Management of risks and the control system

Although it has a limited economic and financial risk profile because most of its operations are in regulated business segments, Snam adopts a structured and systemic approach to governing all risks that could affect value creation.

The system we use across the Group to identify, assess, manage and control risk has three levels, each with different objectives and associated responsibilities. The Board of Directors charges the CEO with giving structure to and maintaining the entire system.

We use an integrated, dynamic and group-wide method of assessing risk that evaluates the existing management systems in the individual corporate processes, starting with those relating to the prevention of fraud and corruption and health, safety, environment and quality.

These same controls form an integral part of the managerial processes. Management must therefore foster an environment that encourages controls, and must specifically manage “line controls”, consisting of all the control activities that individual operating units or companies perform over their own processes. Independent controls are performed by the Internal Audit department, which is responsible for checking that the system is functioning and adequate.

In 2017, audit activities were performed by a dedicated team of 8 auditors.

In 2017, all internal audit activities were carried out in accordance with the international standards issued by the Institute of Internal Auditor (IIA) and, following the 2016 Quality Assurance Review (QAR) (whose final summary opinion is one of general compliance of the structure and Internal Audit activities of Snam S.p.A. with IIA Standards and Code of Ethics), the Internal Audit department has prepared and launched a program to implement the improvement actions highlighted by the QAR. In particular, the main actions implemented by the function include:

• Review and approval of the Guidelines for the Board regarding internal audit activities. The changes took into consideration:(i) the update of IIA international standards (effective January 2017), (ii) the update of the Italian Stock Exchange Code (published in July 2015), and (iii) the change in the scope of audit activities following organisational changes and the updating the company procedural framework;
• the updating of the operating guides through the preparation of an Internal Audit Manual, which, with a view to continuous improvement, seeks to increase the process efficiency and make information easier to consume.

These activities were performed with the support of an independent specialist consultant, who also carried out a benchmark relative to similar companies in terms of size and operation; this work did not reveal any non-compliance with the standards, whilst ensuring that changes made were in line with IIA International Standards and best practices.

Enterprise Risk Management process (ERM)

The Snam group, in line with the indications of the Code of Corporate Governance and international best practices, has instituted, under the direct supervision of the General Counsel, the Enterprise Risk Management (ERM) unit, which operates within the wider Internal Control and Risk Management System, in order to manage the integrated management process of corporate risks for all Group companies.

The main objectives of ERM are to define a risk assessment model that allows risks to be identified, using standardised, group-wide policies, and then prioritised, to provide consolidated measures to mitigate these risks and to draw up a reporting system.

1.
Identification and measurement: of risk events relating to corporate processes and external risk factors that could influence the achievement of corporate goals, either through direct impacts on results and corporate finances (lower revenue or higher costs) or through intangible negative effects on other types of capital, especially the licence to operate.

3.
Definition of the management strategy: for all risks, management measures are identified, together with any specific interventions and the relevant implementation time frames, associated with a type of risk management from among those that have been codified. Management plans for the main risks are presented to the Control and Risk Committee.

2.
Enterprise and prioritisation assessment: each event is assigned an ‘enterprise measurement’, which summarises, for each risk, the different measurements carried out by the risk owner and by centralised units with specialist expertise. The prioritisation of risks is defined by combining the measurements of impact and probability.
 

4.
Monitoring and reporting: the risk mapping is periodically updated according to the enterprise
measurement, and at least once a year, including for low-priority risks. Periodic reporting guarantees, at the various corporate levels, the availability and representation of information relating to the management and monitoring of the relevant risks.

Cross-organisational nature

One of the best features of Snam’s ERM model is the wide-ranging nature of its impact measurement.

Any risk event may have 10 different types of impact, some determined by the risk owners (operational impacts) and others by specialist departments (e.g. legal and financial impacts). This means risk measurement from different perspectives and team risk prioritisation.

The most common operational impact is industrial impact, consistent with the fact that risk identification begins with process analysis. The most prevalent specialist impacts include reputational and legal impacts, confirming the existence of an increasingly globalised external context subject to ever more complex regulations.

Using the model described above, the risk assessment cycles were performed on the entire Snam Group in 2017.As at the end of 2017, 136 enterprise risks had been mapped and broken down between all corporate processes.

A project was also launched in 2017 to define and implement an integrated risk assessment model that, through a single IT tool and a single database, rationalises and integrates all information flows of second-level controls with a synergistic approach aimed at maximum overall efficiency.

The main corporate risks identified, monitored and, insofar as specified below, have been classified into the following categories:

• strategic risks
• legal and non-compliance risk
• operating risks
• financial risks

The table below shows the mitigation and monitoring measures implemented for each type of risk.