Risk management system

The risk management system in the PZU Group consists in the following: 

• split of duties and tasks performed by statutory bodies, committees and individual organizational units and cells in the risk management process;
• risk management process, including risk identification, measurement and assessment, monitoring and control methods, risk reporting and undertaking management actions; the framework for this process is universal among financial market entities.

The consistent split of duties and tasks in the PZU Group and in individual financial sector subsidiaries covers four decision-making levels.

The role of the PZU Group Risk Committee is to provide support to the supervisory boards and management boards of PZU Group subsidiaries in implementing an effective risk management system that is coherent for the entire PZU Group. The operational objective of the PZU Group Risk Committee is to coordinate and supervise activities related to the PZU Group’s risk management system and processes.

The first three are: 

• The Supervisory Board, which supervises the risk management process and assesses its adequacy and effectiveness; performs duties as part of its decision-making powers defined in a given entity’s Articles of Association and the Supervisory Board bylaws, as well as through the Audit Committee; 
• The Management Board, which organizes the risk management system and ensures that it is operational, by adopting strategies and policies, setting the level of risk appetite, defining the risk profile as well as tolerance levels for the individual categories of risk;
• The committees, which decide about limiting the levels of individual risks to fit the risk appetite framework they have defined, adopt procedures and methodologies for mitigating the individual risks and accept the limits for individual risk types.

The fourth decision-making level pertains to operational measures divided into three lines of defense:

• the first line of defense – entails ongoing risk management at the entities’ business unit and organizational unit level and decision-making as part of the risk management process, taking into account the limits for individual risks; 
• the second line of defense – risk management by specialized units responsible for risk identification, measurement, monitoring and reporting, as well as for limits control; 
• the third line of defense – internal audit which conducts independent audits of the individual elements of the risk management system, as well as of control procedures.

Chart of the organizational structure for the risk management system