Skip to:
  1. Home
  2. Governance
  3. Our internal control systems
Share this event on:
  • LinkedIn

Recomend this page

Thank you, we sent your recommendation to the desired recipient.

Sorry, this functionality is not available right now.
Please try with this link. Thank you.


Recipient (e-mail address):

1 / 3

The Internal Control System (ICS) consists of a set of rules, procedures and organizational structures which aim to:

  • ensure that corporate strategy is implemented
  • achieve effective and efficient corporate processes
  • safeguard the value of corporate assets
  • ensure the reliability and integrity of accounting and management data
  • ensure that operations comply with all existing rules and regulations

Role of governing bodies


establishes guidelines for the internal controls system consistently with the strategic guidelines and risk appetite established, in accordance with the instructions issued by the Supervisory Authorities and with applicable laws. On a yearly basis, the Board of Directors defines the Group Risk Appetite Framework consistently with the budget process timeline and with the definition of the financial plan and establishes policies to govern the risks to which the Group may be exposed, as well as risk targets and tolerance thresholds, reviewing them periodically in order to ensure that they remain effective over time. 



identifies the Company's risks, submitting them to the Board of Directors, and implements the Board's guidelines by planning, managing and monitoring the internal controls and risks management system. The CEO is responsible for taking all necessary steps to ensure that the organisation and internal controls system comply with the principles and requirements envisaged under legal provisions.



THE AUDIT COMMITTEE                    

is responsible for overseeing the completeness, adequacy, functionality and reliability of the internal controls system and the Risk Appetite Framework, as well as the risks management and control process.

As to the variety of corporate functions and structures that have control roles and responsibilities within the Company, the Audit Committee is called to check the efficacy of all structures and functions involved in the controls system, the proper performance of duties and their proper coordination, promoting any corrective actions aimed at remedy any shortcoming or irregularities detected.



Role of the corporate functions


UniCredit monitors, measures and controls market, credit, operational, reputational and compliance risk as follows:

First-level or line controls are designed to ensure that transactions are carried out correctly.


Controls are performed by the production unit, incorporated in procedures or carried out by a back office.


Second-level or risk management controls are the duty of a unit which is distinct from the production unit. The departments responsible for these controls are the following:

  • The Compliance Function looks after the correct application of/and compliance with the regulatory framework, its consistent interpretation at group level, as well as the identification, evaluation, prevention and monitoring of the overall compliance risks of the group or respective Legal Entities.
  • The Group Risk Management (GRM) controls and steers Group risks by the definition of policies and methods aimed at measuring and controlling those risks, and optimizing the cost of risk through the definition of guidelines, policies and credit non-binding opinions on significant credit exposures, in compliance with internal and external rules and regulations.


As independent function, Internal Audit plays an integral part in the internal controls system, carrying out assurance and consulting to evaluate, add value to and improve the internal controls system of UniCredit and its Group.


Internal Audit adheres to the International Professional Practices Framework (Definition of Internal Audit, Core Principles for the Professional Practice of Internal Auditing, and Code of Ethics and International Standards).

Please click on the accordion below to learn more on the corporate functions responsibile for intenal controls

Role of the Supervisory Body

pursuant to Legislative Decree 231/2001


Italian Legislative Decree 231/01 prescribes the establishment of an internal Supervisory Body (hereinafter also SB) with independent powers of initiative and control whose duty is to supervise the functioning of and compliance with the Organization and Management Model and to ensure its updating. The functions of the Supervisory Body of UniCredit S.p.A., pursuant to Legislative Decree 8 June 2001 n. 231, starting from 12 April 2024, have been attributed to the Audit Committee.


Legislative Decree No. 231 of June 8, 2001 states the administrative liability of incorporated and non-incorporated bodies, companies and associations (entities). This liability is very similar to the criminal liability because it's not linked to the person committing the illegal conduct (entities are liable even if the person liable can't be prosecuted or has not been identified).

Entities can be liable as per L.D. 231/01 if:

a) senior managers, directors or people working under their guidance and supervision commit any of the crimes listed into the special part of the Decree;

b) the offence is committed for the benefit or in the interest of the entities themselves.

Entities may be exempted from liability if they prove that they have adopted and effectively implemented models of organization and management suitable to prevent the commission of the offences covered by the decree.

Decree 231/2001, the composition and role of the Supervisory Board and the internal disciplinary system.

The "Code of Ethics pursuant to Legislative Decree no. 231/2001" is an integral part of the Organization and Management Model, and contains rules intended to ensure that the conduct of the Addresses are always guided by principles of fairness, collaboration, loyalty, transparency and mutual respect, as well as to avoid conducts that could constitute the offences and crimes set forth in Italian Legislative Decree 231/01.


Role of the external auditing firm

External auditors of listed companies are required to be entered to a special Register kept by Ministry of Economy and Finance.

During the financial year they are required to verify that:

  • the company's accounting records are properly maintained and that operations are correctly reflected in the accounting records; and
  • the company's annual accounts and consolidated accounts are free from material misstatements which would alter the true and fair view of the financial position and results of operations of the Company and of the Group and are compliant with applicable accounting standards.

Additionally, based on Consob's recommendation, the external auditors shall also carry out a review of the individual and consolidated first-half report.
An auditing firm was appointed to perform the above tasks by UniCredit's Shareholders' Meeting on 9 April 2020 according to the Board of Statutory Auditors' proposal, for the financial statements 2022-2030 as for Legislative Decree 39/2010 that introduced a duration of nine years non-renewable.

The auditing firm currently appointed by UniCredit as its external auditors is KPMG S.p.A. whose address is as follows:

Via Vittor Pisani, 25
20124 Milano
Tel. 02 83322111


The auditing firm's reports (Report of the External Auditors) are included in the Parent Company's and Consolidated Annual Report and Accounts, as well as in the Individual and Consolidated First-Half Report.




Updated on 15 April 2024.