Risk Management and Internal Control

Internal control focuses on achieving operational objectives, ensuring the reliability of reporting and compliance with the legislation and internal requirements of the Fund and its Portfolio Companies.

The objectives of the Corporate Risk Management and Internal Control System are as follows:

• Strengthening the risk culture and integrating risk management and internal control into all aspects of the Fund's activities.
• Reducing volatility of results by improving the Fund's ability to prevent adverse situations, respond effectively to adverse events and minimise their impact to an acceptable level.
• Ensuring that opportunities are seized to increase the value of the Fund's assets and profitability over the long term.

The main principles and approaches to the organisation of risk management and internal control in the Fund Group are reflected in the Fund's Policy on Risk Management and Internal Control. This Policy has been drawn up taking into account the recommendations of COSO, COSO Enterprise Risk Management – Integrating with Strategy and Performance and is designed to strengthen the responsibility of risk owners for risk management at all levels of the Fund, increase the integration of risk management into all processes of the Fund.

According to the Policy, the Board of Directors and the Management Board of the Fund in the performance of their functions are based on the "Three Lines of Defence" model, where the first line of defence (business functions) is represented by structural units represented by each employee who, within their competence, directly identify, manage risks and perform control procedures. The second line of defence (monitoring functions) is represented, among others, by the Risk Management and Internal Control Department and the Compliance Service of the Fund, which are responsible for monitoring the implementation by structural units of effective risk management and internal control practices, compliance with the legislation and internal regulatory documents of the Fund. The third line (independent assurance) includes the Internal Audit Service, which provides an independent assessment of the effectiveness of the risk management and internal control system.

The Fund and portfolio companies annually approve the risk appetite, risk register and risk map, and regularly submit the Report on Significant Risks to the Board of Directors for consideration.

A corporate reinsurance programme under the administration of the Fund's captive is being implemented, which is aimed at comprehensive organisation of reinsurance protection of risks of the Fund's companies.

Work continues to improve the internal control system, including documentation of control procedures in the Fund's internal regulatory documents.

THE NON-EXHAUSTIVE LIST OF RISKS OF THE FUND AND THE PORTFOLIO COMPANIES IS AS FOLLOWS

Strategic Risks:

The risks of significant investment projects range from internal to external, including classic project risks such as delays and increased capital expenditure, as well as external factors such as inflation, currency fluctuations and logistical challenges. The process of risk identification and minimisation is carried out on a regular basis and measures to minimise risks are developed.

Reputational damage risk includes potential negative perception of the Fund and Portfolio Companies by various stakeholders. This risk is managed through the development and maintenance of the overall image and communication policy, as well as compliance with the legislative and ethical standards of behaviour of the Fund and Portfolio Companies.

Financial Risks:

Liquidity and covenant/listing risks. These arise when a company is unable to finance its operations and meet its obligations. Management of these risks includes setting and monitoring debt limits and various measures to improve financial stability.

Operational Risks:

Social instability risk is a risk associated with social tension of various groups of employees of the Fund and Portfolio Companies. To monitor the state of social stability risk, the Centre for Social Interaction and Communications analyses the level of social stability in the Fund Group's workforce on an annual basis. In order to monitor and regulate social and employee relations , the complaints and appeals of the Fund Group's employees are also monitored. The Fund, together with Portfolio Companies, republican and local authorities, works out systemic measures to improve the welfare of employees and resolve emerging issues.

The risk of accidents is one of the key risks for the Fund's production Portfolio Companies. The Plan of Measures on Industrial Safety for 2024 was approved, consisting of 33 specific measures in 4 areas: People, Equipment, Prevention of Emergencies, Outreach and Information and Advocacy.

In January 2024, a list of critical risks that may lead to accidents (emergencies), accidents with two or more victims, loss of life, as well as significant environmental pollution was formed. An instruction was given on the need to adopt appropriate systematic measures to prevent accidents and incidents.

Cybersecurity risks, cyberattacks – a risk associated with the possibility of cyberattacks, system hacks, data breaches or other information security incidents. In order to mitigate cybersecurity risks and cyberattacks, measures are taken at three management levels: at the level of the Fund, strategic initiatives are developed to create a long-term policy and ensure proper control; at the level of Portfolio Companies, centralised data protection and information security processes are implemented; at the level of subsidiaries and affiliates, operational response and control over the state of security at the local level is carried out.