Risk management

The global situation in 2020 was largely defined by the COVID-19 pandemic, which triggered a series of global socioeconomic consequences: quarantine and self-isolation requirements, border closures, event cancellations and postponements, worldwide protests and a major global economic recession.

The events of 2020 driven by pandemic restrictions, and the sanctions imposed on Russia, resulting in lower energy demand and weaker rouble, have all negatively affected the entire Russian economy and social sphere.

Due to the decline in economic activity amid an economic recession, Russia’s population mobility decreased significantly, which led to a significant drop in long-distance passenger traffic and passenger-kilometres.

In this situation, the Company took measures to improve its financial and economic position in 2020:

• A more rigorous, in-depth analysis of the performance of FPC’s passenger trains was conducted, and proposals for optimising the Company’s key performance indicators were developed and implemented
• Targeted marketing promotions and fares were developed and applied
• Passenger train schedules and train set options were adjusted for domestic services

Risk management system

Risk management at FPC is a continuous and systematic process embedded throughout the organisation, integrated with business processes and aimed at mitigating exposure and strengthening the assurance that FPC’s objectives and goals will be achieved.

All Company units are involved in the risk management process within their scope of responsibility.

The Risk Management Unit is responsible for overall coordination and methodological support of the risk management process, as well as operational control of how it is run by FPC’s units and, according to the established procedure, by subsidiaries and affiliates, including the review of FPC units’ progress on risk treatment plans, response to identified variances and gaps in the risk management and internal control system (RMICS), which have led or may lead to negative consequences, scheduled and unscheduled RMICS audits, and preparing and submitting reports to FPC’s management.

The Internal Audit Unit is responsible for assessing the reliability and effectiveness of the RMICS.

Governance principles

The Risk Management and Internal Control Policy (the “Policy”) developed in line with the Risk Management and Internal Control Policy of Russian Railways was approved by FPC’s Board of Directors.

In accordance with the Policy, the main purpose of the RMICS is to provide reasonable assurance that the following will be achieved:

• Strategic objectives
• Operational objectives
• Objectives in ensuring compliance with applicable international regulations, regulations of the Russian Federation and internal regulations of the Company
• Objectives in ensuring the reliability, timeliness and quality of all types of reporting

According to the Policy, FPC’s RMICS is set up and operated in accordance with the principles set out in GOST R ISO 31000:2010 Risk management. Principles and guidelines, namely:

• risk management creates and protects value
• risk management is an integral part of all organisational processes
• risk management is part of the decision-making process
• risk management is explicitly associated with uncertainty
• risk management is systematic, structured and timely
• risk management is based on the best available information
• risk management is adaptable
• risk management takes into account human and cultural factors
• risk management is transparent and takes into account the interests of stakeholders
• risk management is dynamic, iterative and responsive to changes
• risk management contributes to the continuous improvement of the organisation.

Key objectives of the RMICS:

• Creation of infrastructure and a regulatory and methodological basis for the effective functioning of the risk management process
• Integration of risk management and internal control procedures into the strategic and operational activities of the Company, which will enable proactive responses to risks and negative changes in the external and internal environment (through planning and implementation of risk treatment activities)
• Raising risk awareness among RMICS participants and other stakeholders
• Reduction in the number of unforeseen events that could have a negative impact on the achievement of FPC’s goals

Central decision-making bodies for risk management at FPC are its Board of Directors and the General Director.

The Company has the Audit and Risk Committee of the Board of Directors and the Risk Management Committee to prepare recommendations for management decision making.

Three lines of defence model

In its operations, FPC uses an approach driven by the three lines of defence model based on roles and responsibilities sharing. Each of the three lines increases the likelihood of FPC successfully achieving its objectives.

Improvement of the RMICS in 2020

In a period of uncertainty in 2020, the existing risk management system helped improve the adaptability of the Company, its core processes and systems, which enabled prompt review of business goals and preparation of scenario options for FPC’s development until 2025. The risk management system was therefore geared to supporting the Company in achieving its goals.

During 2020, a number of measures were implemented to improve the RMICS’ effectiveness.

The 2020 RMICS reliability and effectiveness assessment demonstrated that overall it is reliable and effective:

• Elements of FPC’s RMICS are built in accordance with the principles of, and approaches to, its organisation approved by the Board of Directors, COSO documents and GOST ISO 31000
• The risk management process is designed to help achieve the Company’s strategic goals
• Individual issues about the RMICS operation did not affect the achievement of the Company’s goals

The Internal Audit Unit proposed ways to improve the RMICS effectiveness.

In 2020, FPC’s regulatory and methodological framework was updated to bring it in line with Russian Railways’ regulatory framework:

• A number of standards and guidelines were developed and approved:
  • Methodological Recommendations for Determining the Acceptable Amount of Risk (Risk Appetite)
  • Methodological Recommendations for Risk Management and Internal Control
  • Regulations on Interactions within the Risk Management and Reporting Process
• Approaches to FPC’s risk identification, analysis and evaluation were improved

Plans for 2021 include further improvements to the RMICS at FPC and aligning it with a project to improve and further develop the integrated risk management framework at Russian Railways.

Key risk factors

Key risks factors associated with FPC’s operations:

• Lower GDP growth
• Higher CPI growth
• Significant fluctuations in inventory and fuel and energy prices
• Increased competition (adjustments to pricing policy and dumping by FPC’s competitors, expansion of air transport infrastructure)
• Lower or no price indexation
• Changes in the economic and political environment in Russia
• Deteriorating social and demographic situation in urban and rural areas
• Lower household purchasing power and real disposable income
• Exchange rate volatility
• Increased governmental support for air transport

Risk mitigation approaches

The following risk treatment methods are currently used at FPC:

• Risk avoidance – withdrawing from an activity or project associated with a particular (inherent) risk where other treatment strategies (risk mitigation, risk sharing, risk acceptance) are not economically viable or feasible. Given that any activity of the Company is associated with risks and complete withdrawal from any activity leads to its discontinuation, this strategy can be used to manage individual, specific risks (and/or new activities, projects).
• Risk mitigation – risk treatment involving activities to reduce the likelihood of a risk event and/or the potential impact of its occurrence to an acceptable level.
• Risk mitigation activities may include both the deployment and execution of control procedures and the implementation of other measures (e.g. creating provisions to cover losses caused by a risk event).
• Risk acceptance – a risk treatment method where no active risk treatment is used, applied where: a) the level of risk is acceptable; and b) risk avoidance, mitigation or sharing are not economically viable or feasible (e.g. political or macroeconomic risks).
• Risk sharing – transfer of a risk where the Company’s risk mitigation is ineffective, while the level of risk is not acceptable (the risk cannot be accepted) and third-party services can be used for risk treatment. Risk sharing is mainly aimed at mitigating the consequences rather than the likelihood of risk occurrence.

Risk management process stages

In line with the Policy, the risk management process at FPC consists of five stages:

1. Risk identification
2. Risk analysis
3. Risk treatment
4. Monitoring and review
5. Communication and consultation

As part of these processes, risk reports are prepared to be submitted to the executive bodies, Audit and Risk Committee, the Company’s Board of Directors and external stakeholders (if necessary), including information on risks, risk treatment measures and effectiveness of the RMICS.

FPC’s risk management structure

The risk management structure showed is in line with FPC’s Risk Management and Internal Control Policy.

Key risks

According to the above methodology, eight risks were identified as key risks for FPC in 2020.

• Decline in passenger-kilometres
• Poor train capacity utilisation
• Decline in yields (deregulated segment)
• Decline in yields (regulated segment)
• Increase in passenger transportation cost
• Variance from targeted effects of the implementation of strategic initiatives
• Failure to deliver key investment projects
• Shortage of train crews

Risk map

Key risks and the Company’s strategy

FPC’s operations are carried out in accordance with the Company’s Development Strategy to 2030 (the “Strategy”), which incorporates the parameters contained in the following documents approved by the Government of the Russian Federation: Transport Strategy of the Russian Federation to 2030, Strategy of Railway Transport Development in the Russian Federation to 2030, and the Long-Term Development Programme of Russian Railways to 2025.

In addition, the Strategy identifies the following list of strategic benchmarks:

• Passengers carried
• Revenue
• EBITDA
• Net debt/EBITDA
• Carriage acquisition

Major factors that affected FPC’s KPI performance in 2020:

• Changes in the macroeconomic environment taking place faster than anticipated
• Deterioration of the geopolitical situation (US dollar, euro, Swiss franc exchange rates, imposition of sanctions against Russia)
• Competition from alternative modes of transport (air, road)
• Shorter average distances travelled by passengers
• Increased fares in the regulated segment with no compensation from the government
• Aggressive pricing policy of air carriers, aircraft fleet renewals, expansion of air carrier route networks, increased choice of flights, increased subsidies to air carriers
• Growing competition in the domestic market for rail passenger services
• Changes in demand for passenger services (including shifts in passenger traffic from domestic to international travel, growth in the cost of accommodation and recreation in major cities of the Russian Federation and its tourist and recreation destinations)
• Decrease in the households’ nominal income and inflation rising above forecast
• Epidemic outbreaks

The Strategy outlines a number of strategic projects that drive the achievement of the objectives set. Strategic projects are implemented by FPC taking into account the macroeconomic situation in the country, with appropriate adjustments to the pace and scale of implementation and the amount of resources required.

Since key risks may have a significant negative impact on FPC’s operations, the achievement of strategic goals, and the implementation of the Strategy, the Company pays due attention to managing its key risks. Key risks are approved by the General Director based on a decision made by FPC’s Board of Directors following a risk review and taking into account the opinion of the Audit and Risk Committee, with the Board of Directors following up on key risk treatment activities by FPC units.

Internal control

Internal control at FPC is carried out in accordance with the Risk Management and Internal Control Policy.

Internal control is an integral, indispensable part of the risk management system, while the risk management and internal control system is part of corporate governance.

Internal control serves as a key risk management tool, addressing the following tasks:

• Creation of a control environment enabling both the development and implementation of risk treatment control procedures and the operation of the risk management process across all stages
• Effective information sharing and communication both within the Company and with external stakeholders
• Ensuring proper monitoring of the set-up and operation of the risk management process across all stages