Internal Audit

Risk Management

enaon has established a Risk Management Unit to proactively monitor, prevent, mitigate, and manage risks associated with its business operations. Main tasks include, but are not limited to:

• Identifying, defining, and classifying potential risks.
• Establishing performance indicators, measures, and controls to mitigate risks.
• Monitoring the progress and implementation of mitigation efforts to ensure operational efficiency and effectiveness.

As part of the Italgas Group and in line with globally recognized frameworks, including COSO Framework and ISO 31000, enaon has implemented a comprehensive Internal Control and Risk Management System to ensure compliance with applicable laws and group procedures, safeguard company assets, optimize and efficiently manage activities and provide accurate and complete accounting and financial data. This system enhances the stability of operations while reinforcing the reliability of enaon’s financial information.

Structure of the system

Risk management is divided into three levels of internal control.

• First level: involves identifying, assessing, and monitoring risks inherent in various processes. Responsibility for managing and mitigating these risks lies with the departments that own them, which are tasked with implementing necessary controls and ensuring their proper functioning.

• Second level: focuses on monitoring major risks to ensure the effectiveness of risk management activities and controls. This includes:
  • Supporting first-level control in defining and implementing measures for managing critical risks and associated controls.
  • Overseeing the adequacy and functionality of the control system.
    This level is managed by specialized staff departments responsible for coordinating and supervising primary control systems.
• Third level: involves an independent and objective verification of the overall effectiveness of the first and second levels, as well as the adequacy of the company’s risk management framework. This verification is conducted by the Internal Audit of the Italgas Group.

 Ensuring Excellence in Corporate Governance

enaon’s internal control framework reflects our commitment to upholding the highest standards of safety, efficiency, and accountability. Through a robust system of policies and procedures, we ensure:

• Integrity in all operational processes.
• Strict adherence to regulatory requirements.
• Comprehensive protection of company resources.
• Reliability in accounting and financial data processing.

Our policies are evaluated and updated annually to:

• Identify and mitigate risks effectively.
• Enhance operational efficiency.
• Maintain strong corporate governance principles.

By maintaining an agile risk management system and fostering a culture of continuous improvement, enaon consistently meets market demands and exceeds stakeholder expectations.

Enterprise Risk Management

The Enterprise Risk Management (ERM) oversees the integrated enterprise risk management process. Its primary objectives include:

• Establishing a unified and cross-functional risk assessment model.
• Identifying and prioritizing key risks.
• Consolidating mitigation actions.
• Developing an effective reporting system.

Risk Analysis and Mitigation

In order to ensure that the corporate population is increasingly aware of the need to develop a culture attentive to the identification, monitoring and management of the main risks of the company’s business (Risk Based Thinking), training activities on Enterprise Risk Management issues are organised on a regular basis.

enaon’s risk management process involves:

1. Risk Identification and Categorization: Risks are classified across five core categories—economic, human, legal, regulatory, and reputational.
2. Impact and Probability Assessment: Each risk is analyzed in detail to determine its causes, potential effects, and the likelihood of occurrence, along with the scale of its impact.
3. Mitigation Measures: Existing controls are reviewed, and new actions are planned annually to further reduce risks or capitalize on emerging opportunities. Results are meticulously documented, monitored, and updated as needed.