Internal
Audit
System.

Internal Audit System

The Company has an adequate and effective Internal Audit System, which consists of all internal control mechanisms and procedures, including risk management, internal control and regulatory compliance, and continuously covers every activity of the Company and contributes to its safe and effective operation.

Objectives

The Company’s Internal Audit System aims at the following objectives, in particular:

a) The consistent implementation of the business strategy, with the effective use of available resources.
b) The efficient operation of the Internal Audit Unit, whose organization, operation and responsibilities are defined in the law and in its Rules of Operation.
c) The efficient operation of the Risk Management Unit, through the recognition and management of the essential risks associated with the business activity and operation of the Company.
d) Ensuring the completeness and reliability of the data and information required for the accurate and timely determination of the financial situation of the Company and the preparation of reliable financial statements, as well as its non-financial statement, in accordance with article 151 of L. 4548/2018.
e) The effective operation of the Regulatory Compliance Unit, through compliance with the regulatory and legislative framework, as well as the internal regulations governing the operation of the Company.

Management.

The BoD ensures that the functions constituting the Internal Audit System are independent of the business sectors they control, and that they have the appropriate financial and human resources, as well as the powers to operate effectively, as required by their role. The reporting lines and the division of responsibilities are clear, enforceable and duly documented.

Internal Audit Unit Mission

The main mission of the Internal Audit Unit is to monitor and improve the operations and policies of the Company and its subsidiaries (hereinafter the “Group”) and to provide advisory support by submitting relevant proposals to the BoB regarding the Internal Audit System.
The Internal Audit Unit is independent of the Company’s business units. It reports, operationally, to the Company’s Audit Committee and, administratively, to the Managing Director, if appointed, otherwise to the Executive Vice President of the Board of Directors, if appointed, otherwise directly to the Board of Directors. The Internal Audit Unit has and implements internal Operating Regulation, which is approved by the Board of Directors, following a proposal of the Audit Committee. Head of Unit the Head of the Internal Audit Unit: a) Is appointed by the BoD following a proposal by the Audit Committee. The proposal has an advisory character, is evaluated by the Board and in case of reservations or different opinion of the Board, it is re-evaluated by the Audit Committee and resubmitted, after taking into account the comments of the Board. b) Is a full-time and on exclusive basis employee, personally and operationally independent and objective in the performance of his duties, and has the appropriate knowledge, skills and relevant professional experience. He may not be a member of the BoD of the Company or a member with the right to vote in standing committees of the Company, nor should he have close ties with anyone who holds one of the above qualities in the Company or in a company of the Group. c) Is subject: - administratively, to the Managing Director, if appointed, otherwise to the Executive Vice President of the Board of Directors, if appointed, otherwise directly to the BoD; and ELVALHALCOR S.A. operationally, to the Company’s Audit Committee.

Risk Management Unit Mission

The purpose of the Risk Management Unit is, through appropriate and effective policies, procedures and tools, to assist the BoD in identifying, evaluating and managing the essential risks associated with the business and operation of the Company and the Group, with adequacy and efficiency.
Organization and operation The Risk Management Unit is staffed by its Head. The Head of the Risk Management Unit is appointed by the Board of Directors of the Company following a proposal of the Company Audit Committee and has sufficient knowledge and experience.
The Head of the Risk Management Unit reports, operationally, to the Company’s Audit Committee and, administratively, to the Managing Director, if appointed, otherwise to the Executive Vice President of the BoD, if appointed, otherwise directly to the Board of Directors.
The Head of the Risk Management Unit provides the Company Audit Committee and the Board of Directors with impartial reports and updates regarding risk issues, the degree of ELVALHALCOR S.A. compliance with the risk policies, the results of the review of the risk identification and risk assessment process (risk assessment), the operation of the Company’s management and response procedures to them (risk response) and the results of monitoring their development (risk monitoring).
Responsibilities
The main responsibility of the Risk Management Unit is the identification, evaluation, management and monitoring of risks, both at company and Group level, in order to maintain stability and ensure the continuity of its operations.

Regulatory Compliance Unit Mission

The purpose of the Regulatory Compliance Unit is to assist the BoD in the full and continuous compliance of the Company with the current legal and regulatory framework and the internal Regulations and Policies that govern its operation, providing at all times a complete picture of the degree of achievement of this goal.
Organization and operation
The Regulatory Compliance Unit is staffed by its Head. The Head of the Regulatory Compliance Unit is appointed by the Board of Directors of the Company following a proposal of the Audit Committee and has sufficient knowledge and experience. The Head of the Regulatory Compliance Unit reports, operationally, to the Company’s Audit Committee and, administratively, to the Managing Director, if appointed, otherwise to the Executive Vice President of the Board, if appointed, otherwise directly to the Board of Directors.
Responsibilities / Obligations
The Regulatory Compliance Unit, through its Head, has, inter alia, the following responsibilities: i) Recognizes, evaluates, monitors and effectively manages the risks to which the Company and the Group may be exposed due to failure to comply with the laws and regulations governing its organization, operation and activities (regulatory risk) and supports the Audit Committee in monitoring the management of these risks. ii) Remains constantly updated and collects, records, processes and interprets the continuous changes that occur in the legal and regulatory framework that governs the organization and operation of the Company, records the discrepancies in relation to the requirements and obligations arising for the Company and the Group and informs the Management about the above and the consequences that it is estimated that they may have for the Company and the Group.

Assesment of the System

The Internal Control System is subject to periodic assesment by an independent auditor, in accordance with Law 4706/2020, and in particular Article 14, paragraph 3, item (i) thereof, Decision No. 1/891/30.9.2020 of the Hellenic Capital Market Commission, as amended by Decision No. 2/917/17.06.2020 of the Hellenic Capital Market Commission and currently in force, as well as the relevant Policy and Procedure established and implemented by the Company.