Management of risks and the control system

Although it has a limited economic and financial risk profile because most of its operations are in regulated business segments, Snam adopts a structured and systemic approach to governing all risks that could affect value creation.

The system used across the Group to identify, assess, manage and control risk has three levels, each with different objectives and associated responsibilities. The Board of Directors charges the CEO with giving structure to and maintaining the entire system. We use an integrated, dynamic and group-wide method of assessing risk that evaluates the existing management systems in the individual corporate processes, starting with those relating to the prevention of fraud and corruption and health, safety, environment and quality.

These same controls form an integral part of the managerial processes. Management must therefore foster an environment that encourages controls, and must specifically manage “line controls”, consisting of all the control activities that individual operating units or companies perform over their own processes. Independent controls are performed by the Internal Audit department, which is responsible for checking that the system is functioning and adequate.

In 2019, audit activities were performed by a dedicated team of 10 auditors on average.

In 2019 the Internal Audit activities are carried out by ensuring that the conditions of complete independence and autonomy are preserved, as well as the due professional diligence, objectivity, and competence, as provided for by the Mission of the Internal Audit and by the Mandatory Guidance of the Institute of Internal Auditors and by the principles contained in the Code of Ethics.

Internal Audit regularly carried out scheduled activities involving: i) the preparation of the proposed Audit Plan based on the measurement and prioritisation of the main corporate risks carried out by the ERM unit; ii) the execution of the Audit Plan, composed of 14 measures, approved by the Snam Board of Directors on 18 February 2019, following the favourable opinion of the Control and Risks and Related-Party Transactions Committee and carrying out two further audits not scheduled in the plan (spot audits); iii) carrying out the independent monitoring programme defined with the Chief Financial Officer under the scope of Snam’s Corporate Reporting Control System; iv) confirmations of reports, including anonymous ones, of problems relating to the internal control and risk management system, the company’s administrative responsibility, whistleblowing and v) activities inherent to relations with the External Auditors and those relating to monitoring activities for conferring additional tasks, as well as support, jointly with the legal and administrative departments, in the tender launched by CDP group aimed at identifying a single auditor for the Group for the years 2020-2028.

Below are the main activities carried out in terms of methodology:

• full operation of the new tool for the management of audit activities from the planning of interventions stage to the follow up of corrective actions. In this area, for the purpose of defining the audit plan, the audit universe was updated, also in order to consider the organisational changes that took place in 2019, in particular for Snam S.p.A. and to include the new processes resulting from the acquisition of companies in relation to the new businesses;
• implementation of improvement actions highlighted following the Internal Quality Review conducted at the end of 2018, including: i) the updating of the Key Risk Indicators, as well as the implementation of new ones, as part of the continuous monitoring of the passive cycle process, preparing, from the third quarter of 2019, a report with the outcomes of the analyses for the management of the competent functions, ii) the updating of the periodic reporting introducing Key Performance Indicators (KPIs) for the activities carried out by the function as well as with reference to issues of sustainability.

Enterprise Risk Management process (ERM)

The Snam group, in line with the indications of the Code of Corporate Governance and international best practices, has instituted, under the direct supervision of the General Counsel, the Enterprise Risk Management (ERM) unit, which operates within the wider Internal Control and Risk Management System, in order to manage the integrated management process of corporate risks for all Group companies.

The main objectives of ERM are to define a risk assessment model that allows risks to be identified, using standardised, group-wide policies, and then prioritised, to provide consolidated measures to manage these risks and to draw up a reporting system.

The risk is defined as an effect of the uncertainty on the targets and can be negative or positive in scope.

Cross-organisational nature

(For more information on the main risk and uncertainty factors, please refer to the chapter “Risk and uncertainty factors” of this Report).