4.10 Risk Management, Internal Control and Internal Audit
A risk management and internal control system is in operation within the Company, aimed at ensuring reasonable assurance in achieving the Company’s objectives and the Rosseti Group’s development strategy, including the provision of reliable, high-quality, and affordable electricity supply to consumers, as well as operational objectives of financial and economic activities.
The principal documents regulating the organization and functioning of the RM&ICS within the Company comprise the Risk Management and Internal Control Policy, risk appetite statement, Risk Management and Internal Control Organization Procedure, risk assessment and monitoring methodology, risk appetite determination procedure, RM&ICS development program, risk management and internal control glossary, and risk register. To ensure the RM&ICS effectiveness and conformity with evolving requirements and conditions, the Company’s internal auditor conducts assessments of the RM&ICS reliability and efficiency against the target state and maturity level.
In the reporting year, the Company implemented the following principal measures to enhance the RM&ICS:
- Development/update of regulatory and methodological documents in risk management and internal control:
- Risk appetite statement;
- Risk Management and Internal Control Organization Procedure;
- Risk Appetite Determination Procedure;
- Risk Management and Internal Control Glossary;
- External Control (Supervisory) Body Inspection Logging Regulation.
- Approval of the Company’s Business Process Model, organization of business process passport development, and update of business process risk matrices and control procedures.
The following measures to enhance the Risk Management and Internal Control System (RMICS) are planned for implementation in 2026:
- Documentation of business processes in accordance with the updated Company Business Process Model;
- Update of internal documents in the field of risk management and internal control;
- Enhancement of the financial stability control mechanism, including support for counterparty liquidation and bankruptcy procedures.
| Indicator | MU | 2023 actual | 2024 actual | 2025 actual | 2025/2024, % |
|---|---|---|---|---|---|
| Number of conducted control activities focused on risk exposure and mitigation | pcs | 410 | 431 | 388 | -10.0 % |
| Number of examined procurement-related materials (items) | pcs | 4,177 | 2,514 | 1,972 | -21.6 % |
| Number of eliminated violations following the inspections conducted by external watchdogs | pcs | 789 | 2,512 | 1,671 | -33.5 % |
| Total sum of annulled fines after appeals against decisions to impose administrative sanctions | RUBruble million | 19.5 | 57.35 | 4.7 | -1,120.2 % |
| Total funds received by the Company from contractors under liquidation and bankruptcy procedures | RUBruble million | 144.465 | 758.127 | 734.443 | -3.1 % |
| The total amount of funds saved by the Company as a result of acquiring its own debt at auction from debtors undergoing bankruptcy proceedings | RUBruble million | 0 | 0 | 0 | — |
The department responsible for performing the internal audit function within the Company is the Internal Audit Department. Pursuant to the Internal Audit Policy of PAOPublic Joint-Stock Company Rosseti Ural, the Internal Audit Department is functionally subordinate to the Board of Directors, which oversees and coordinates its activities. The purpose of internal audit is to strengthen the Company’s capability to create, protect, and preserve Company value by providing the Board of Directors and executive bodies of the Company with independent, risk-based, objective assurances, opinions, recommendations, and forecasts. As of 31 December 2025, the headcount of employees performing the internal audit function comprises 8 full-time positions.
The principal internal documents regulating internal audit activities include:
- the Company’s Internal Audit Policy;
- Standards of Ethics and Professionalism for Internal Auditors of the Company;
- Regulation on the Company’s Internal Audit Department;
- Program for Ensuring and Enhancing the Quality of the Company’s Internal Audit;
- internal standards of internal audit activities and practical application standards developed in accordance with the recommendations of the Bank of Russia and International Standards for the Professional Practice of Internal Auditing.
The Head of the Internal Audit Department receives feedback from the sole executive body, the Audit Committee of the Board of Directors, and the Board of Directors through various forms of interaction with the sole executive body and the Audit Committee, including analysis of the Audit Committee and Board of Directors decisions/recommendations on matters within the competence of internal audit, as well as through surveys of the sole executive body and Audit Committee members. The Audit Committee satisfaction rating with the Internal Audit Department performance (weighted average score from surveys of participating Audit Committee members divided by the number of participating members) for 2025 corresponds to the «Fully Compliant» rating.
Following the external independent assessment conducted in 2024, in the opinion of OOOLimited Liability Company B1-Consult, the internal audit of PAOPublic Joint-Stock Company Rosseti Ural received the highest rating, indicating that the Company’s internal audit «generally conforms» to the International Standards for the Professional Practice of Internal Auditing, the Code of Ethics, and the Internal Audit Policy, specifically: it has an internal audit regulation, policies, and procedures, the execution and results of which are assessed as conforming to the International Standards for the Professional Practice of Internal Auditing.