Integrated Corporate Risk Management
The Company’s management of corporate risks is directly related to sustainable growth, Copel’s profitability and the creation of value for its shareholders. This process allows us to identify not only threats but also business opportunities, and to optimize decision making and the continuous improvement of results by connecting more closely the business strategy and objectives to the risk to which it is subject.
The risk management and internal control methodology adopted by Copel is based on recognized frameworks and standards, such as the Committee of Sponsoring Organizations of the Treadway Commission – COSO and the IBGC Code of Best Corporate Governance Practices.
In its Policy for Integrated Corporate Risk Management, Copel defines the principles and guidelines concerning the process of corporate risk management integrated with the strategy and performance to be observed and applied in the Company.
The activity of Integrated Corporate Risk Management is linked to the Governance, Risk and Compliance Office, which coordinates the activities related to compliance, corporate risk management and internal controls in the scope of Copel (Holding), its wholly-owned subsidiaries, controlled and associated companies.
The Risk Management aims to contribute to the strengthening of the Corporate Governance process, to increase assurance as to the achievement of objectives, to promote greater transparency for the interested parties and to improve the Company’s internal control environment. Furthermore, it aims to add and preserve value, minimizing losses by identifying opportunities and threats, meeting international standards and relevant legal and regulatory requirements, improving operational effectiveness and efficiency, and enhancing the management of crises or incidents.
Integrated Corporate Risk Management Policy
Copel’s crisis management process is aligned with the Company’s strategy and supports decision making in the face of eventual contingencies that may cause reputational, operational, financial and strategic risks, in order to maintain the integrity and availability of its assets, as well as mitigate and remediate negative impacts.
Copel has a Policy for Integrated Management of Corporate Risks that covers the corporate areas, its wholly-owned subsidiaries and controlled companies, and has been in effect since 2009. Moreover, the Policy is recommended to its jointly-controlled companies, associated companies and other Copel’s equity holdings. The guidelines of this policy are based on Copel’s values, on its Code of Conduct and on the guidelines issued by COSO – Committee of Sponsoring Organizations of the Treadway Commission. The last revision occurred in 2020 and was approved at the 208th Ordinary Meeting of the Board of Directors, on November 12, 2020, after the favorable recommendation of the 2421st Board of Directors Meeting – Redir, on November 5, 2020, and of the 226th Meeting of the Statutory Audit Committee, on November 6, 2020.
Copel’s Risk Management Policy is publicly available and provides for the integration of risk management with the definition of strategies and performance monitoring, the formal establishment of roles and responsibilities, the creation and maintenance of an adequate infrastructure, the definition of a common methodology for the entire company, and the declaration of risk appetite
Additionally, the Policy provides for instruments for the adequate monitoring of risks and protection of the Company’s value, highlighting those described below:
- Practices for incident reporting and control;
- Monitoring the adequacy and effectiveness of responses to risk, the accuracy and completeness of disclosures and the timely correction of deficiencies;
- Periodic reports to the Statutory Audit Committee and to the Board of Directors.
The focus of the management of crisis situations is on the agile, effective and articulated service with other governmental entities and society, in eventual emergencies that may directly affect people, the environment and the Company’s operations.
Risk Appetite Statement
In its risk appetite statement, Copel is based on the following pillars:
- to act in the highest ethical and compliance standards;
- ensure that activities or practices adopted are aligned with sustainability practices with emphasis on climate change and socio-environmental aspects;
- ensure that in all of Copel’s operations occupational safety is strictly observed;
- ensure the constant improvement of the cybersecurity level of Information Technology and Operation Technology;
- not to operate in segments that are not related to its core business;
- to invest in businesses that are adequate to Copel’s portfolio strategy and capital allocation.
Responses to risks are placed within the following categories: accept, avoid, accept and expand the performance target, reduce and share. Those responsible for risk shall treat risk according to the priority assigned and apply the appropriate risk responses in the context of business objectives and performance targets.
Risk Culture
Aiming at training and dissemination of risk management at Copel, the Governance, Risk and Compliance Department (DRC) periodically promotes training cycles for employees, managers, board members and administrators.
The contents are customized based on the target audience, ranging from basic concepts and presentation of the methodology to the exposure of practical cases on how to perform analyses with adequate depth and consistency.
Furthermore, training on the risk management policy is held annually for the company’s senior management executives, as well as on the risk management methodology for employees.
Emerging Risks
Following the Corporate Risk Policy guidelines, new and emerging risks should be identified so that management can implement responses in a timely manner. These risks should be escalated to the Board of Directors for knowledge and potential action.
Sensitivity Analysis and Stress Testing
In risk assessments for new businesses, whether acquisitions, mergers or divestitures intended by Copel, the risk analysis includes the Monte Carlo statistical simulation, which is based on massive random sampling to obtain numerical results of financial impacts, which are grouped into confidence scenarios.
Concerning the management of financial risks, sensitivity analyses are developed for the exchange rate risk, sensitivity analysis of the operations with derivative financial instruments, and sensitivity analysis of the interest rate risk and monetary variations. Sensitivity analysis is also performed on the operations of purchase and sale of energy.
Supply Chain Risk Management
In compliance with the law, and in order to guide and establish responsibilities for the responsible areas in the Company and for suppliers, in every contracting process the need to prepare a matrix of risks and responsibilities is evaluated, which considers, in addition to strategic aspects related to the purpose of the contract, aspects of social and environmental responsibility, provided for in Copel’s Sustainability Policy, Environmental Policy, Human Rights Policy and other corporate policies.
The results obtained with the application of the Risks and Responsibilities Matrix serve as guidance for the identification of the major points of attention in the execution of the contract and the severity of the materialization of the incidents.
Among the risks related to the supply chain, the following stand out: violation of human rights, accidents with employees; precarious installations and working conditions; and accidents or damages to the population.
Especially in the economic-social dimension, there are risks related to Copel’s economic-financial dependence, legal obligations, tax, social and labor charges, and salaries and additional payments.
The risks related to the environment involve non-compliance with environmental legislation, inadequate origin of inputs and deficiency in waste treatment. Copel seeks to mitigate these risks by determining strict contracting rules, reaffirming its commitment to sustainable development.
