Risk Management and Compliance
Risk Management and Compliance

An integrated approach to risk management

Rai Way has adopted a Risk Management & Compliance model to promote a culture of risk management—understood both as the control of threats and the enhancement of opportunities. The system makes it possible to identify, assess and prioritise enterprise risks, define appropriate response actions, and support management in strategic decision-making.



The governance model is:
Business-oriented

For informed decisions based on relevant information

Enterprise-wide

Covering all types of risks and opportunities

Value-driven

Focusing on the greatest impacts on strategic objectives



The Risk Management & Compliance function, which reports directly to the Chief Executive Officer (CEO), ensures coordinated and cross-functional management of risks and compliance, working in synergy with risk owners and with the other control bodies within the Internal Control and Risk Management System (ICRMS).

Risks are compiled in a corporate risk register and monitored over time to track their evolution.



Rai Way pays particular attention to:
Strategic risks

Linked to business objectives

Operational Risks

Related to asset management

ESG Risks

Including those arising from climate change



Risk Management & Compliance: our approach

Within the Enterprise Risk Management system, Rai Way pays particular attention to managing risks and opportunities, alongside ensuring regulatory and ethical compliance.

Enterprise Risks

Rai Way adopts a Risk Management model that covers all categories of risk relevant to the Company.

Enterprise risks include strategic, operational, financial, regulatory and ESG aspects that may affect the achievement of the Industrial Plan’s objectives and influence the Company’s main value drivers. Their analysis is carried out by risk owners, in collaboration with the Risk Management & Compliance function, to assess likelihood and impact and define appropriate response strategies.

Opportunities

Within the Risk Management & Compliance model, risk is also viewed as a lever for opportunity. Identifying market trends, technological innovations and new customer needs means anticipating change and directing investment towards areas with high growth and sustainability potential. Valuing opportunities strengthens corporate resilience and contributes to value creation for stakeholders.

Project risks

Company projects are an integral part of the RMC model: on the one hand they mitigate enterprise risks, and on the other they enable new development opportunities. Each project, however, carries specific risks that may affect expected outcomes. Managing these risks—embedded in the project management process—ensures alignment with strategic priorities, efficient use of resources, and an appropriate balance between risks, benefits and objectives.

Compliance

Rai Way ensures regulatory compliance, by monitoring risks of non-compliance and adopting ethical and responsible behaviour.

Compliance Governance operates on multiple levels: the Compliance Officer coordinates and oversees activities, supported by first- and second-line business functions and by Internal Audit. The scope covers both mandatory requirements (corporate, tax, privacy, safety, anti-corruption, Italian Legislative Decree 231/2001) and voluntary commitments (ISO certifications, ESG and sustainability standards).

Using dedicated tools Rai Way ensures traceability and completeness in managing requirements, monitoring the evolution of non-compliance risks. This approach protects reputation, strengthens stakeholder trust and ensures business continuity in line with legality, transparency and responsibility.