
StradaClopotei, nr. 2 bis,
Ploiesti, JudetulPrahova,
phone: +(40) 244 54 43 21
email:
office.rws@rompetrol.com
15
Section Principle
Prov
No.
Provision (detailed) Yes Partial No
Explanation (text and url link if
document is on website)
B: RISK
MANAGEMENT
AND INTERNAL
CONTROL
FRAMEWORK
B.1. The Company should
have an adequate and
effective internal control
framework and an
enterprise risk
management framework,
taking into account its
strategy, size, complexity
of operations and risk
profile including potential
environmental and social
impact of its activities.
B.1., 3
The Board and Audit Committee should understand
emerging information technology and artificial
intelligence-related changes so to mitigate
cybersecurity risks. Time should be given to the AI
risks and opportunities and cybersecurity on Board
agenda to ensure understanding of cyber protection.
X
The Board of Directors and the Audit
Committee periodically monitor the risks
associated with information technology,
cybersecurity, and emerging
developments. The Board ensures that
the Company has appropriate controls
and procedures in place to prevent and
mitigate IT and cybersecurity risks.
B: RISK
MANAGEMENT
AND INTERNAL
CONTROL
FRAMEWORK
B.1. The Company should
have an adequate and
effective internal control
framework and an
enterprise risk
management framework,
taking into account its
strategy, size, complexity
of operations and risk
profile including potential
environmental and social
impact of its activities.
B.1., 4
The Company is recommended to establish a risk
management function responsible for ensuring
accurate, complete and timely identification of the
risks, ensuring that adequate and feasible risk
control measures are in place and monitoring the
risk management procedures. The risk management
function, through the Chief Risk Officer (CRO),
where present, should have a direct communication
and functional reporting to the Board and Audit
Committee (if there is no separate Risk Committee).
X
The Company applies the risk
management framework implemented at
the Rompetrol Group level, and the
responsibilities for identifying, assessing,
and monitoring risks are carried out by
the competent internal structures.
B: RISK
MANAGEMENT
AND INTERNAL
CONTROL
FRAMEWORK
B.1. The Company should
have an adequate and
effective internal control
framework and an
enterprise risk
management framework,
taking into account its
strategy, size, complexity
of operations and risk
profile including potential
environmental and social
impact of its activities.
B.1., 5
The Board with the assistance from the Audit
Committee should at least annually assess the
adequacy and effectiveness of Company’s risk
management and internal control framework
(including operational and compliance controls) and
make relevant recommendations. The assessment
should consider the effectiveness and scope of the
internal audit function, the adequacy of risk
management and compliance, internal control
reports, if they are required by applicable legislation,
to the Audit Committee, management’s
responsiveness and effectiveness in dealing with
identified internal control failings or weaknesses and
submission of relevant reports to the Board.
X
The Board of Directors, assisted by the
Audit Committee, periodically monitors
the functioning of the Company’s risk
management framework and internal
control system. The Audit Committee
reviews the information provided by the
relevant structures regarding risks,
compliance, and internal controls, and
issues recommendations to the Board in
accordance with its responsibilities under
the applicable legislation.