The Company has implemented and is continuously improving a centralized risk management and internal control model.

The effective functioning of the risk management and internal control system allows ensuring the proper control of the Company’s financial and economic activities and providing the Company’s management with a set of appropriate tools to identify, assess, manage and monitor risks, as well as to exchange the necessary information between stakeholders in order to make risk-oriented management decisions.

The Company’s risk management and internal control system complies with the requirements of the Russian legislation, recommendations of the Corporate Governance Code of the Bank of Russia and best practices and represents a set of risk management and internal control processes implemented on the basis of the existing organizational structure, internal policies and regulations, procedures and methods of risk management and internal control applied in the Company at all levels of management and within all functional areas.

Continuous development and improvement of the Company’s risk management and internal control system allows responding to changes in the external and internal environment in a timely and correct manner, improving the efficiency and effectiveness of activities, maintaining and increasing the Company’s value.

In order to ensure consistent, continuous and integrated development of the risk management and internal control system in accordance with the Rosneft Long-Term Development Program, the Risk Management and Internal Control System Development Plan has been developed and is updated on an annual basis. It includes measures aimed at improving the risk management and internal control processes and organizing interaction and information exchange within the risk management and internal control system.

The main directions of developing the risk management and internal control system for the medium term are:

• improvement of the methodological framework of the risk management and internal control system taking into account changes in the legislation of the Russian Federation and trends in the best international practices;
• improvement of the risk management and internal control infrastructure and process;
• introduction of the full-featured information resources, implementation of the risk management and internal control system information support, etc.;

The Company’s main local regulatory document regulating the risk management and internal control system is the Company’s Policy “Risk Management and Internal Control System”, which defines the main goals, objectives, principles of effective functioning of the Company’s risk management and internal control system, as well as the list and rules of interaction between its key subjects.