Internal control system

The Internal Control System (ICS) consists of a set of rules, procedures and organizational structures which aim to:

• ensure that corporate strategy is implemented,
• achieve effective and efficient corporate processes,
• safeguard the value of corporate assets,
  
• ensure the reliability and integrity of accounting and management data, and
  
• ensure that operations comply with all existing rules and regulations.

Role of the Governing Bodies

 The governing bodies having a role in respect of the ICS are:

• The Chairman and Deputy Chairman: are ex officio members of the Internal Control and Risk Committee (ICRC). Subject to an opinion of the ICRC, the Chairman shall propose the appointment and replacement of the Head of the Internal Audit function to the Board of Directors.

• The Board of Directors of UniCredit: draws up Group internal control guidelines and policy in accordance with the Italian regulators’ directives and applicable law. The Board of Directors, having consulted the Board of Statutory Auditors, approves risk management policy. The Internal Audit Department reports to the Board.

• The CEO: identifies the main corporate risks, presents them to the Board of Directors, and carries out the Board’s instructions by having the ICS designed, managed and monitored.
  The CEO has the duty of ensuring effective risk management by drawing up adequate policies and procedures and making sure that they are complied with within the bank.
  In respect of third-level controls performed by the audit function that reports directly to the Board of Directors, the CEO examines the audit guidelines, proposes additions to the annual audit plan, and gives a non-binding opinion on proposed organisational and staff changes within the Internal Audit Department.

• The Board of Statutory Auditors: The Chairman of the Board of Statutory Auditors is an ex officio member of the Internal Control and Risk Committee and may delegate another Statutory Auditor to attend meetings of the Committee. Statutory Auditors may at any time undertake inspections or verification, jointly or singly.

• The Internal Control and Risk Committee: comprises non-executive directors (a majority being independent directors). It assists the Board of Directors in drawing up the rules for the ICS and at least once a year assesses its adequacy, ensuring that the main corporate risks are correctly identified, measured, managed and monitored.
  The ICRC may, through its Chairman, access all corporate information and functions as necessary for the proper performance of its duties, and avail itself of corporate and Group departments and where necessary external advisors.
  The ICRC assists the Board in determining the Group’s risk appetite, evaluates the annual audit plan drawn up by the Head of the Audit Department, examines the accounts quarterly and assists the Board in drawing up risk management policy. The ICRC reports at least half-yearly to the Board on its activity and on the adequacy of the ICS.

Role of the Corporate Functions

The UniCredit Group monitors, measures and controls market, credit, operational, reputational and compliance risk as follows:

• First-level or line controls are designed to ensure that transactions are carried out correctly. Controls are performed by the production unit, incorporated in procedures or carried out by a back office.

• Second-level or risk management controls are the duty of a unit which is distinct from the production unit. The departments responsible for these controls are the following:

The Compliance Function - within the Legal & Compliance Department - looks after the correct application of/and compliance with the regulatory framework, its consistent interpretation at Group level, as well as the identification, evaluation, prevention and monitoring of the overall compliance risks of the Group or respective Legal Entities.

The Risk Management Department provides strategic direction, draws up risk management policy and determines the principles for assessing, managing, measuring and reporting all risks.

• Third-level controls are performed by internal audit, which assesses and regularly checks the completeness, functionality and adequacy of the ICS. Internal audit is independent of both production and second-level control units. In some cases an entity may outsource internal auditing to UniCredit Audit.

UniCredit Group has an Internal Audit Department. The “Person in Charge of Internal Control System” prescribed by the Italian Corporate Governance Code is the Head of Internal Audit.