Management of risks and the control system

Although it has a limited economic and financial risk profile because most of its operations are in regulated business segments, Snam adopts a structured and systemic approach to governing all risks that could affect value creation.

The system we use across the Group to identify, assess, manage and control risk has three levels, each with different objectives and associated responsibilities. The Board of Directors charges the CEO with giving structure to and maintaining the entire system. We use an integrated, dynamic and group-wide method of assessing risk that evaluates the existing management systems in the individual corporate processes, starting with those relating to the prevention of fraud and corruption and health, safety, environment and quality.

These same controls form an integral part of the managerial processes. Management must therefore foster an environment that encourages controls, and must specifically manage “line controls”, consisting of all the control activities that individual operating units or companies perform over their own processes. Independent controls are performed by the Internal Audit department, which is responsible for checking that the system is functioning and adequate.

In 2018, audit activities were performed by a dedicated team of an average of 10 auditors.

In 2018, the Internal Audit activities were carried out by ensuring that the conditions of complete independence and autonomy are preserved, as well as the due professional diligence, objectivity, and competence, as provided for by the Mission of the Internal Audit and by the Mandatory Guidance of the Institute of Internal Auditors and by the principles contained in the Code of Ethics.

Internal Audit regularly carried out the programmed activities, which regarded: (i) the execution of the Audit Plan, approved by the Snam Board of Directors on 13 March 2018, after obtaining the favourable opinion of the Control, Risk and Related Party Transactions Committee and spot audits not envisaged on the plan; (ii) the carrying out of the independent monitoring programme defined with the Chief Financial Officer as part of the Snam Control System on the Corporate Disclose; (iii) named or anonymous reports of problems relating to the internal control and risk management system, to the Company’s administrative liability, irregularities or fraudulent acts (whistleblowing); (iv) the activities involving relations with the Independent Auditing Firm and those relating to the monitoring of the activities for the conferral of additional appointments on such.

Please also note the main activities carried out in methodology:

• the implementation of an Internal Audit Manual, which, with a view to ensuring continuous improvement, aimed to update the methodologies and identify standard formats so as to increase the efficiency and simplify the internal audit process;
• the development of a new tool to manage audit activities from the planning of interventions through to the follow-up of corrective action following the implementation of the Integrated Risk Assurance and Compliance Project;
• the update of the Key Risk Indicators, as well as the implementation of new ones, as part of the continuous monitoring of the expenditure cycle with the desire to structure, in 2019, dedicated reports for the functions of the first and second level control;
• the Internal Quality Review with the aim of monitoring the effectiveness and efficiency of the activities, the conformity, in going about operations, with the regulatory and operative tools of the Department and with respect to best practices and reference international standards for the profession.

The Enterprise Risk Management (ERM) process

The Snam group, in line with the indications of the Code of Corporate Governance and international best practices, has instituted, under the direct supervision of the General Counsel, the Enterprise Risk Management (ERM) unit, which operates within the wider Internal Control and Risk Management System, in order to manage the integrated management process of corporate risks for all Group companies.

The main objectives of ERM are to define a risk assessment model that allows risks to be identified, using standardised, group-wide policies, and then prioritised, to provide consolidated measures to manage these risks and to draw up a reporting system.

The risk is defined as a result of the uncertainty over the objectives, and may be negative or positive (opportunity).

Cross-organisational nature

One of the best features of Snam’s ERM model is the wide-ranging nature of its impact measurement.

Any risk event may have eight different types of impact, some determined by the risk owners (operational impacts) and others by specialist departments (e.g. legal and financial impacts). This means risk measurement from different perspectives and team risk prioritisation.

The most common operational impact is industrial impact, consistent with the fact that risk identification begins with process analysis. The most prevalent specialist impacts include reputational and legal impacts, confirming the existence of an increasingly globalised external context subject to ever more complex regulations.

During 2018, the risk assessment cycles were completed and the first mapping of corporate opportunities performed, according to the model described above and the “Enterprise Risk Management” guidelines approved in March by the Board of Directors, which involved the whole of the Snam Group. As at the end of 2018 approximately 138 enterprise risks appeared to be mapped, distributed across all corporate processes. Moreover, the 2018 mapping of risks and opportunities considered the new activities under the scope of new unregulated businesses, as a result of acquisitions made during the year.

Opportunities (approximately 25) were identified using a similar method to that employed for the risks. In this case too, suitable metrics were used to measure the operative impacts (industrial/business and economic) by each owner and to have the specialised departments measure the other impacts (market, reputational, environment, financial).

In 2018, the Integrated Risk Assurance and Compliance project was trialled, with the aim of defining and implementing an integrated risk assessment model that, through a single IT tool and a single database, rationalises and integrates information flows of second-level controls with a synergistic approach aimed at maximum overall efficiency.

The main enterprise risks identified and monitored were classified as financial and non-financial (strategic risks, legal and non-compliance risk and operational risks).

The table below shows the mitigation and monitoring measures implemented for each type of risk.

More information on the main risk and uncertainty factors is given in the chapter entitled “Elements of risk and uncertainty” in this Report.