Risk management and internal control

The Group has introduced and employs the Risk Management and Internal Control Framework (RMICF), which encompasses key assets, business processes, lines of business, and all levels of the Group’s management.

Purpose and objectives of the Risk Management and Internal Control Framework

The use of the Risk Management and Internal Control Framework ensures:

  • an objective, fair, and clear view of the Group’s current state and prospects,
  • reasonable confidence in achieving the goals set for the Group,
  • a high level of trust among shareholders and investors in the Company’s management bodies,
  • the protection of investments and assets and the containment of risks within acceptable limits.

Participants in the Risk Management and Internal Control Framework

The Group’s management ensures the RMICF is integrated into key business processes and the Group’s activities, above all in the planning and monitoring of business activities, including business planning and project management in the Generation, Supply, Trading, and Engineering segments.

With the support of the Internal Control and Risk Management Department (ICRMD), senior management is responsible for coordinating and drafting a unified methodology and ensuring the stages of the RMICF cycle are properly implemented and produce the key results. The head of the ICRMD reports directly to the Chairman of the Management Board, which ensures the independent identification and assessment of risks as well as the development and monitoring of risk management measures, including control procedures.

The objectives, core principles, approaches, and parties involved in risk management and internal control processes at PJSC Inter RAO are enshrined in the Risk Management and Internal Control Policy of PJSC Inter RAOThe Risk Management and Internal Control Policy (Minutes No. 234 of the Company’s Board of Directors dated November 19, 2018) is a top-level document drafted based on the Charter of PJSC Inter RAO that takes into account the recommendations of Russian and international risk management standards, the Corporate Governance Code, the guidelines of the Federal Agency for State Property Management, risk management and corporate governance best practices, and the listing rules of Russian and international stock exchanges., which is reviewed and approved by the Company’s Board of Directors.

The Risk Management and Internal Control Policy was approved as a corporate standard for the companies of the Inter RAO Group by an orderOrder No. IRAO/652 dated December 17, 2018 “On the Risk Management and Internal Control Policy of PJSC Inter RAO approved by the Board of Directors.” of the Chairman of the Management Board.

Flow chart of responsibility of participants in the Risk Management and Internal Control Framework of the Inter RAO Group

Functions and objectives of participants in the Risk Management and Internal Control Framework
Participants Key functions and objectives
Board of Directors Determination of the principles and approaches to the organization of the RMICF and approval of the Risk Management and Internal Control Policy. Approval of risk appetite for the planned period, critical risk maps, and a critical risk management action plan. Annual review of a report on the operation of the RMICF and an assessment report on the effectiveness of the RMICF.
Executive management bodies Chairman of the Management Board, Management Board, Collective advisory bodies Ensuring the RMICF functions effectively at the Company. Distribution of powers, duties, and responsibilities for specific risk management and internal control procedures. Approval of requirements for the structure, content, and formats of reporting processes and risk management and internal control procedures. Approval of benchmarks for the RMICF, including:
  • a list of the Group’s companies that fall within the perimeter of the RMICF;
  • a list of the Group’s standard risks with the distribution of management’s areas of responsibility for the risks;
  • acceptable risk levels;
  • target indicators for assessing the impact of risks;
  • the review and adoption of decisions on risk management and internal control issues;
  • dissemination of knowledge and skills in risk management and internal control and the development of a risk management culture.
Risk Owners Managers who directly report to the Chairman of the Management Board, Managers of structural units of the Group’s companies Establishing the RMICF within the functional areas they manage, ensuring it functions effectively, and introducing, implementing, and improving internal control and risk management procedures. Introducing a risk-based approach to operational practices and disseminating the standards and values of a risk management culture among employees. Drafting internal regulatory documents on risk management and internal control for functional areas. Ensuring the stages of the RMICF cycle are properly implemented and produce the key results. Implementing functional risk management measures, including control procedures, and ensuring their monitoring. Coordinating employees’ actions, information flows, and resources in order to manage the risks of their functional areas.
Internal Control and Risk Management Department Overall coordination of risk management and internal control processes. Creation of a unified methodology for the RMICF and monitoring its compliance. Implementing and improving RMICF processes and ensuring the stages of the RMICF cycle are properly implemented and produce the key results. Informing the Company’s Board of Directors and executive bodies about the operational results of the RMICF. Disclosing information on risk management and internal control issues to internal and external stakeholders. Organizing training for the Company’s employees and controlling entities on matters concerning risk management and internal control and ensuring the dissemination of knowledge and skills in risk management and internal control at the Group’s companies.
Internal Audit Assessing the effectiveness of the RMICF. Monitoring measures that aim to improve the effectiveness of the RMICF. Consulting the Company’s executive bodies on matters concerning risk management and internal control.
Employees Taking a risk-oriented approach to activities, including the adoption of risk-oriented decisions and following compliance principles in the areas of functional responsibility stipulated by official duties. Documenting and monitoring risks in day-to-day operating activities as part of the performance of official duties, carrying out risk management measures and control procedures, and/or ensuring their monitoring. Informing immediate superiors in a timely manner about changes to the internal and external conditions of the Company’s activities that could lead to changes in the degree of risk or the emergence of new risks as well as cases where risk management measures cannot be implemented or need to be adjusted.

Development of the Risk Management and Internal Control Framework

The PJSC Inter RAO Board of Directors decided to merge the Enterprise Risk Management Framework and the Internal Control Framework into the unified RMICFMinutes No. 234 dated November 19, 2018.. The merger and mutual integration of the systems has made it possible to achieve the following results:

  • the perimeter for inclusion in the Risk Management and Internal Control Framework was expanded from 15 to 26 of the Group’s subsidiaries. This has resulted in the cumulative revenue of companies within the perimeter of the RMICF accounting for 96% of the Group’s revenue per IFRS
  • an assessment was conducted of the impact risks have on the Group’s performance targets in the context of its strategic development priorities;
  • the list of the Group’s standard risks was updated and the number of standard risks faced by the Group’s companies that are assessed and managed within the RMICF was increased from 30 to 57;
  • an approach was approved for assessing process level risks, developing control procedures, and building risk-oriented internal control.

Based on the results of the annual efficiency assessment of the Enterprise Risk Management Framework (ERM) and the Internal Control Framework (IC) conducted by the internal audit division in the first quarter of 2018, the Board of Directors approved recommendations to improve the efficiency of the ERM and IC taking into account the priorities for risk management and internal controls for 2018Minutes No. 221 dated April 2, 2018..

Efficiency assessment of the Risk Management and Internal Control Framework

  • Management informs the Board of Directors each year about the results achieved in matters concerning risk management and internal control over the reporting period as part of an annual report on the operation of the RMICF.
  • The internal audit division conducts audits and an annual efficiency assessment of the RMICF and provides the Board of Directors with reporting on the results of the assessment.
  • The Company’s Board of Directors reviews matters concerning the organization, functioning, and effectiveness of the RMICF at least once a year and makes recommendations for its improvement, and also has the power to initiate an external assessment of the RMICF with the hiring of an independent organization.
  • The efficiency assessment of the RMICF for 2018 was presented by the Internal Audit Unit to the Company’s Board of Directors for review and approved on March 29, 2019Minutes No. 243 dated April 1, 2019..
Priorities for 2018 Results achieved
Strengthening the integration of the ERM and IC The Enterprise Risk Management Framework and Internal Control Framework were integrated into the unified Risk Management and Internal Control Framework. The Enterprise Risk Management Framework and Internal Control Framework were integrated into the unified Risk Management and Internal Control FrameworkMinutes No. 234 dated November 19, 2018.. The number of internal regulatory documents (IRD) in the ‘Risk Management’ and ‘Internal Control’ functional areas was updated and optimized. The conceptual framework in risk management and internal control was improved and unified.
Updating approaches to determining acceptable risk levels, including risk appetite The Group approved the concept of acceptable risk levels (risk appetite, risk capacity, risk tolerance, and risk limit), which upon being introduced in 2019 will make it possible to:
  • provide confidence in the achievement of the Group’s strategic goals;
  • determine the acceptable level of controlled risk factors and link the influence of uncontrolled risk factors to the achievement of the target indicators of the Group’s companies.
Strengthening the integration of risk management with business planning processes The RMICF was integrated into business planning processes and reporting on the execution of the business plans of the Group’s companies. Approaches were formalized for conducting an integrated risk-oriented factor analysis of deviations in the business plans of the Group’s companies.
Strengthening the integration of risk management with project management Project risk assessment was integrated into project management processes. The approaches that have been developed for project risk management have been tested during various types of projects. A project risk management methodology has been developed and recommendations have been made on updating the IRD in project management.
Assistance in the development of compliance methodology Antimonopoly Compliance (AMC): The Board of Directors has approved an Antimonopoly Compliance PolicyMinutes No. 235 dated December 3, 2019. . An order Order No. IRAO/703 dated December 27, 2018. of the Chairman of the PJSC Inter RAO Management Board approved the Antimonopoly Risk Map together with the Antimonopoly Risk Management Action Plan. An Antimonopoly Compliance Commission has been established and functions at the Company. In December 2018, organizations controlled by the Company appointed persons responsible for AMC in coordination with the Antimonopoly Compliance Commission. Tax compliance: Since 2018, PJSC Inter RAO has been submitting quarterly reporting forms on internal control to the tax authorities in accordance with the requirements of the Federal Tax Service of Russia (FTS of Russia). Regulatory documents have been drafted to ensure the effective functioning of the internal tax control system at PJSC Inter RAO.

Critical risk analysis

The critical risk map of the Inter RAO Group is compiled annually and reflects the results of the critical risk assessment, including a graphic display, a list of critical risks, and the disclosure of information about them. Critical risks refer to risks that pose a threat of deviation from the Group’s goals and require priority management and monitoring in order to comply with an acceptable level of risk.

  1. Credit risk of counterparty banksPer a resolution of the Board of Directors, such risks are listed among critical risks, but are not graphically displayed on the risk map since they are categorized as risks whose impact on EBITDA and cash flow from operations are not assessed. Information on corruption risks is disclosed in the ‘Anti-Fraud and Corruption’ section.
  2. Risk of a decrease in the day-ahead market price as a result of changes related to the procedure used to convert price bids for the planning of production volumes
  3. Risk of the regulator adopting unfavorable tariff and balance decisions and a shortfall in the actual approved required gross proceeds
  4. Currency risk
  5. Price risk in the day-ahead market (risk associated with adverse price changes in the day-ahead market)
  6. Credit risk of the receivables of electricity customers/organizations
  7. Credit risk of the receivables of customers on the wholesle electric power and capacity market
  8. Risk of the failure to meet commissioning deadlines (failure to meet the capacity supply schedules under capacity delivery agreements (CDA))
  9. Price risk (foreign economic activities)
  10. Risk of a reduction in the volume of electricity supplies (FEA)
  11. Risk of a lower guaranteed rate of return on CDA investments and the share of a CDA facility’s expenses compensated by payment for capacity
  12. Corruption risksPer a resolution of the Board of Directors, such risks are listed among critical risks, but are not graphically displayed on the risk map since they are categorized as risks whose impact on EBITDA and cash flow from operations are not assessed. Information on corruption risks is disclosed in the ‘Anti-Fraud and Corruption’ section.

Risks that materialized in 2018

Risk name Comments
Price risk in the day-ahead market (risk associated with adverse price changes in the day-ahead market) The main factors that had an effect on the decrease in day-ahead market prices relative to the targets were:
  • an increase in hydroelectric power generation;
  • 3.4% indexation of wholesale gas prices starting from August 21, 2018 and not from July 1, 2018, as had been originally planned.
The risk of adverse changes in day-ahead market prices in 2018 was offset by:
  • optimization of the selecting composition of included generating equipment (SCIGE) in actual market conditions;
  • optimization of strategies for filing price bids on the day-ahead market depending on market conditions.
Credit risk of the receivables of electricity customers/grid organizations Main factors of risk materialization in 2018:
  • an increase in receivables for enterprises of the Ministry of Defense of the Russian Federation;
  • an increase in receivables for housing and utility service enterprises;
  • an increase in receivables for industrial enterprises.
The growth in receivables on the retail electricity market was offset by:
  • a decrease in the level of overdue receivables at the end of 2018.
As part of receivables management measures in 2018, the following measures were taken to offset risk:
  • changes were made to the staffing table of supply companies to ensure work with receivables using various recovery methods (including judicial work and live canvas calling);
  • the start of the ‘Smart Receivables’ project in the main power transmission lines (optimized collection of receivables based on machine processing of big data about consumers – so-called ‘big data’ technologies) and software improvements that aim to provide analytical work and the segmentation of consumers into categories;
  • a comprehensive indicator for assessing the effectiveness of work with receivables is included in the KPIs of the Group’s senior management and subsidiaries for 2019;
  • in 2018, the companies of the Inter RAO Group continued to employ a system for the annual compilation of an Action Plan to reduce receivables as a special corporate governance tool.
Credit risk of the receivables of customers on the wholesale electric power and capacity market Main factors of risk materialization in 2018:
  • growth in the receivables of guaranteed electricity suppliers in the North Caucasus Federal District;
  • the bankruptcy of the Mezhregionsoyuzenergo Group.
As part of receivables management measures in 2018, the following measures were taken to offset risk:
  • claim-related actions;
  • measures to collect debt as part of enforcement proceedings;
  • the assignment of the rights of claims to debt and direct settlements with payment using the promissory notes of supporting banks.
Risk of the failure to meet commissioning deadlines (failure to meet the capacity supply schedules under capacity delivery agreements) Main factors of risk materialization in 2018:
  • delays in the commissioning of power units at Zatonskaya CHPP.
The risk of the failure to commission Zatonskaya CHPP in 2018 was offset by:
  • work with the Contractor to update the construction schedule and strengthen control over its execution in order to complete construction, installation, and commissioning work;
  • claim-related work with the Contractor.
Corruption risks According to the approaches used at the Group, fraud is considered a corruption risk, and the risk is deemed to have materialized when a conviction is handed down in court in cases that were not initiated as a result of the Group’s companies reaching out to law enforcement agencies. A case involving the risk of fraud was uncovered in the Group’s supply business: an employee of a company of the Group was found guilty under a conviction that was handed down in 2018.
It should also be noted in terms of criminal cases initiated by a company of the Group (does not affect risk materialization), one conviction was handed down against employees of the supply business in 2018 and another two convictions were handed down in 2019.
The Group has organized work to counter and prevent fraud and corruption.
For more on the management of corruption risks, please see the section ‘Anti-Fraud and Corruption’.
Risks not included in the list of critical risks for 2018 whose materialization led to a deviation in EBITDA or cash flow from operations in 2018
Risk name Comments
Changes in electricity sales on the day-ahead market (competitiveness of branches) The main factors that had an effect on the decrease in electricity sales on the day-ahead market relative to the targets were:
  • an increase in hydroelectric power generation;
  • an increase in flows from PZ1 (the first price zone) to PZ2.
The risk was offset by the optimization of the selecting composition of included generating equipment (SCIGE) in actual market conditions.
Credit risk of the receivables of thermal power customers

The main reason for the growth in receivables: revenue growth due to the climatic factor (a colder heating period compared with the temperatures projected in the Business Plan).

The growth in receivables among thermal energy customer in 2018 was offset by increased claim-related work and intensified interaction with the bailiffs service, collection agencies, and law enforcement agencies.

Correlation of risk management and internal control with the Group’s Development Strategy

The PJSC Inter RAO Board of Directors has approved strategic goals and development priorities (see the ‘‘Strategic Priorities’’ section). Operational-level goals are set to assess the achievement of strategic priorities and their fulfillment is included in the KPIs and PBs of the Chairman and members of the Company’s Management Board (see the ‘‘Key Performance Indicators System’’ section).

A list of standard risks inherent in the Group’s activities was determined as part of the target benchmarks of the Risk Management and Internal Control Framework, and target indicators were enshrined based on which the impact of the risks was assessed.

The breakdown of the Group’s strategic priorities into operational indicators and the assessment of the impact of risks on these indicators ensure the integration of the RMICF with the management incentive system and make it possible to effectively manage the Group’s companies taking into account their inherent risks.