Risk management

The global situation in 2021 was largely defined by the COVID-19 pandemic, which triggered a series of global socioeconomic consequences: quarantine and self-isolation requirements, border closures, event cancellations and postponements, worldwide protests and a major global economic recession.

The events of 2021 driven by pandemic restrictions, and the sanctions imposed on Russia, resulting in lower energy demand and weaker rouble, negatively affected the entire Russian economy and social sphere.

Due to the decline in economic activity amid an economic recession, Russia’s population mobility decreased significantly, which led to a significant drop in long-distance passenger traffic and passenger-kilometres.

In this situation, the Company took measures to improve its financial and economic position in 2021:

• A more rigorous, in-depth analysis of the performance of JSC FPC’s passenger trains was conducted, and proposals for optimising the Company’s key performance indicators were developed and implemented
• Targeted marketing promotions and fares were developed and applied
• Passenger train schedules and train set options were adjusted for domestic services

Risk management system

Risk management at JSC FPC is a continuous and systematic process embedded throughout the organisation, integrated with business processes and aimed at mitigating exposure and strengthening the assurance that JSC FPC’s objectives and goals will be achieved.

All Company units are involved in the risk management process within their scope of responsibility.

The Risk Management Department is responsible for overall coordination and methodological support of the risk management process, as well as operational control of how it is run by JSC FPC’s units and, according to the established procedure, by subsidiaries and affiliates, including the review of JSC FPC units’ progress on risk treatment plans, response to identified variances and gaps in the risk management and internal control (RM/IC) system, which have led or may lead to negative consequences, scheduled and unscheduled RM/IC audits, and preparing and submitting reports to JSC FPC’s management.

All risks in JSC FPC are managed on the basis of the following:

• JSC FPC Risk Management Policy approved by the decision of the Company’s Board of DirectorsMinutes No. 11 dated 27 December 2019.
• Methodological recommendations on determining the acceptable value of risks (risk appetite), approved by the decision of the Board of Directors of JSC FPCMinutes No. 24 dated 02 July 2020.
• Methodological Recommendations on Risk Management and Internal Control approved by the decision of the Director General of JSC FPCJSC FPC Directive No. 258r dated 20 March 2020.
• Regulations on Interaction in the Risk Management and Reporting Process, approved by the order of the Director General of JSC FPCJSC FPC Directive No. 258r dated 20 March 2020.

The Internal Audit Department is responsible for assessing the RM/IC system reliability and effectiveness.

Governance principles

The Risk Management and Internal Control Policy (the Policy) developed in line with the Risk Management and Internal Control Policy of the Parent Company was approved by JSC FPC’s Board of Directors.

In accordance with the Policy, the main purpose of the RM/IC system is to provide reasonable assurance that the following will be achieved:

• Strategic objectives
• Operational objectives
• Objectives in ensuring compliance with applicable international regulations, regulations of the Russian Federation and internal regulations of the Company
• Objectives in ensuring the reliability, timeliness and quality of all types of reporting

The Risk Management and Internal Control Policy stipulates that RM/IC system organisation and functioning in JSC FPC is to be carried out in accordance with the principles set out in GOST R ISO 31000:2010 Risk Management. Principles and guidelines, namely:

• Risk management creates and protects value
• Risk management is an integral part of all organisational processes
• Risk management is part of the decision-making process
• Risk management is explicitly associated with uncertainty
• Risk management is systematic, structured and timely
• Risk management is based on the best available information
• Risk management is adaptable
• Risk management takes into account human and cultural factors
• Risk management is transparent and takes into account the interests of stakeholders
• Risk management is dynamic, iterative and responsive to changes
• Risk management contributes to the continuous improvement of the organisation.

Main objectives of the RM/IC system:

• Creation of infrastructure and a regulatory and methodological basis for the effective functioning of the risk management process
• Integration RM/IC procedures into the strategic and operational activities of the Company, which will enable proactive responses to risks and negative changes in the external and internal environment (through planning and implementation of risk treatment activities)
• Raising risk awareness among RM/IC participants and other stakeholders
• Reduction in the number of unforeseen events that could have a negative impact on the achievement of JSC FPC’s goals

Central decision-making bodies for risk management at JSC FPC are its Board of Directors and the General Director.

The Company has the Audit and Risk Committee of the Board of Directors and the Risk Management Committee to prepare recommendations for management decision making.

Improvement of RM/IC system in 2021

In a period of uncertainty in 2021, the existing risk management system helped improve the adaptability of the Company, its core processes and systems, which enabled prompt review of business goals and preparation of scenario options for JSC FPC’s development until 2025. The risk management system was therefore geared to supporting the Company in achieving its goals.

During 2021, a number of measures were implemented to improve the RM/IC system effectiveness.

The results of the assessment of the reliability and efficiency of RM/IC system in 2021 demonstrate that, in general, the RM/IC system is reliable and efficient:

• The elements of JSC FPC’s RM/IC system are established in accordance with the principles of, and approaches to, its organisation approved by the Board of Directors, COSO documents and GOST ISO 31000
• The risk management process is designed to help achieve the Company’s strategic goals
• Certain observations in the functioning of the RM/IC system did not affect the achievement of the Company’s objectives.

The Internal Audit Department proposed ways to improve the RM/IC system effectiveness.

In 2021, the regulatory and methodological framework of JSC FPC was updated to improve approaches to the identification, analysis and assessment of the Company’s risks, as well as the approach to identifying key risks and setting risk appetite for them.

The Internal Audit Department assessed the reliability and effectiveness of the RM/IC process in 2021. Based on the assessment results, a conclusion was made that the elements of the RM/IC process in JSC FPC are built in accordance with the principles and approaches to its organisation approved by the Board of Directors of JSC FPC, COSO documents and GOST R ISO 31000-2019. In order to further improve the efficiency of the RM/IC process, a number of relevant recommendations were prepared.

In 2022, it is planned to continue further improvement of JSC FPC’s RM/IC, taking into account the implementation of a project to improve and develop an integrated risk management model elaborated by the Parent Company.

In 2022, as part of the approval of the 2021 Annual Report of the Internal Audit Department, the issue of assessment of reliability and efficiency of the RM/IC system in 2020 will be considered.

The H1 Report, which will be submitted for approval in August 2022, will include the issue of assessment of reliability and efficiency of the RM/IC system in 2021.

In its operations, JSC FPC uses an approach driven by Three Lines of Defence Model, which is based on roles and responsibilities sharing. Each of three lines increases the likelihood of JSC FPC successfully achieving its objectives.

Key risk factors

Key risks factors associated with JSC FPC’s operations:

• Lower GDP growth
• Higher CPI growth
• Significant fluctuations in inventory and fuel/energy prices
• Increased competition (adjustments to price policy and dumping by JSC FPC’s competitors, expansion of air transport infrastructure)
• Lower or no price indexation
• Changes in the economic and political environment in Russia
• Deteriorating social and demographic situation in urban and rural areas
• Lower household purchasing power and real disposable income
• Exchange rate volatility
• Increased governmental support for air transport

Risk treatment methods applied

The following risk treatment methods are currently used at JSC FPC:

• Risk avoidance — withdrawing from an activity or project associated with a particular (inherent) risk where other treatment strategies (risk mitigation, risk sharing, risk acceptance) are not economically viable or feasible. Given that any activity of the Company is associated with risks and complete withdrawal from any activity leads to its discontinuation, this strategy can be used to manage individual, specific risks and/or new activities or projects.
• Risk mitigation — risk treatment involving activities to reduce the likelihood of a risk event and/or the potential impact of its occurrence to an acceptable level. Risk mitigation activities may include both the deployment and execution of control procedures and the implementation of other measures (e.g., creating provisions to cover losses caused by a risk occurrence).
• Risk acceptance — a risk treatment method where no active risk treatment is used, applied where: a) the level of risk is acceptable; and b) risk avoidance, mitigation or sharing are not economically viable or feasible (e.g., political or macroeconomic risks).
• Risk sharing — transfer of a risk where the Company’s risk mitigation is ineffective, while the level of risk is not acceptable (the risk cannot be accepted) and third-party services can be used for risk treatment. Risk sharing is mainly aimed at mitigating the consequences rather than the likelihood of risk occurrence.

JSC FPC’s risk management structure

The risk management structure represented is in line with JSC FPC’s Risk Management and Internal Control Policy.

Risk management process stages

In line with the Policy, the risk management process at JSC FPC consists of the following stages:

1. Risk identification
2. Risk analysis
3. Risk treatment
4. Monitoring and review
5. Communication and consultation

As part of these processes, risk reports are prepared to be submitted to the executive bodies, Audit and Risk Committee, the Company’s Board of Directors and external stakeholders (if necessary), including information on risks, risk treatment measures and effectiveness of the RM/IC system.

A total of 103 risks were identified for JSC FPC in 2021:

• 2 high level risks
• 3 medium level risks
• 98 low level risks

KEY RISKS

According to the above methodology, 14 risks were identified as key risks for JSC FPC in 2021.

• Decline in passenger-kilometres
• Increase in passenger transportation cost
• Failure to deliver key investment projects
• Decrease of labour productivity to target values
• Restriction of the Company’s operations, bringing JSC FPC to liability
• Risk of net profit falling below target
• Significant garbling of accounting statements
• Corruption risks
• Fire at stationary facilities
• Violations of safety rules for passenger trains
• violation of industrial safety requirements;
• Failure to comply with the JSC FPC Procurement Plan
• Loss (disclosure) of documents and leakage of personal, proprietary, confidential and insider information
• Risk of underfunding of JSC FPC’s obligations under the Collective Bargaining Agreement

Risk map

In order to provide a visual representation of risks materiality, a risk map has been plotted.

The Y-axis of the risk map displays the magnitude (degree) of the impact of identified risks on JSC FPC’s operations, while the X-axis shows the likelihood of their occurrence.

Relations of key risks and the Company’s strategy

JSC FPC’s operations are carried out in accordance with the Company’s Development Strategy until 2030 (the Strategy), which incorporates the parameters contained in the following documents approved by the Government of the Russian Federation: Transport Strategy of the Russian Federation until 2030, Strategy of Railway Transport Development in the Russian Federation until 2030, and the Long-Term Development Programme of the Parent Company until 2025.

In addition, the Strategy identifies the following list of strategic benchmarks:

• Number of passengers carried
• Revenue
• EBITDA
• net debt / EBITDA
• Carriage acquisition

Major factors that affected JSC FPC’s KPI performance in 2021:

• Changes in the macroeconomic environment taking place faster than anticipated
• Deterioration of the geopolitical situation (US dollar, euro, Swiss franc exchange rates, imposition of sanctions against Russia)
• Competition from alternative modes of transport (air, road)
• Shorter average distances travelled by passengers
• Increased fares in the regulated segment with no compensation from the government
• Aggressive pricing policy of air carriers, aircraft fleet renewals, expansion of air carrier route networks, increased choice of flights, increased subsidies to air carriers
• Growing competition in the domestic market for rail passenger services
• Changes in demand for passenger services (including shifts in passenger traffic from domestic to international travel, growth in the cost of accommodation and recreation in major cities of the Russian Federation and its tourist and recreation destinations)
• Decrease in the households’ nominal income and inflation rising above forecast
• Epidemic outbreaks

The Strategy outlines a number of strategic projects that drive the achievement of the objectives set. Strategic projects are implemented by JSC FPC taking into account the macroeconomic situation in the country, with appropriate adjustments to the pace and scale of implementation and the amount of resources required.

Since key risks may have a significant negative impact on JSC FPC’s operations, the achievement of strategic goals, and the implementation of the Strategy, the Company pays due attention to managing its key risks. Key risks are approved by the General Director based in line with the decision of the Board of Directors of JSC FPC based on the results of their review and taking into account the opinion of the Audit and Risk Committee. In the future, the Board of Directors supervises the implementation of measures to treat such risks by JSC FPC’s divisions.

In addition, JSC FPC identified the risk of deviation from the achievement of the planned effects of the implementation of strategic initiatives of JSC FPC for the period up to 2030 — within the framework of this risk, the Company monitors the deviation from the planned effects for all strategic initiatives.

SUSTAINABILITY RISKS

JSC FPC also identified sustainability risks, possible consequences for the Company in case of their occurrence and developed measures to treat the same.

Internal control

Internal control at JSC FPC is carried out in accordance with the Risk Management and Internal Control Policy.

Internal control is an integral, indispensable part of the risk management system, while the RM/IC system is part of corporate governance.

Internal control serves as a key risk management tool, addressing the following tasks:

• Creation of a control environment enabling both the development and implementation of risk treatment control procedures and the operation of the risk management process across all stages
• Effective information sharing and communication both within the Company and with external stakeholders
• Ensuring proper monitoring of the set-up and operation of the risk management process across all stages