervisory Board of Pelion S.A. (Audit Committee)

supervises the enterprise risk management process. It assesses the risk management system for completeness in terms of policies and procedures related to supervision, risk aggregation and quantification, reporting and monitoring.

The Management Board of Pelion S.A.

is responsible for enterprise risk management, including supervision and monitoring of measures taken, as well as effective risk response and transparent reporting lines.

The enterprise risk management process at Pelion provides for three mutually independent lines of defence:

The first line of defence

supported by risk owners (at operating units) through risk management at a level of the operating unit or process, following the defined procedures of risk management, risk identification and assessment, as well as risk response. The first line of defence involves the internal functional control function, ensuring that risk control activities are applied and legal regulations are complied with.

The second line of defence

supported, in line with a model, by risk management process owners (the Risk Committee, Risk Management Officer, as well as owners of the compliance, quality assurance, information security, physical security, controlling, monitoring and debt collection processes) through development and updating of risk management procedures, ensuring risk management consistency with Pelion's strategy, assistance to risk owners and coordination of their actions (support in designing and developing risk control and management processes), identification of trends in synergies and opportunities, and serving as a liaison between the first and third lines of defence. The second line of defence, currently being developed, is intended to form the risk management system, including methods, tools, process and organisation.

The third line of defence

supported by the Internal Audit department through monitoring of risk management and independent assessment of the risk management adequacy.

Risk identification consists in indicating such events that will affect the implementation of the strategy and achievement of objectives. In identifying risk, management considers internal and external factors, potential risks or opportunities, in the context of the entire organisation. Risk factors are identified at the Management Board level of the Pelion companies.

Risk assessment allows the organisation to analyse to what extent potential events may affect the achievement of objectives. In the first stage of assessment, the Management Boards of the Pelion companies analyse risk factors through the lens of inherent risk. Once responses to risk are defined, management analyses residual risk. Individual events should be analysed for their impact on:

• finance,
• reputation,
• health, life and safety
• environment.

All information on identified risks is aggregated and classified by business area, risk category, source, materiality and other criteria. In this way, the risk profile for the entire area of Pelion's business is determined.

In 2016, 62 processes were audited in the execution of 17 audit tasks at different Pelion family companies. The auditors issued 71 post-audit recommendations, upon which the companies developed appropriate remediation plans.

(for more information on the subject, refer to the Directors' Report o the operations of the Pelion Group in 2016, sections ‘Risk factors and threats’ and ‘Statement of compliance with corporate governance principles’).