Paolo Bersani | PWC - Integrated internal control over sustainability

www.pwc.com

Sustainable finance and Integrated Thinking Integrated internal control over sustainability: a new opportunity for the value creation Strictly Private and Confidential 16 october 2018

Internal

Internal

The current market scenario

The behaviour of organizations in the current market scenario may be described as follows.

Leading organizations have understood the relevance of integrated internal control systems and adopted a voluntary and proactive approach.

Others are following the leading organizations and are preparing to respond to the requirements of

Internal

the European Directive 95/2014 and the Legislative Decree 254/2016.

Finally there are organizations which are not yet structured in order to implement an integrated internal control system.

From where companies start on ICNFR Many different levels involving data and information flows…and no clear responsibility Different reporting processes in the different Business Units

Many functions involved, not familiar with the concept of “robustness of the process” Lack of alignment regarding the data providing process Frequent use of electronic spreadsheets…and no general controls Different IT systems supporting internal function, reporting “not GRI compliant” kpi Limited time for data and information analysis Internal

Organizations may experiment some critical issues along the reporting process for non-financial information.

A system may help managing them structured internal control …

The analysis conducted by PwC PwC conducted a benchmark analysis, in order to evaluate how companies are positioned and are moving in terms of internal control system over non-financial information.

Organizations involved in the analysis have been selected among a panel of corporations of the insurance industry and companies regarded as “best in class�.

In the following slides, the main findings of the benchmark activity are disclosed.

Internal

Main findings of the analysis The results obtained show how the panel, regarding the framework of the internal control system over non-financial information, seems robust in relation to the «Control Environment» component, fairly robust in relation to the «Risk Assessment» and «Information & Communication» components and weakly structured in relation to the «Control Activities» and «Monitoring Activities» components.

Results by CoSO Framework components

Control Environment

Risk Assessment

Control Activities

Results obtained Potential results Internal

Information & Communication

Monitoring Activities

Summary of results by CoSO Framework components Actions for improvement Control Environment

▪ Better assignment of responsibilities ▪ Provide training on sustainability matters

Risk Assessment

▪ Implement an integrated Enterprise Risk Management system ▪ Define a more structured approach to materiality

Control Activities

▪ Develop ITGCs on non-financial reporting system ▪ Introduce segregation of duties ▪ Implement preventive manual and automatic controls

Information and Communication

Monitoring Activities

Internal

▪ Formalize policies and procedures related to the internal control system ▪ Structure the organization for implement an internal control system ▪ Provide monitoring activities related to internal control system ▪ Implement an action plan related to the deficiencies of the system

Our perspectives of current practices Structuring an internal control system over non-financial information may be based on two different approaches: •

the analysis of some components of the CoSO Framework, with a specific focus on “Risk Assessment” and “Control Activities”;

•

the analysis of all components of the CoSO Framework, in order to design an Integrated Internal Control System of the organization.

Risk and control matrix

Internal

Outputs of the analysis

Detailed analysis of CoSO components as the layer on which develop detailed and focused approach on ICNFR

Thank you!

Paolo Bersani PwC | Partner Direct: +39 011 5773273 | Mobile: +39 348 9995712 Email: paolo.bersani@pwc.com PricewaterhouseCoopers Advisory SpA Corso Palestro 10, 10122 Turin, Italy www.pwc.com/it

This publication has been prepared for general guidance on matters of interest only, and does not constitute professional advice. You should not act upon the information contained in this publication without obtaining specific professional advice. No representation or warranty (express or implied) is given as to the accuracy or completeness of the information contained in this publication, and, to the extent permitted by law, PricewaterhouseCoopers Advisory SpA, its members, employees and agents do not accept or assume any liability, responsibility or duty of care for any consequences of you or anyone else acting, or refraining to act, in reliance on the information contained in this publication or for any decision based on it. © 2018 PricewaterhouseCoopers Adisory SpA. All rights reserved. In this document, “PwC” refers to PricewaterhouseCoopers Adisory SpA which is a member firm of PricewaterhouseCoopers International Limited, each member firm of which is a separate legal entity.

Internal