iten
Log in
iten
Log in
Internal Control and Risk Management
Internal Control and Risk Management

A fundamental element of the Governance system

Rai Way has adopted an Internal Control and Risk Management System (SCIGR) consisting of the set of organisational structures, corporate rules and regulations , designed to enable the company to be conduct in a healthy, fair, and coherent way, with predetermined objectives. This is achieved through a suitable identification, measurement, management, and monitoring process of the main risks, including those that may be significant from a sustainability perspective.


The ICRMS is integral to the organisational and corporate governance framework: it is a key element of our entire governance system and plays a central role in our company’s organisation.

The planning, implementation and maintenance of the ICRMS and the periodic assessment are based on the principles of the Corporate Governance Code and best practices. Rai Way is indeed inspired by the main internationally recognized reference frameworks, such as CoSO* Internal Control - Integrated Framework for the creation, analysis, and integrated assessment of SCIGR, and CoSO* ERM for the implementation of the Enterprise Risk Management System.

The implementation of an effective and efficient ICRMS promotes an informed decision- making process. It also contributes to ensuring the protection of corporate assets, the efficiency and effectiveness of corporate processes, the reliability of financial information, and compliance with laws and regulations, the Bylaws and internal rules. The corporate compliance models structured and organised in accordance with applicable statutory provisions, are also an integral part of the ICRMS.

* Committee of Sponsoring Organizations of the Treadway Commission



Bodies and functions involved with the ICRMS

The Internal Control and Risk Management System requires the involvement of various corporate bodies and company functions, which interact in certain ways, which have been predetermined to avoid overlaps and shortcomings as much as possible.


Board of Directors and Control, Risks and Sustainability Committee

The responsibility of the ICRMS falls to the Board of Directors. Following favourable advice provided by the Control, Risks and Sustainability Committee, the Board’s main task is to define the direction of the ICRMS, evaluating at least yearly the sufficiency of the company’s characteristics and its risk profile, as well as its efficiency and effectiveness.

Chief Executive Officer

The Managing Director bears the role of implementing and maintaining the ICRMS. The Managing Director, in this regard, is particularly responsible for:

  • curating the identification of the company’s main risks, taking into account the characteristics of Rai Way’s business, and periodically examining these risks with the Board;
  • determining the direction of the Board, curating the planning, implementation, and management of the ICRMS, as well as constantly verifying its sufficiency and efficiency;
  • curating the adjustment of the ICRMS to suit the company’s working conditions, as well as any legal context.

Board of Statutory Auditors

The Board of Auditors is responsible for the observation of the law and the statue/terms of reference, respecting the principles of fair administration, and the sufficiency of the organisational, administrative, and financial structure adopted by the company. It must verify that everything operates correctly. Among the Board of Auditors’ responsibilities, they must also evaluate the efficiency, thoroughness, sufficiency, functionality, and reliability of the ICRMS.

Manager of Audit Functions

The Manager of Audit Functions, in particular, bears the responsibility of verifying – both continually and related to specific needs – the operation and suitability of the ICRMS using an audit plan approved by the Board of Directors, and based upon a process structured on the analysis and prioritisation of the main risks.


Internal Audit Department

The Internal Audit Functions must carry out an independent and objective ‘assurance’ and consultancy , designed to promote improvement in the efficiency and effectiveness of the ICRMS, as well as the organisation of the company. The Internal Audit Functions must also assist in the organisation of the company itself, and in ensuring objectives are followed using a professional and systematic approach. This will allow the evaluation and improvement of audit systems, risk management, and corporate governance.

Manager in Charge

The Manager in Charge of drafting corporate accounting documents is also responsible particularly for preparing suitable administrative and financial procedures for the compilation of the financial statements, the consolidated financial statements (where prepared), the Sustainability Report and any other financial communications – particularly quarterly and biannual. They are also responsible for the preparation of these documents.



Three levels of Internal Auditing

Our ICRMS is divided into three levels of internal control, each characterised by a different degree of operational involvement in risk management.

FIRST LEVEL

Identifies, assesses, manages and monitors risks under its authority to then identify and implement specific actions to deal with them;


The first level of control is the management of the company

SECOND LEVEL
  • Monitors the effective management of risks by the first level, in order to ensure the effectiveness and efficiency of risk treatment
  • Monitors the adequacy and effectiveness of the controls put in place to monitor the main risks
  • Provides support to the first level in the definition and implementation of appropriate management systems for the main risks and related controls.


The second auditing level is represented by the management whose role involves monitoring functions, such as managing control and Risk Management and Compliance.

THIRD LEVEL

Provides independent and objective assurance on the adequacy and operational effectiveness of first and second level controls and the entire ICRMS as a whole.


The third level of control is represented by the Internal Audit Function.


The level controls structure is consistent with the size, complexity, specific risk profile and the regulatory framework within which Rai Way operates.



The structure of the first and second auditing levels is coherent with the size, complexity, risk profile, and regulatory context in which Rai Way operates