Risk management

Governance and oversight at corporate level

The Board

• Set the tone on risk management culture.
• Maintain sound and effective risk management and internal control systems.
• Define risk appetite and approve risk management policies, guidelines and processes.
• Responsible for principal risk identification and ongoing monitoring of the Company’s risk exposure to ensure that material matters are managed in alignment with strategic objectives.

Assistance to the Board by reviewing and monitoring of principal risks and procedures.

The Board committees

• The Audit and Risk Committee reviews the effectiveness of the risk management process, develops and oversees implementation of risk management strategies and makes recommendations to the Board.
• The Safety and Sustainability Committee measures the impact of the Company’s initiatives and supports the Audit and Risk Committee in monitoring sustainability risks.

Support the Audit and Risk Committee in evaluating the Group’s risk profile and internal controls implemented by management

Internal audit function

• Define and monitor the risk management process and mitigation tools and actions.
• Plan and execute assurance activities to ensure there are policies and procedures in place to support the effectiveness of the Group’s internal control system.
• Prepare regular risk and internal control reports for approval by the Audit and Risk Committee and maintain the Risk Assurance Map.
• Perform risk analysis on growth projects, detailing the specific conditions and risks faced by the new project.

Operating risk management across mining operations and exploration

Operational managers

• Risk awareness embedded into day-to-day operations.
• Risk identification and assessment performed across business operations on an everyday basis.
• Implementation of risk mitigation programmes and operational monitoring of internal controls.

The IA Department supports the Board, through the Audit and Risk Committee, in evaluating the Company’s and the Group’s governance framework. It also aims to raise levels of understanding and awareness of risk and control throughout the Group. Internal auditors maintain organisational independence from Group management by reporting to the Audit and Risk Committee on substantive matters and to the Group CEO for administrative purposes; the internal auditors additionally report their findings to the members of the Group’s executive management. Any potential conflicts of interest should be disclosed by the internal auditors as they arise; internal auditors are not allowed to audit areas where they have held operational roles in the previous 12 months.

The IA Department’s annual work plan is approved by the Audit and Risk Committee. It is based on a risk tolerance evaluation that ensures the achievement of the Group’s operating objectives and focuses on the principal risks the of Group’s risk profile. The head of the IA reports to the Board through the Audit and Risk Committee.

The KPIs of the head of the IA are:

• completion of work in accordance with the approved plan,
• quality of audits and the number of follow-up audits, where agreed recommendations have been implemented.

In addition to the Audit and Risk Committee assessment, the internal auditors use an annual self-certification process, which requires managers throughout the Group to personally confirm the testing of internal controls and compliance with Group policies within their business or function, as well as the steps taken to address actual or potential issues that are identified. The results of self-certification as well as management response thereto are provided to the Committee along with other reports on the internal audit activities. The IA Department also performs periodic external certification, the most recent of which started at the end of 2018 with the results presented to the Audit and Risk Committee in March 2019. It was confirmed that the independence and objectivity of the Group’s

IA Department is in compliance with international standards for internal audit.

Internal control framework and activities are available in the Annual Report.

External auditor appointment

The re-appointment of Deloitte LLP as the Group’s external auditor is reviewed annually by the Audit and Risk Committee. Deloitte LLP was appointed auditor in 2011, with Deloitte CIS having been auditor of JSC Polymetal since 2007. James Leigh was appointed as audit partner in 2015. The Committee’s assessment of the external auditor’s performance and independence underpins its recommendation to the Board to propose to shareholders the re‑appointment of Deloitte LLP as auditor until the conclusion of the AGM in 2021. Resolutions to authorise the Board to re-appoint and determine the auditor’s remuneration was proposed at the AGM on 27 April 2020. Dean Cook took over as audit partner for 2020.

Audit tender

The Group has a policy of tendering the external audit at least every ten years. The most recent tendering process took place from January to May 2019, with a view to appointing the external auditor for the 2020 audit, which also coincided with the completion of the five-year term of our current audit partner. Deloitte LLP has been our auditor for 10 years, following Polymetal’s listing on the London Stock Exchange. Deloitte was invited to participate in this tendering process, along with other appropriately qualified international audit firms. The tender process was held in compliance with the Competition and Markets Authority regulations, applicable EU requirements and Financial Reporting Council (FRC) guidance.

Following the completion of the evaluation, the Audit and Risk Committee recommended Deloitte LLP to the Board for approval as external auditors for the year commencing 1 January 2020. The decision was driven by expertise, better resources and the audit approach to delivering high quality audit services to Polymetal. After considering the Committee’s recommendation, the Board proposed Deloitte LLP as auditor subject to shareholders’ approval at the Company’s 2020 AGM. Re-appointment of Deloitte was approved by 99.88% of the shareholders voting at 2020 AGM.

Auditor independence

The auditors are required each year to confirm in writing to the Committee that they have complied with the independence rules of their profession and regulations governing independence, and that they have complied with the requirements of the Company’s policy on provision of non-audit services. The external auditor is required to maintain appropriate records to provide reasonable assurance that its independence from the Company is not impaired.

Review of the effectiveness of the external audit process and audit quality

The Audit and Risk Committee has adopted a formal framework in its review of the effectiveness of the external audit process and audit quality which focuses on the following areas:

• The audit partners, with particular focus on the lead audit engagement partner
• The audit team
• Planning and scope of the audit and identification of areas of audit risk
• Execution of the audit
• The role of management in an effective audit process
• Communications by the auditor with the Audit and Risk Committee, and how the auditor supports the work of the Audit and Risk Committee
• How the audit contributes insights and adds value
• The independence and objectivity of the audit firm and the quality of the formal audit report to shareholders.

An auditor assessment is completed annually by each member of the Audit and Risk Committee and by the CFO by way of a formal questionnaire. Feedback is also sought from the Group CEO, other members of the finance team, divisional management and the head of internal audit. The feedback from this process is considered by the Audit and Risk Committee, and is provided both to the auditor and to management. Action plans arising are also reviewed by the Committee.

The effectiveness of management in the external audit process is assessed principally in relation to the timely identification and resolution of areas of accounting judgement, the quality and timeliness of papers analysing those judgements, management’s approach to the value of the independent audit, the booking of audit adjustments arising (if any) and the timely provision of draft public documents for review by the auditor and the Audit and Risk Committee.

Non-audit services by the external auditors see in the Annual Report.