Internal Controls
Copel is a publicly traded private company whose shares are traded on various stock exchanges; as such, it is subject to compliance with an extensive set of domestic and foreign laws and regulations, including the requirement to formally establish a framework for risk management, compliance, and internal controls. To achieve these objectives, Copel follows the criteria established in the COSO 2013 Integrated Framework, developed by the Committee of Sponsoring Organizations of the Treadway Commission, a U.S. organization whose primary objectives include integrating transparency and trust requirements into companies’ financial reports, supported by standards of ethics and the effectiveness of their internal controls. That said, COSO defines Internal Control as “a process led by the entity’s governance structure, management, and other professionals, and designed to provide reasonable assurance regarding the achievement of objectives related to operations, disclosure, and compliance.”
This definition reflects several fundamental concepts, emphasizing that internal control is a process with the following characteristics:
- Conducted to achieve objectives in one or more categories—operational, disclosure, and compliance.
- A process consisting of ongoing tasks and activities—a means to an end, not an end in itself.
- Performed by people—it is not simply a manual of policies and procedures, systems, and forms, but concerns people and the actions they take at every level of the organization to implement internal control.
- Able to provide reasonable—but not absolute—assurance to an entity’s governance structure and senior management.
- Adaptable to the entity’s structure—flexible in its application to the entire entity or to a specific subsidiary, division, operating unit, or business process.
This definition is intentionally broad and captures fundamental concepts regarding how organizations develop, implement, and conduct internal control, providing a foundation for application to all organizations operating across different organizational structures, industries, and geographic regions.
Three Lines Model
As established in NPC 0104 – Integrated Corporate Risk Management Policy, the Company adopts the IIA’s “Three Lines” model for the effective management of risks and controls, through which the responsibilities of each stakeholder are clearly defined to ensure there are no gaps in the process.
Below is a breakdown of the Three Lines to clarify responsibilities in accordance with the Company’s structure:
- Management: directly responsible for the actions (including risk management) needed to achieve the organization’s objectives through risk-based decision-making and the allocation of resources for organizational oversight. This is where the following are located:
- First Line: encompasses the following roles:
- implementing corrective actions to resolve deficiencies in processes and controls;
- executing and maintaining effective internal controls;
- conducting daily risk and control procedures;
- identifying, assessing, controlling, and addressing risks, guiding the development and implementation of internal policies and procedures to ensure that activities align with Copel’s goals and objectives; and
- implementing detailed procedures and controls to oversee execution.
- Second Line: Assumes the following roles:
- assisting business unit management in developing processes and controls to manage risks;
- providing guidance and training on risk management processes, internal controls, and the code of conduct; and
- monitoring the implementation of effective risk management practices by the First Line.
- Internal Audit: represents the Third Line. It provides independent and objective assessment and advice on matters related to the achievement of objectives, to provide clarity and confidence, as well as to promote and facilitate continuous improvement through rigorous investigation, insightful communication, and organizational oversight. It combines the roles of:
- providing objective assessments of the effectiveness of governance, risk management, and internal controls, including how the first and second lines of defense achieve risk management and control objectives, and recommending, where appropriate, corrective actions or improvements; and
- reporting the results of its work to a sufficiently high level within the organization to fulfill its responsibilities independently.
- First Line: encompasses the following roles:
Segunda Linha: Controles Internos na Copel
The Internal Controls Department is responsible for coordinating and maintaining Copel’s internal control environment. One of its main objectives is to comply with the Sarbanes-Oxley Act (SOX), a requirement imposed by U.S. authorities on all companies that trade securities on the New York Stock Exchange (NYSE). As a result, Copel must annually review and evaluate its internal controls and issue a certificate attesting to their compliance with the standards of Section 404 of SOx, a practice it has followed since 2005.
Internal controls provide reasonable (but not absolute) assurance regarding operational, disclosure, and compliance objectives, as they depend on people and the actions they take at every level of the organization to implement them; in this case, there will always be a risk that effective controls may be “circumvented or bypassed” (“management override of controls”). Furthermore, in addition to the existence of authority controls, reporting mechanisms, and senior management’s monitoring of deficiencies—all aimed at mitigating the risk of “management override of controls”—the Company has a robust and well-established process to encourage reporting through the Whistleblower Hotline.
Established in 2021, ESG metrics are part of the variable compensation criteria at all levels of Copel, with the aim of strengthening commitment, employee engagement, and meritocracy. In 2025, performance in sustainability, occupational health and safety, and internal controls will account for 20% of variable compensation at all levels, linked to the following areas:
- Internal controls indicator;
- Occupational safety indicator related to the accident severity rate;
- Performance indicator in the CSA/S&P Global sustainability assessment.
The findings regarding the internal controls environment, issued by an independent audit in a document called the Internal Controls Letter or Comment Letter, are one of the components of these metrics. In this letter, control deficiencies can be classified as:
- Control Deficiency: occurs when an internal control is not functioning as designed or there is no control in place to prevent or detect errors in a timely manner. It is the least serious deficiency and may not have a significant direct impact on the financial statements.
- Significant Deficiency: a failure or set of failures in internal controls that is less severe than a material deficiency but important enough to warrant governance attention. It may affect the organization’s ability to record, process, or report financial information reliably. It does not result in material misstatements in the financial statements but represents a relevant risk.
- Material Deficiency: a failure, or set of failures, in internal control over financial reporting that results in a reasonable possibility that a material misstatement in the financial statements will not be prevented or detected in a timely manner. It is the most serious deficiency and directly impacts the reliability of the financial statements.
Targets set:
- 2022: Material deficiencies in internal controls – target ZERO.
- 2023: Material deficiencies in internal controls – target ZERO.
- 2024: Significant and material deficiencies in internal controls – target ZERO.
- 2025: Significant and material deficiencies in internal controls – target ZERO.
The targets have been achieved in the last 3 years, as shown in the following graphs:
