believes
that
the
business
initiatives
and
actions
planned
in
the
Strategy
will
be
an
apt
response
to
the
changing market conditions and challenges of the future.
The
Bank’s
risk
management
system
and
internal
control
system
are
organised
on
three
independent
levels – lines of defence.
The
internal
control
system
supports
the
management
of
the
Bank
by
contributing
to
ensuring
the
effectiveness
and
efficiency
of
the
Bank’s
operations,
the
reliability
of
financial
reporting,
compliance
with risk management principles, and the Bank’s compliance with laws and internal regulations.
The internal control system includes:
1.
The
control
function
which
aims
to
ensure
compliance
with
control
mechanisms
relating
in
particular
to
risk
management
in
the
Bank,
which
includes
positions,
groups
of
people
or
organisational
units
responsible
for
the
performance
of
tasks
assigned
to
this
function.
The
function
is
carried
out
in
a
systematic manner by employees at all organisational levels by means of:
-
continuous
monitoring,
consisting
of
the
examination
of
selected
operations
or
activities
performed
at
the bank,
-
periodic
verification,
consisting
of
an
examination
of
selected
operations
or
activities
already
carried
out in order to check the adequacy and effectiveness of the continuous monitoring.
2.
The
compliance
function
which
is
responsible
for
identifying,
assessing,
controlling
and
monitoring
the
risk
of
non-compliance
of
the
Bank’s
operations
with
the
law,
internal
regulations
and
market
standards,
as
well
as
for
presenting
reports
in
this
respect.
The
tasks
of
the
compliance
function
are
performed by the Compliance Department.
3.
An
independent
internal
audit
function
which
aims
to
examine
and
assess,
in
an
independent
and
objective
manner,
the
adequacy
and
effectiveness
of
the
risk
management
system
and
the
internal
control
system.
The
tasks
of
the
independent
internal
audit
function
are
performed
by
the
Internal
Audit Department.
The
Audit
Committee
provides
the
Supervisory
Board
with
its
opinion
on
the
assessment
of
the
internal
control
system
based
on
information
from
the
Bank’s
Management
Board
on
the
functioning
of
the
internal
control
system,
reports
on
the
effectiveness
of
the
control
function,
significant
and
critical
irregularities
and
the
status
of
recovery
plans,
reports
on
compliance
risk
management,
the
assessment
from
an
internal
audit
perspective,
as
well
as
the
results
of
audits.
The
Committee
takes
into
account
in
its
opinion
information
from
the
parent
company,
subsidiaries,
the
auditor,
supervisory
institutions
(e.g.,
the
Polish
Financial
Supervision
Authority),
as
well
as
from
other
third
parties.
The
Committee
assesses
the
performance
of
the
Compliance
Department
and
the
Internal
Audit
Department
on
the
basis
of
annual
activity
reports
presented
directly
by
the
Directors
of
the
Compliance and Internal Audit Departments.
Based
on
the
information
received
in
2021,
the
Supervisory
Board
did
not
identify
any
significant
irregularities
in
the
functioning
of
the
internal
control
system
(including
the
control
function,
the
compliance
function,
and
the
internal
audit
function)
and
considers
that
it
is
adapted
to
the
scope
and
complexity
of
the
Bank’s
activities,
organisational
structure,
and
risk
management
system.
As
part
of
the
assessment
of
the
internal
control
system,
on
the
basis
of
an
opinion
of
the
Audit
Committee,
the
Supervisory
Board
identified
the
strengths
of
the
system
and
areas
for
further
improvement.
The
Supervisory
Board
assessed
that
the
units
responsible
for
the
control
function,
compliance
risk
management,
and
internal
audit
carried
out
their
tasks
in
accordance
with
the
internal
regulations
on
a
continuous
basis,
and
that
the
Bank’s
Management
Board
and
Audit
Committee,
as
well
as
the
Supervisory
Board,
received
adequate
reports
and
information
on
the
effects
of
such
activities.
The
independence
of
the
Compliance
Department
and
the
Internal
Audit
Department
was
ensured
as
defined
in
the
Rules
of
the
Compliance
Department
and
the
Audit
Charter,
respectively.
In
performing
their
duties,
employees
of
those
units
performed
their
activities
with
independence
and
objectivity,
did
not
execute
processes
which
were
subject
to
their
controls,
and
did
not
engage
in
activities
which
could
give rise to a conflict of interest with their duties.
The
Directors
of
the
Compliance
Department
and
the
Internal
Audit
Department
took
measures
on
an
on-going
basis
to
ensure
that
adequate
human
resources
and
the
necessary
financial
resources
were
available to systematically improve the qualifications, experience and skills of the staff of those units.
The Group’s risk management system is based on the concept of three lines of defence.
The
Bank
has
in
place
risk
committees
for
each
business
line:
the
Retail
Banking
Risk
Committee,
the
Corporate
and
Investment
Banking
Risk
Committee,
and
the
Financial
Markets
Risk
Committee,
which
define
the
risk
management
principles
and
determine
the
risk
appetite
of
the
business
line.
Risks
are
also
an
important
focus
of
the
work
of
other
committees
in
the
Bank
chaired
by
members
of
the
Management Board.
The
Bank
has
in
place
methodologies
and
processes
where
risks
are
identified
and
assessed
to
determine
their
potential
impact
on
current
and
future
operations.
The
comprehensive
risk
management
structure
is
complemented
by
a
consistent
system
for
monitoring
and
reporting
risk