The internal control and risk management system

The Internal Control and Risk Management System (ICRMS), the main aspects of which are described in the “Other information” section of the Annual Report, is subjected to regular audits and updates, in order to ensure its ongoing adequacy and effectiveness in controlling the main areas of risk for company activities. This is assessed in relation to the typical features of the company’s operating sectors and its organizational structure and based on any new legislation or regulations.

A key role in the audit and assessment process for the ICRMS as a whole is given to the Internal Audit department, which conducts audits (operational, financial and compliance audits focusing on the aspects covered by Italian Legislative Decree 231/01) to implement the annual Audit Plan prepared using a “top-down, risk based” approach and approved, together with the resource budget, by the Board of Directors and, for aspects relevant for the purposes of Italian Legislative Decree 231/01, by Eni SpA’s Vigilance Body.

With reference to the main activities performed by the Internal Audit department, it is noted that:

• the number of integrated audits conducted in 2013 is in line with the average of all the audits conducted in the last five years. In particular there was a recorded increase in the average duration of the integrated audits conducted in 2013 due to the addition of the Anti-Corruption audits and the independent monitoring carried out for Sarbanes Oxley purposes;
• the average number of corrective actions per audit has remained stable for the various sectors, and to date substantial observance of the implementation times for planned actions has been recorded, confirming the attention paid by the audited structures to the time-scales agreed;
• risk assessment activities in 2013 were reduced after the process of integrated risk management got up to speed. The results are used by Internal Audit to plan their audit activities, adding more detailed analysis where deemed necessary in terms of risk assessment;
• there was a sharp increase in the number of ICRMS training initiatives compared to the previous year. These were aimed at the management of Eni SpA and its main subsidiaries in Italy and abroad and designed to provide an organic and integrated vision of the ICRMS and develop awareness of the role of management in the implementation and operation of an effective and efficient ICRMS. In particular, in 2013 “on site” workshops were conducted in about 15 Countries in addition to Italy.