Risk management

Risk management is an integral part of the operational and decision-making processes carried out in all areas of PSE's activities, including power system management, system development, ICT, operation or investment. When initiating and subsequently implementing activities in these and other business areas, account is taken of risks the materialisation of which could contribute to the failure to achieve the strategic and operational objectives pursued, including the ability of the organisation to ensure the operational continuity of both the national electricity system and the company itself. Risk management in each area involves the systematic application of planned and coordinated measures, procedures and practices that reduce or eliminate the possibility of risk materialisation, and minimise the negative effects of their occurrence or enable their positive effects to be utilised.

Risk management measures, undertaken at strategic and operational level, are aligned with the process of identifying, assessing and monitoring the risks most relevant to PSE. In accordance with the company's Risk Management Policy, this process covers the most important areas of PSE’s activities, including in particular ensuring the continuity of electricity supply, the provision of transmission services and the implementation of investment processes. In practice, the substantive scope of this process refers to all dimensions of the company's activities and is intended to adequately reflect the changing internal and external circumstances in the register of risks most relevant to PSE.

At PSE, as part of the continuous improvement of organisational, process and technological solutions, initiatives are undertaken aimed both at improving the operational efficiency and security of the PPS and the company, as well as reducing or managing risks more effectively. Their implementation is reflected in the risk parameters included in the register mentioned above.

The following parties are involved in risk management activities, both those undertaken within the framework of operational and decision-making processes, as well as those being part of the process of identifying, assessing and monitoring the most significant risks from the point of view of PSE:

• the Audit Committee/Supervisory Board,
• the Management Board,
• managers of the company’s organisational units,
• risk coordinators in the company’s organisational units,
• all employees of the company,
• the Risk Management Office.

Presented below is essential information on the role of each of those parties.

The Audit Committee supports the Supervisory Board in supervising the operation of risk identification and management systems.

In particular, the Audit Committee can:

• assess the appropriateness of the business risk identification, monitoring and mitigation systems used by the Management Board,
• assess the compliance of the internal control system with the internal rules and regulations and procedures that ensure the effective operation of the system,
• indicate internal control system areas that need improvement,
• assess the performance of systems reducing the risk of irregularities occurring in the company,
• submit internal audit plan proposals for a particular year.

The Audit Committee may demand that the Management Board submit information on the approach to risk management, as well as risks relevant to the company and the PPS.

The Management Board is responsible for the establishment of a system-based approach to risk management in the company. Approves the Risk Management Policy. In addition, the Management Board studies periodic reports on PSE’s business risks as well as measures taken as part of risk management.

Each manager of the company’s organisational unit is responsible for the management of the business area assigned to that unit. Management activities include the identification of risks and the development and implementation of an approach to the management of risks that may affect the functioning of the area concerned and the achievement of its objectives.

In order to ensure terminological and methodological consistency in risk identification and assessment, and to ensure the adequate reflection of risks related to a given business area in register of risks of key significance for PSE, organisational unit managers cooperate with the Risk Management Office (RMO). The manager of an organisational unit acts as the risk owner for risks falling within their area of responsibility, which are included in the risk register.

Risk coordinators in the Company’s organisational units are individuals designated by the managers of those units. They are responsible for operational cooperation with the RMO, mainly for ensuring the current risk information flow between the unit concerned and the RMO. They support managers of organisational units in performing their role as risk owners.

PSE’s employees are a significant component of a system-based approach to risk management at the company – they engage in activities falling in line with the approach to the management of respective risks and support unit managers in the risk identification process. In addition, all employees are required to familiarise themselves with the Risk Management Policy and the risk management rules described in it.

The RMO is an organisational unit responsible for providing the Management Board with a comprehensive picture of the most significant risks for the operation of the PPS and the company. The unit ensures a system-based approach to the identification and assessment of those risks. In addition, the RMO develops recommendations for measures promoting risk management, pursued by the company’s individual organisational units (this applies to areas such as investment, ICT, anti-corruption, or employee health and safety). The Office ensures terminological and methodological consistency with regard to risk identification and assessment, as well as risk monitoring and reporting to the Management Board.

The operational security and efficiency of the PPS, and of the company itself, is ensured through the implementation and continuous maintenance of necessary systems and functions, including: risk management, internal control, compliance management, and internal audit. Their common assumption is to support the organisation in achieving the company’s operational and strategic objectives.

PSE’s strategy defines 6 main challenges and 17 objectives to be achieved within 10 years. The implementation of the objectives involves a number of risks. Therefore, it is of key importance for the company to ensure a system-based approach to the identification, assessment, management and monitoring of strategic as well as operational risks.

At the same time, risk management is treated at the company as an indispensable element within three independent but mutually complementary lines of defence.

It is provided by PSE’s organisational units which are risk owners and are responsible for their management. The first line of defence comprises management control solutions forming a set of supervisory and audit measures such as control mechanisms embedded in processes and systems. Their purpose is to reduce risks related to the different business areas of the company, as well as taking advantage of opportunities.

It involves the organisational units performing supervisory and control tasks at the company, including units responsible for financial audit, physical and ICT security, risk management, regulatory compliance, and quality control. Activities pursued by these functions involve the monitoring and control of solutions deployed in the first line of defence, and supporting PSE organisational unit managers (risk owners) in order to ensure the correct design and efficient operation of implemented controls mechanisms.

In includes the functions that provide the Management Board and the Supervisory Board with a guarantee in the form of independent assurance that the first and second lines of defence effectively support the achievement of the company’s strategic and operational objectives. At PSE, the third line of defence is delivered by the internal audit function performed by the Supervision Office.

The process of identifying, assessing and monitoring the risks most relevant to the PPS and the company is coordinated by the Risk Management Office (RMO. The main activities pursued in the process include:

In coordination with risk owners, the RMO analyses changes in external and external conditions, as they can lead to the emergence of risks of a high significance for the company, which previously did not pose an obstacle to the fulfilment of its tasks. As part of risk identification, a description of the risk scenario is developed together with associated potential causes and effects. In addition, the main elements of the approach to risk management are indicated. Risk identification is performed both as part of annual risk reviews and ad hoc – risks can be identified in the course of a current analysis of PSE’s business conditions.

Identified risks are subject to assessment which is also performed in coordination with risk owners and the RMO. Risk assessment is carried out in accordance with the specific methodological approach adopted by the company (see “Methodological approach adopted”).

Identified and assessed risks are recorded in the register of the company’s key risks. The register is kept by the RMO. The register reflects all changes in the value of each risk parameter. Updates are performed both as a result of the annual risk review and ad hoc, where this is justified by a change in conditions, including risk data obtained from the company’s different business areas.

For the purposes of risk monitoring, Key Risk Indicators (KRIs) are defined. The character and design of each KRI are determined in coordination with the owner of the risk to be monitored with the use of the indicator. Data that allow changes in the indicator value and related trends to be traced are acquired cyclically, at the intervals adopted. Information on the KRO values is used in analysing the conditions related to each risk. They are also taken into account in reporting to the Management Board on the risks included in the company’s risk register.

The approach to risk management is defined by the risk owner. Irrespective of permanent, predefined components of the approach, in many cases initiatives are undertaken which are aimed at supplementing or modifying previously adopted solutions so as to improve the quality of risk management or reduce the probability of a specific risk scenario occurring. The initiatives, including their implementation progress, are subject to periodic monitoring.

Findings of the analyses of external and internal conditions affecting the risk measures, changes in KRI values, progress in implementing initiatives supporting risk management and recommendations resulting from monitoring performed by the RMO are reported to the Management Board on a periodic basis. Annual and quarterly reports are submitted to the Management Board. Moreover, in the event of changes in the risk register, reported during specific quarters, ad hoc reports are drafted, containing information on such changes and their reasons.

The company follows the Methodology for Risk Assessment at PSE S.A. and its subsidiaries, which defines the methodological approach used in assessing identified risks of key significance for the PPS and the company. The document is subject to periodic reviews and updates. It is the company’s intention to ensure that the approach presented in the document takes into account the experience gained in the course of its application and reflects the current level of methodological development and advancement.

The methodology and the associated toolbox support activities aimed at:

• identifying key risks related to the functioning of the organisation – including in particular those related to operation, maintenance and investment activities
• assessing, quantifying and ranking of identified risks,
• determining the correlations between identified risks and their significance for the measure of individual risks,
• enabling the current monitoring of risks, including risk value trends, and generating synthetic management information on risks.

The basic risk measure is the product of:

• the expected frequency of materialisation of a particular risk in a year, taking into account the susceptibility (conditional probability of risk materialisation in case of occurrence of individual causes),
• the total value of the direct and indirect effects of its materialisation, weighted by resilience (conditional probability of effects occurring following the materialisation of a particular risk).

It was also assumed that the materialisation of one risk may be a trigger (cause) of the emergence of other risks. In such cases, cascades of risks are identified and taken into account in estimating risk measures:

• the measure of the upstream risk as a potential cause of the materialisation of the downstream risk takes into account the indirect effect (the effect of the materialisation of the downstream risk, adjusted by the conditional probability with which the upstream risk leads to the materialisation of the downstream risk.

For each risk, its causes, incidence, conditional probability and effects are defined:

• in relation to the cause, i.e. specific event (or circumstance) the occurrence of which may lead to risk materialisation, the incidence and conditional probability of risk materialisation after the occurrence of such cause (susceptibility) is determined;
• the incidence of causes, susceptibility and resilience are determined using a scale (see below) or by providing a specific numerical value,
• the effects understood as any (negative and positive) consequences of risk materialisation are determined by a numerical value or descriptively, using the following ratings on a descriptive scale: critical, serious, moderate, low, insignificant,
• as part of the 5 dimensions of effect (financial and material, continuity and quality of the PPS operations, image and legal issues, impact on health and life, environmental impact), a qualitative description of the effect to which a given value is assigned is formulated with the use of scales,
• not all effect dimensions are expressed in monetary form – therefore their measures are converted into PLN with the use of monetary conversion rates defined further on in the methodology.

Risk parameters (incidence, susceptibility, resilience, effect) are subject to expert assessment or they are assessed with the use of dedicated area-specific methodologies (if developed).

Presented below is a summary of selected risks included in the Company Risk Register. For each of them, significant elements of the approach to management adopted are indicated.

Having regard to the epidemic conditions that have recently developed – the SARS-CoV-2 pandemic – the description of the approach to management has been supplemented with information on measures and solutions that additionally apply to particular risks.

PSE participates in the work of the Team for Monitoring Security Risks reporting to the Minister of Climate, including the Sectoral Team for Electricity operating of part of it.

In addition, business continuity prevention procedures are implemented, and a Crisis Team set up by PSE at the end of January 2020, working in coordination with the Management Board, has been monitoring the spread of the virus on an ongoing basis and taking necessary actions as the situation requires, such as:

• analyses of the pandemic development and its consequences for the company have been conducted, and recommendations are drawn up on measures necessary to ensure business continuity of the company and an undisturbed operation of the PPS,
• restrictive precautions are in force at PSE facilities to prevent the virus infection: mutual locational separation between key teams in each organisational unit, segmentation of buildings accommodating critical workplaces – the National Power Dispatch Centre, Area Power Dispatch Centres and Regional Supervision Centres, as well as key staff responsible for cybersecurity and operation of the communications network,
• restrictive precautions are in force at PSE facilities to prevent the virus infection: mutual locational separation between key teams in each organisational unit, segmentation of buildings accommodating critical workplaces – the National Power Dispatch Centre, Area Power Dispatch Centres and Regional Supervision Centres, as well as key staff responsible for cybersecurity and operation of the communications network,

Other solutions have also been put in place in response to the pandemic, including:

• the possibility to submit applications for transmission network connection conditions electronically,
• drones for aerial inspection of power lines have been deployed on a wider scale,
• as part of the projects which have to be carried on due to their importance for Poland’s energy security, a pilot geosurvey has been conducted (an interactive application that allows a proposed location to be learnt and change proposals to be submitted – the solution was intended to enable and facilitate communication with stakeholders).

More information on the measures taken in connection with the SARS-CoV-2 pandemic can be found in the table presenting selected risks and the approach adopted to manage those risks.

The further functioning of the organisational and procedural arrangements implemented or their tightening or relaxation is dependent on the development of the epidemic situation in the country and worldwide. Decisions will be taken having regard to personnel health and safety and operational continuity of the company and the PPS.

Irrespective of ongoing activities pursued by the company as part pf risk management, PSE is involved in performing tasks aimed at the correct and timely implementation of the provisions of Regulation (EU) 2019/941 of the European Parliament and of the Council of 5 June 2019 on risk-preparedness in the electricity sector and repealing Directive 2005/89/EC.

The objective of the above regulation is to initiate, and then implement, measures with a view to preventing, preparing for and managing electricity crises in a spirit of solidarity and transparency and in full regard for the requirements of a competitive internal market for electricity. ‘The Regulation defines the electricity crisis as a present or imminent situation in which there is a significant electricity shortage, as determined by the Member States and described in their risk-preparedness plans, or in which it is impossible to supply electricity to customers.

The above regulation provides for:

• defining regional electricity crisis scenarios,
• drafting national electricity crisis scenarios,
• developing risk-preparedness plans,
• performing periodic risk-preparedness plan effectiveness tests and electricity crisis simulations,
• drafting early warnings of the risk of a crisis occurring in a Member State and declaring an electricity crisis,
• implementation of measures set out in risk-preparedness plans,
• preparing ex post evaluation reports drawn up in each case after the end of an electricity crisis.

In order to ensure the performance of PSE’s tasks resulting from the above regulations, the Task Force for the performance of tasks resulting from Regulation 2019/941 relating to risk-preparedness plans (hereinafter: “Task Force”) was established on 28 January 2020 by Order of the President of the Management Board. In the course of its work so far, the Task Force has selected electricity crisis scenario proposals and submitted them to ENTSO-E (after having obtained the acceptance of the Management Board and the Competent Authority – the Minister of Climate). Based on the proposals submitted by Poland and other countries, ENTSO-E has defined 31 regional electricity crisis scenarios which can be assigned to several categories:

The Task Force assessed the aforementioned scenarios and submitted them to ENTSO-E (after having obtained the acceptance of the Management Board and the Competent Authority).

Further work, for which the Competent Authority will be responsible, includes:

• the development of national electricity crisis scenarios – by 5 January 2021,
• the development of risk-preparedness plans for individual scenarios – by 5 January 2022.

PSE will be engaged in the performance of those tasks in line with its competences and responsibilities arising from the role of transmission system operator in Poland.