Within the Enterprise Risk Management system, Rai Way pays particular attention to managing risks and opportunities, alongside ensuring regulatory and ethical compliance.
An integrated approach to risk management
Rai Way has adopted a Risk Management & Compliance model to promote a culture of risk management—understood both as the control of threats and the enhancement of opportunities. The system makes it possible to identify, assess and prioritise enterprise risks, define appropriate response actions, and support management in strategic decision-making.
The Risk Management & Compliance function, which reports directly to the Chief Executive Officer (CEO), ensures coordinated and cross-functional management of risks and compliance, working in synergy with risk owners and with the other control bodies within the Internal Control and Risk Management System (ICRMS).
Risks are compiled in a corporate risk register and monitored over time to track their evolution.
Risk Management & Compliance: our approach
Enterprise Risks
Rai Way adopts a Risk Management model that covers all categories of risk relevant to the Company.
Enterprise risks include strategic, operational, financial, regulatory and ESG aspects that may affect the achievement of the Industrial Plan’s objectives and influence the Company’s main value drivers. Their analysis is carried out by risk owners, in collaboration with the Risk Management & Compliance function, to assess likelihood and impact and define appropriate response strategies.
Opportunities
Within the Risk Management & Compliance model, risk is also viewed as a lever for opportunity. Identifying market trends, technological innovations and new customer needs means anticipating change and directing investment towards areas with high growth and sustainability potential. Valuing opportunities strengthens corporate resilience and contributes to value creation for stakeholders.
Project risks
Company projects are an integral part of the RMC model: on the one hand they mitigate enterprise risks, and on the other they enable new development opportunities. Each project, however, carries specific risks that may affect expected outcomes. Managing these risks—embedded in the project management process—ensures alignment with strategic priorities, efficient use of resources, and an appropriate balance between risks, benefits and objectives.
Compliance
Rai Way ensures regulatory compliance, by monitoring risks of non-compliance and adopting ethical and responsible behaviour.
Compliance Governance operates on multiple levels: the Compliance Officer coordinates and oversees activities, supported by first- and second-line business functions and by Internal Audit. The scope covers both mandatory requirements (corporate, tax, privacy, safety, anti-corruption, Italian Legislative Decree 231/2001) and voluntary commitments (ISO certifications, ESG and sustainability standards).
Using dedicated tools Rai Way ensures traceability and completeness in managing requirements, monitoring the evolution of non-compliance risks. This approach protects reputation, strengthens stakeholder trust and ensures business continuity in line with legality, transparency and responsibility.

