Internal control and risk management system

THE ACEA “PRIVACY GOVERNANCE MODEL”

Acea has adopted a Group Privacy Governance Model, compliant with the indications of Regulation (EU) 2016/679 on data protection (GDPR), which constitutes the organisational and control framework in which the roles and responsibilities and the implementing methods of the basic principles of the Privacy regulation are identified, with a preventive risk-based approach supported by continuous monitoring and periodic reviews.

This Model - which is also adopted by the Subsidiary Companies - is reviewed annually on the basis of the performance in previous years and is amended to strengthen its effectiveness (Control Framework).
Acea oversees the various areas with an impact on privacy, gradually leading to the adoption of policies on remote working, data security management and compliance.
In 2022, the risk analysis of all data processing included in the Parent Company’s records was completed, aimed at ensuring the constant and prompt update of the associated risks. Processing considered to be potentially high risk, according to the specific situation, is subject to specific analyses such as the DPIA (Data Protection Impact Assessment), LIA (Legitimate Interest Assessment) and TIA (Transfer Impact Assessment). For outsourced activities, specific contractual tools were adopted to govern personal data processing and continuous monitoring of procurement activities is ensured.
The following were also carried out in 2023:

• an in-company awareness campaign on key data protection concepts; mini-training videos posted on the company intranet;
• an online training campaign for privacy specialists, to provide expertise on GDPR and the Group Privacy Governance Model;
• a second GDPR compliance pilot projectfor suppliers, appointed as data controllers, in order to comply with the obligations of supervision and control over the processing of personal data for the Acea Group;
• a privacy support activity implementing the Whistleblowing legislation.

ANTITRUST COMPLIANCE PROGRAMME

Compliance with antitrust law and adherence to consumer protection legislation are core values for the Acea Group, which for years has had an Antitrust Compliance Programme to prevent unlawful conduct. The Programme, also implemented in the Subsidiaries, makes it possible to make use not only regulatory developments, but also the insights available from the application practices of the national and European Competition Authorities and the guidance of case law, thus helping to strengthen the internal control system and refine compliance strategies with a view to risk prevention and continuous improvement.
Acea provides its subsidiaries, through the “Antitrust Compliance and Consumer Protection Guidelines”, with guidelines for the implementation, within a common framework, of their specific Antitrust Compliance Models. In December 2023, by resolution of the Board of Directors, Acea also approved the updating of the “Antitrust and Consumer Protection Regulation Compliance Manual”, which is the main regulatory tool of the Antitrust Compliance Programme. In addition to reporting the main elements of the regulations provided to protect Competition and Consumers, the Manual sets out the relevant cases and conducts and the main rules of conduct to be observed by all addressees, and recalls and applies the principles of the Acea Group Code of Ethics, which enshrines the protection of competition and consumers as founding values of Acea's and the Group's Companies' business.

CYBER RISK, INFORMATION ASSETS AND ICT SYSTEMS

The development of digitalisation in the management of essential infrastructures and services continues to drive the evolution of the business environment, and concomitantly creates a need to effectively address the growth of cyber threats.
According to the most recent figures, Italy has witnessed a steady increase in cyber attacks, with an 86% increase in the first half of 2023 compared to 2018. The frequency and severity of attacks have increased, due also to the Russia-Ukraine conflict, and in the year under review Italy experienced a significant increase in cyber crime incidents (+40%) compared to 2022, which was above the global average. The European Union has continued to contribute to the development of industry legislation and the National Cybersecurity regulatory Authority (ACN) is operational nationally.
Cybersecurity and skills development are crucial in all areas of Information Security, so a continuous improvement process is underway, fuelled by analysis of the external environment and the lessons learned from the various incidents.
During 2023, the Acea Cyber Security Unit continued to consolidate its role as linchpin for the security of the Group's operating companies. New strategies, goals, technologies and processes were set in the IT, OT and IoT sectors, based on a holistic and unified approach to security. Real Time Security Monitoring and Incident Management capabilities have been increased tenfold, in response to the challenges of the current geopolitical environment that continues to influence the cyber landscape. The Vulnerability Management was further strengthened, emphasising vulnerability research and mitigation, together with the Security by Design process, which is crucial for defining cybersecurity requirements in business-oriented technology projects. The development of Cyber Threat Intelligence has led to a significantly increase in the volume of information managed, allowing the integrated monitoring of the “'cyber climate”. Other interventions aim to improve the Group's cyber resilience, such as the Cyber Legal area, with a regulatory monitoring service to identify cybersecurity legislative initiatives that directly impact the Acea environment.
In 2023, the awareness & training campaign to raise individual cybersecurity awareness and skills continued, as did Acea's participation in the European ECHO programme (European network of cybersecurity centres and competence hub for innovation and operations), which contributes to the security of digital infrastructures at European level.

PROTECTION OF PHYSICAL AND DIGITAL ASSETS AND MANAGEMENT OF INTERNAL RISKS

The mission of the Security & Cyber Defence function is to protect tangible and intangible corporate assets, and to ensure the definition, implementation and control of activated policies for the physical protection of the Group's real estate assets. It also oversees the Security Operations Room (Control Room), the security and reception staff and video surveillance/intrusion systems, and coordinates the implementation of business continuity and emergency management plans.
Finally, the Function cooperates with the competent structures and Group Companies in coordinating the correct performance of activities required by judicial authorities, security institutions and law enforcement agencies.

ANTI-CORRUPTION COMPLIANCE PROGRAMME

The Group is pursuing the implementation of an anti-corruption compliance programme, which was launched via the definition of a Group framework. The first pillar of the framework (Values and Regulatory System) includes the Acea Group's Anti-corruption Guidelines, adopted by the Board of Directors of Acea SpA. It standardises and integrates the anti-corruption compliance measures already widespread within the internal Regulatory System (Code of Ethics, 231 Model, regulatory system, etc.) into an organic framework of rules and principles aimed at countering the risks of unlawful practices. The Anti-Bribery Guideline regulates roles, responsibilities and control activities relating to anti-corruption, such as the principles of conduct to be observed in sensitive areas that may be most exposed to corruption risk, the applicable controls and the information and reporting flows relating to the implementation and monitoring of the framework. The Guidelines apply to the Group Companies and to suppliers, partners, business associates and more generally all parties who act in the name and on behalf of Acea or the Group Companies, or the parties they come into contact with in the course of their business. In each company, an “Anti-Corruption Manager” (ACM) is appointed to ensure compliance oversight for the prevention of corruption. The role also reports to the corporate control bodies. The Parent Company also implemented a Corruption prevention management system, which obtained UNI ISO 37001:2016 certification in 2023 and adopted a specific Anti-Corruption Policy, approved by the Board of Directors in March.

REPORTS RECEIVED ON THE CODE OF ETHICS AND THE ROLE OF THE ETHICS OFFICER

The Code of Ethics, revised and updated in 2022, is conceived to allow the widespread dissemination of Acea principles and values to all the Companies and people of the Group. The Code incorporates references to principles and standards underlying the strategic initiatives for the Group, in particular with regard to sustainability and the valorisation of issues such as the safeguarding of human rights in every operating context, including the supply chain; people’s involvement and organisational wellbeing; inclusion; the safeguarding of ecosystems and biodiversity; the commitment to climate change mitigation and adaptation; dialogue with stakeholders; and the promotion of sustainability with regard to suppliers.
In November 2023, the Board of Directors of Acea SpA adopted the new “Acea Group Whistleblowing Policy”, in compliance with Legislative Decree no. 24 of 10 March 2023, transposing EU Directive 2019/1937, and with the indications of the “Guidelines on the protection of persons who report breaches of Union law and protection of persons who report breaches of national regulatory provisions” approved by ANAC Resolution no. 311 of 12 July 2023. Acea has a consolidated system for receiving and managing reports ( “Whistleblowing”), which can beused both by employees and external parties, in connection with the commission of administrative, accounting, civil or criminal offences, non-compliance with the law, internal rules and the Code of Ethics, as well as issues related to the Internal Control System, Corporate Reporting, the company’s administrative liability (Legislative Decree no. 231/2001), fraud and conflicts of interest. The system ensures the highest degree of confidentiality and privacy in the processing of reports, to protect the whistleblower, the reported person and the persons involved.
The “Comunica Whistleblowing” company IT platform uses an advanced encryption system for communications and its database to guarantee compliance with required regulatory standards (Legislative Decree no. 24/2023), confidentiality for whistleblowers, secure filing of documents sent and uploaded to the system and confidential management of analysis and other processes.
The reports related to alleged violations of the Code of Ethics and the SCIGR of the Group companies are sent to the Ethics Officer, the autonomous collegial body within the Group that manages the system for reporting alleged violations due to non-compliance with the law, the internal regulations and the Code of Ethics and monitors observance of the values of transparency, legality, fairness and ethical integrity in relations with all stakeholders. The Ethics Officer also prepares periodic reports on the main findings to company top management and the supervisory bodies.
In 2023, with reference to the scope under review⁵⁸, the Ethics Officer received 42 reports, of which 15 related to alleged breaches of the Code of Ethics, 14 concerned alleged breaches of the SCIGR and 13 related to other cases (commercial complaints, reports of alleged unauthorised water and electricity connections, etc.) and therefore, these were qualified under the procedure as “not relevant”. As regards the acquisition channels, 20 reports were received through the” Comunica Whistleblowing” platform, 15 by ordinary mail, 5 by the Ethic Officer’s email address and 2 by email to entities other than the Ethics Officer.
The 24 “relevant” reports concerned: 11 Human resources, 4 Supplier relationships, 2 potential conflicts of interest, 2 Privacy, 1 Health, Security and Environment (HSE), 1 Procurement, 1 Business, 1 Corporate assets and 1 other areas.

At the end of the investigations, 15 reports were assessed as “unjustified”, 1 was “filed” as “unsubstantiated and unverifiable”, and 1 was “suspended”, pursuant to the Whistleblowing procedure, as the Company had filed a complaint with the competent authorities with reference to the reported facts.
Regarding the remaining 7 reports outstanding, the preliminary verifications and ascertainments have been completed by the Technical Secretariat, which will then suggest that the Ethics Officer assess them, pursuant to the procedure in force, with 2 of them to be “filed” as generic and unsubstantiated, 1 as “justified” with improvement actions partly already implemented by the Company and 4 as “unjustified”.
Note that, following the publication of press articles in February 2023 relating to alleged conduct contrary to the provisions of the company’s Code of Ethics, the Board of Directors instructed the Ethics Officer to carry out the necessary investigations. It was found that the matters investigated did not constitute breaches of the Code of Ethics and were classed as unjustified.
Failure to comply with the Code of Ethics by employees may result in disciplinary measures, as defined in the Code itself and in the OMC Model 231 adopted by Group companies, such as fines or suspension from service which may affect remuneration.
The Ethics Officer is tasked with supporting the company departments appointed to Code of Ethics training, by promoting communication programmes and activities intended for their maximum dissemination, in addition to the Ethics and Sustainability Committee in monitoring the adequacy and implementation of the Code of Ethics, for the matter within its remit. To this end, the Ethics Officer may propose that the Committee issue or amend any guidelines and operating procedures to reduce the risk of breaches of the Code of Ethicsand indicate whether they should be updated. In 2023, the Ethics Officer periodically monitored the use of training on the Code of Ethics and on Whistleblowing.

HUMAN RIGHTS POLICY

The protection of human rights is of central importance in responsibly-run business, especially for companies whose activities affect a wide range of stakeholders. Institutions and civil society are increasingly asking organisations to take more responsibility for the protection of human rights. This trend is fuelled also by evidence highlighted in the press, not only in relation to developing countries or countries with limited democratic structures. The matter is also carefully considered by markets and analysts as an aspect of risk management of organisations. Strengthened by this awareness, which is based on the Group's already consolidated values and systems, including the Code of Ethics, the Equality, Diversity and Inclusion Policy, stakeholder engagement principles and tools, as well as the occupational health and safety management systems, the Acea Board of Directors approved the Human Rights Policy in December 2023.
The Policy, which refers to the international and national regulatory framework, sets out 20 principles relating to human rights in two fundamental contexts: the internal work environment and the wider outside community and the environment. It is directed at the members of the management and control bodies of Acea SpA and other Group companies, including those abroad, as well as managers, employees, collaborators and suppliers contractually linked to the Group for any reason, with regard to their activities and within the limits of their responsibilities. The implementation of the Policy rests on a structured governance process through which Acea undertakes training and dissemination actions, monitoring of risks and impacts, and reporting through the “Comunica whistleblowing” platform.

ANALYSIS OF POTENTIAL ENVIRONMENTAL RISKS

The companies operating in the water, energy infrastructure and generation and the environment business areas that have ISO 14001:2015 certified environmental management systems identify the potential negative environmental impacts generated by the activities in relation to specific events or operations.
For the water sector, the main risks concern: acute or chronic climatic phenomena or seismic events, which could cause structural failure or malfunctions of plants and network systems managed, causing water shortages for users or accidental spillage of pollutants; inefficient operational management of water, which could cause high levels of losses with consequent excessive consumption; water stress; possible breach of water control parameters with environmental consequences; inadequate interventions on the sewage treatment system with possible contamination of the soil and water bodies; risks of fires and explosions in treatment plants related to the production of biogas, with possible impacts in terms of emissions into the atmosphere.
In the context of energy networks, the main risks are attributable to the existence of overhead and underground systems with impacts in terms of land use and subsoil, the generation of waste and impacts on ecosystems, the generation of electromagnetic fields with impacts in terms of exposure, the maintenance of transformation plants with potential soil and subsoil contamination with hazardous materials, and the maintenance and construction of plants with impacts in terms of production of special waste.
For the electricity generation activities, carried out with renewable and conventional power plants, the potential environmental risks attributable to the ordinary management of the plants or in the event of critical events like fires or explosions may lead to the accidental spillage of pollutants or the exceeding of threshold values in emissions (into the atmosphere, surface water and sewerage). An example of environmental risk derives from the potential dangerousness of structural failure of hydraulic works attributable to critical natural phenomena (such as earthquakes of particular intensity and/or millennial floods), which could affect the territory downstream of the plants (e.g. floods).
The environment sector involves the treatment, recovery and disposal of waste, the recovery of materials and energy (waste-to-energy and composting) and the collection, transport, recovery and disposal of non-hazardous waste produced by waste treatment plants. In this context, potential risks for the environment could take the form of spills of hazardous substances and consequent contamination of the soil and aquifers or surface waters, or of emissions into the atmosphere or water above specific prescribed limits, the treatment of waste not compliant with the reference legislation with repercussions on plant operations, unintentional fires that may cause interruptions to plant operations and pollution of the surrounding areas, as well as the failure to make investments or carry out works on the plants, with impact on the company’s management due to delays in the issue of authorisations; finally, environmental exposure can be caused by noise, odoour and dust produced during extraordinary maintenance of the plants.