Basic Internal Audit Regulations

Transcription

1 Basic Internal Audit Regulations OF IBERDROLA, S.A. AND ITS GROUP (approved by the Board of Directors on 15 December 2015, upon a proposal of the Audit and Risk Supervision Committee dated 14 December 2015) 15 December 2015

2 Content

3 Content / 1 TITLE I.- NATURE AND REGULATION 2 Article 1.- Nature 2 Article 2.- Regulation 2 TITLE II. INTERNAL AUDIT AREA 2 Article 3.- Director of the Internal Audit Area 2 Article 4.- Internal Audit Divisions of the Group s Companies 3 Article 5.- Framework of Relations between the Internal Audit Area and the Internal Audit Divisions of the Companies of the Group 3 TITLE III.- POWERS 4 Article 6.- Scope of Powers 4 Article 7.- Powers relating to the Audit and Risk Supervision Committee 4 Article 8.- Powers of Supervision of the Information Technology and Internal Control and Risk Management Systems 4 Article 9.- Other Powers 5 TITLE IV. RESOURCES, BUDGET, AND ANNUAL ACTIVITIES PLAN 5 Article 10.- Material and Human Resources 5 Article 11.- Budget 5 Article 12.- Annual Activities Plan 6 Article 13.- Activities Report and Recommendations 6 TITLE IV. FACULTIES AND DUTIES 6 Article 14.- Faculties 6 Article 15.- Duties 6 TITLE V. COMPLIANCE, DISCLOSURE, AND INTERPRETATION 7 Article 16.- Compliance 7 Article 17.- Dissemination 7 Article 18.- Interpretation 7

4 2 TITLE I.- NATURE AND REGULATION Article 1.- Nature The Internal Audit Area is an internal and independent unit of IBERDROLA, S.A. (the Company ), which functionally reports to the Audit and Risk Supervision Committee and hierarchically reports to the chairman of the Board of Directors, and which promotes the proper operation of the information technology and internal control and risk management systems and governance of the Company and of the group of which the Company is the controlling entity, within the meaning established by law (the Group ), without prejudice to the powers of similar committees or bodies (particularly the Internal Audit Areas) that might exist within companies of the Group, whether listed or not. Article 2.- Regulation 1. The Internal Audit Area is governed by the provisions of these Basic Internal Audit Regulations (the Basic Regulations ). 2. Amendments to these Basic Regulations must be approved by the Board of Directors of the Company upon a proposal of the Audit and Risk Supervision Committee. 3. Without prejudice to the provisions of the Corporate Governance System, these Basic Regulations, and the other internal rules of the Company, the Internal Audit Area shall conform its actions to the International Standards for the Professional Practice of Internal Auditing approved by the Institute of Internal Auditors (IIA), which contains the definition of internal auditing, the code of ethics, and the international standards for the professional practice of internal auditing from time to time in effect. TITLE II. INTERNAL AUDIT AREA Article 3.- Director of the Internal Audit Area 1. The person with the maximum responsibility for the Internal Audit Area shall be its director, who must have the expertise, qualifications, and experience suitable for the duties the director is called upon to perform, especially in the area of internal auditing and risk management, and shall have the faculties necessary for the performance thereof. 2. The appointment and removal of the director of the Internal Audit Area is within the purview of the Company s Board of Directors, upon a proposal of the chairman thereof and after a report from the Audit and Risk Supervision Committee. 3. The determination and assessment of the objectives of the director of the Internal Audit Area is within the purview of the Audit and Risk Supervision Committee, upon a proposal of the Company s Board of Directors. 4. The director of the Internal Audit Area shall manage the operation of the Internal Audit Area and its budget, based on principles of independence and efficiency in management,

5 Basic Internal Audit Regulations / 3 and shall be responsible for carrying out the corresponding measures and action plans and ensuring that the Internal Audit Area duly complies with its duties. 5. The director of the Internal Audit Area shall be deemed a member of the senior management of the Company, and shall report hierarchically to the chairman of the Board of Directors. Article 4.- Internal Audit Divisions of the Group s Companies 1. The companies of the Group within which Audit and Compliance Committees are created shall have an Internal Audit division, without prejudice to the particular circumstances that may be applicable thereto due to their listed status, nationality, law, or any other circumstances. 2. The chair of the respective Audit and Compliance Committee shall consult in advance with the director of the Internal Audit Area in order to prepare proposals for the appointment or removal of the directors of the Internal Audit divisions of the companies of the Group. 3. The Internal Audit divisions of the companies of the Group shall provide assistance to their respective Audit and Compliance Committees and shall inform them of their work and annual activities plans, submitting an activities report at the end of each financial year. 4. The Internal Audit divisions shall be governed by the provisions of these Basic Regulations, except in the case of those listed companies that have their own internal regulations on this subject. Article 5.- Framework of Relations between the Internal Audit Area and the Internal Audit Divisions of the Companies of the Group 1. The director of the Internal Audit Area of the Company shall establish an appropriate framework for coordination and information with the Internal Audit divisions of the companies of the Group, and shall develop the strategy, guidelines and overall supervision of the Internal Audit function at the Group level. 2. Specifically, the director of the Internal Audit Area shall: a. Define the strategic lines and scale of the Internal Audit function at the Group level. b. Participate in determining the processes for determining and evaluating the objectives of the heads of the Internal Audit divisions of the companies of the Group that are not listed companies or subsidiaries thereof and for setting the remuneration thereof, and in determining the profiles and development and career plans of its audit team. c. Supervise and coordinate the annual activities plans of the Internal Audit divisions, which must be coordinated with the activities plans of the Internal Audit Area of the Company, and to which it shall transmit the guidelines and directives of the Board of Directors and of the Audit and Risk Supervision Committee of the Company.

6 4 d. Supervise the annual activity reports of the Internal Audit divisions of the companies of the Group. e. Establish directives regarding quality requirements and the promotion of global certifications, and promote periodic evaluations of the Internal Audit divisions of the companies of the Group. 3. The director of the Internal Audit Area of the Company and the heads of the Internal Audit divisions of the companies of the Group shall hold regular coordination and information meetings. Such meetings may also be attended by those internal auditors that the director of the Internal Audit Area deems appropriate for the proper performance of the function. TITLE III.- POWERS Article 6.- Scope of Powers The principal duties of the Internal Audit Area are to collaborate with the Audit and Risk Supervision Committee in its areas of competence and to proactively ensure the proper operation of the information technology and internal control and risk management systems of the Company. Article 7.- Powers relating to the Audit and Risk Supervision Committee 1. The Internal Audit Area shall assist the Audit and Risk Supervision Committee in its areas of competence, especially as regards supervision of the internal control and risk management system, relations with the auditor, and supervision of the process of preparing the economic and financial information of the Company and its Group. 2. The Internal Audit Area shall be the regular body for communication between the Audit and Risk Supervision Committee and the rest of the Company s organisations, without prejudice to the duties entrusted to other areas, especially the Corporate Risk Division. The director of the Internal Audit Area shall be responsible for preparing the information required at meetings of the Audit and Risk Supervision Committee, and shall attend such meetings if it so deems appropriate when dealing with aspects that are within the area of the director s powers or duties. Article 8.- Powers of Supervision of the Information Technology and Internal Control and Risk Management Systems The Internal Audit Area shall ensure the proper operation of the information technology and internal control and risk management systems of the Company. In particular, by way of example and not limitation, the Internal Audit Area shall have the power to: a. Supervise the process of preparing and presenting the economic and financial information that the Company must periodically publish due to its status as a listed company.

7 Basic Internal Audit Regulations / 5 b. Supervise the Internal Control Over Financial Reporting (ICOFR) System established by the Company for preparing and presenting economic and financial information. c. Supervise the internal control and risk management systems. d. Supervise the information technology systems and the technologies in support thereof. e. Supervise compliance by the investment and divestment processes with the risk policies and guidelines that are applicable in each case, and the performance thereof in accordance with procedures that ensure proper internal control and efficient management of the related risks. f. Review the process for setting and evaluating objectives. g. Supervise the specialised audits relating to the management systems, such as, by way of example and not limitation, the quality, occupational risk prevention, and personal data processing systems. h. Audit the Crime Prevention Programme of the Company and supervise any audits performed by the various Internal Audit divisions of the group of their equivalent programmes, reporting its conclusions to the Corporate Social Responsibility Committee and to the Compliance Unit. i. Supervise the implementation of and compliance with the Risk Policies by the Company and its Group. j. And generally, any other powers necessary to carry out its duty to ensure the proper operation of the informational technology and internal control and risk management systems. Article 9.- Other Powers The Internal Audit Area shall also have such other powers of a singular or permanent nature as are assigned thereto by the Company s Board of Directors or vested therein by the Corporate Governance System. TITLE IV. RESOURCES, BUDGET, AND ANNUAL ACTIVITIES PLAN Article 10.- Material and Human Resources The Internal Audit Area shall have access to the material and human resources necessary to perform its duties. Article 11.- Budget 1. Prior to the commencement of each financial year, the director of the Internal Audit Area shall submit to the Audit and Risk Supervision Committee a proposed budget for carrying out its activities during the upcoming financial year. 2. Once validated by the Audit and Risk Supervision Committee, the proposed budget shall be sent to the chairman of the Board of Directors, who shall present it to the Board of Directors for final approval.

8 6 Article 12.- Annual Activities Plan 1. Prior to the commencement of each financial year, the director of the Internal Audit Area shall submit to the Audit and Risk Supervision Committee for approval a proposed annual activities plan for the upcoming financial year, which must focus principally on the significant risks of the Company and of its Group. 2. Compliance with the annual activities plan shall be one of the objectives of the director of the Internal Audit Area. Article 13.- Activities Report and Recommendations 1. The director of the Internal Audit Area shall directly report to the Audit and Risk Supervision Committee on any issues occurring in developing its budget and the annual activities plan, and shall submit thereto a report on its activities at the end of each financial year. 2. In particular, the director of the Internal Audit Area shall regularly report to the Audit and Risk Supervision Committee on the recommendations resulting from its audit work and on the status thereof, and whether the senior executives of the Company take into account the conclusions and recommendations of its reports. TITLE IV. FACULTIES AND DUTIES Article 14.- Faculties 1. The Internal Audit Area, through its director, shall have access to the documentation, information, or information systems it deems necessary or appropriate for the exercise of its powers, without prejudice to observing the law and the internal rules of the Company and its Group. 2. In the exercise of its powers, the Internal Audit Area may obtain the cooperation of any officer or employee of the Company. 3. The management of the Internal Audit Area shall act transparently, informing the affected parties of the purpose and scope of its activities whenever practicable. Article 15.- Duties 1. The members of the Internal Audit Area must act with independence of judgement and action with respect to the rest of the organisation and perform their work with the utmost diligence and professional competence. 2. The members of the Internal Audit Area shall not disclose any information, data, reports, or background information to which they may have access while in office, nor use any of the foregoing for their own benefit or that of third parties, without prejudice to any applicable duties of transparency or reporting. The duty of confidentiality of the members of the Internal Audit Area shall survive even after the members no longer hold such position.

9 Basic Internal Audit Regulations / 7 3. The members of the Internal Audit Area must comply with the rules of the Corporate Governance System as well as the other codes of ethics and professional rules as are applicable thereto at any particular time. 4. The director of the Internal Audit Area, as a person subject to the rules on conflicts of interest, must comply with the provisions to such effect in the Internal Regulations for Conduct in the Securities Markets and in the Procedure for Conflicts of Interest and Related- Party Transactions with Directors, Significant Shareholders, and Senior Officers. TITLE V. COMPLIANCE, DISCLOSURE, AND INTERPRETATION Article 16.- Compliance 1. The members of the Internal Audit Area have the obligation to know and comply with these Basic Regulations, for which purpose the director of the Internal Audit Area shall provide them with a copy. 2. The director of the Internal Audit Area shall have the obligation to ensure compliance with these Basic Regulations. Article 17.- Dissemination The professionals of the Group have the obligation to know these Basic Regulations to the extent they are affected hereby, for which reason the director of the Internal Audit Area shall ensure the proper dissemination hereof. Article 18.- Interpretation 1. Any questions or disputes regarding the interpretation of the Basic Regulations shall be resolved by the director of the Internal Audit Area, who shall take into consideration the provisions of the Corporate Governance System, and if none apply, to the International Standards for the Professional Practice of Internal Auditing approved by the Institute of Internal Auditors (IIA). 2. The interpretation and resolution of questions or disputes that arise shall be reported by the director of the Internal Audit Area to the Audit and Risk Supervision Committee.

10