Internal control system
The Internal Control System (ICS) consists of a set of rules, procedures and organizational structures which aim to:
- ensure that corporate strategy is implemented
- achieve effective and efficient corporate processes
- safeguard the value of corporate assets
- ensure the reliability and integrity of accounting and management data
- ensure that operations comply with all existing rules and regulations.
Role of governing bodies
The Chairman and Deputy Chairman: are ex officio members of the Internal Control and Risk Committee (ICRC). Subject to an opinion of the ICRC, the Chairman shall propose the appointment and replacement of the Head of the Internal Audit function to the Board of Directors.
The Board of Directors of UniCredit: draws up group internal control guidelines and policy in accordance with the Italian regulators' directives and applicable law. The Board of Directors, having consulted the Board of Statutory Auditors, approves risk management policy. The Internal Audit Department reports to the Board.
The CEO: identifies the main corporate risks, presents them to the Board of Directors, and carries out the Board's instructions by having the ICS designed, managed and monitored.
The CEO has the duty of ensuring effective risk management by drawing up adequate policies and procedures and making sure that they are complied with within the bank.
In respect of third-level controls performed by the audit function that reports directly to the Board of Directors, the CEO examines the audit guidelines, proposes additions to the annual audit plan, and gives a non-binding opinion on proposed organisational and staff changes within the Internal Audit Department.
The Board of Statutory Auditors: The Chairman of the Board of Statutory Auditors is an ex officio member of the Internal Control and Risk Committee and may delegate another Statutory Auditor to attend meetings of the Committee. Statutory Auditors may at any time undertake inspections or verification, jointly or singly.
The Internal Controls and Risk Committee: comprises non-executive directors (a majority being independent directors). It assists the Board of Directors in drawing up the rules for the ICS and at least once a year assesses its adequacy, ensuring that the main corporate risks are correctly identified, measured, managed and monitored.
The ICRC may, through its Chairman, access all corporate information and functions as necessary for the proper performance of its duties, and avail itself of corporate and group departments and where necessary external advisors.
The ICRC assists the Board in determining the group's risk appetite, evaluates the annual audit plan drawn up by the Head of the Audit Department, examines the accounts quarterly and assists the Board in drawing up risk management policy. The ICRC reports at least half-yearly to the Board on its activity and on the adequacy of the ICS.
Role of the corporate functions
UniCredit monitors, measures and controls market, credit, operational, reputational and compliance risk as follows:
- First-level or line controls are designed to ensure that transactions are carried out correctly. Controls are performed by the production unit, incorporated in procedures or carried out by a back office.
- Second-level or risk management controls are the duty of a unit which is distinct from the production unit. The departments responsible for these controls are the following.
The Compliance Function looks after the correct application of/and compliance with the regulatory framework, its consistent interpretation at group level, as well as the identification, evaluation, prevention and monitoring of the overall compliance risks of the group or respective Legal Entities.
The Group Risk Management (GRM) controls and steers Group risks by the definition of policies and methods aimed at measuring and controlling those risks, and optimizing the cost of risk through the definition of guidelines, policies and credit non-binding opinions on significant credit exposures, in compliance with internal and external rules and regulations.
- Third-level controls are performed by internal audit, which assesses and regularly checks the completeness, functionality and adequacy of the ICS. Internal audit is independent of both production and second-level control units. In some cases an entity may outsource internal auditing to UniCredit SpA.
UniCredit Group has an Internal Audit Department. The "Person in Charge of Internal Control System" prescribed by the Italian Corporate Governance Code is the Head of Internal Audit