Clarification: The Company has not adopted internal regulations related to diversity among
members of the Management Board and the Supervisory Board pursuant to principle 2.1.
Consequently, reports submitted by the Supervisory Board do not specify the extent to which
the diversity policy is implemented in relation to these bodies, including the achievement of
the corresponding objectives. Should the Company decide to adopt the corresponding
regulations, the Supervisory Board’s report will include information on the implementation of
the diversity policy in relation to the Management Board and the Supervisory Board itself.
III. Internal systems and functions
[3.1.] A listed company maintains effective internal control, risk management and
compliance systems and an effective internal audit function appropriate to the size of
the company and the nature and scale of its business, which is the responsibility of the
management board.
Clarification: The Company partially deviates from this principle insofar that it has not
established a distinct internal audit function. Internal control at the Company is implemented
on the basis of its existing managerial framework, including the finance and accounting
departments. Control processes include, among others, bookkeeping based on internal
systems deployed at the Company; analysis and validation of the generated results, including
in the context of internal projections and expectations, ongoing monitoring of expenditures
and contracts concluded by the Company, as well as assessment of the economic viability of
anticipated projects. Certain internal control processes are carried out by legal departments,
and – where development of videogames is concerned – by the Studio’s development team.
The Company also operates, as part of its IT department, an information security team. In
discharging its internal control obligations the Company also enlists the help of external
experts by commissioning independent audits of specific areas of its activity. A formalized risk
management process is in place at the Company, based on a Risk Management Procedure
instituted by a Management Board resolution. Risks are identified on an ongoing basis, based
on analysis of external and internal factors which may affect the likelihood of irregularities
arising in the course of the Company’s daily activities. Identification and monitoring of risk
factors is the responsibility of the Risk Management Committee, which comprises directors and
managers at the Company (referred to as risk owners). Regarding compliance monitoring, the
Company has instituted a Compliance Management Policy, which names a Chief Compliance
Officer. The Privacy and Compliance department – part of the Company’s legal team – is