Risk Management

Therefore, identifying risks and making decisions in conditions of uncertainty are important elements of the management process at JSC FPC, the effectiveness of which depends entirely on the means and methods used to identify and assess risks. The conscious use of risk management tools has enabled FPC to withstand external fluctuations, maintain stability, ensure reasonable confidence in the achievement of its goals and, despite all the limitations, challenges and sanctions, confirm in practice its ability to reliably, efficiently and safely ensure transport accessibility for the population of the Russian Federation.

Risk management system

Risk management at JSC FPC is a continuous and systematic process embedded throughout the organisation levels, integrated with business processes and aimed at mitigating the exposure to risks and boosting confidence that the objectives and goals of the Company will be achieved.

All units and divisions of the Company are involved in the risk management process within their terms of reference.

Overall coordination and methodological support of the risk management process, preparation and submission of reports to JSC FPCs management, and organisation of risk management training for the Company's employees are provided by the Risk Management Department within the Strategic Development and Risk Management Department.

The following documents serve as the foundation for risk management at JSC FPC:

• JSC FPC's risk management and internal control policies
• Methodological recommendations for determining the acceptable risk profile (risk appetite)
• Methodological recommendations on risk management and internal control
• Regulations on interaction in the risk management and reporting process

In 2024, JSC FPC aligned the corporate‑wide risk management with the above‑listed documents. Lower‑level operational risks were handled with fewer steps and a more straightforward approach.

The Internal Audit Department is responsible for assessing the RM&ICS reliability and effectiveness.

Principles of risk management

In accordance with JSC FPC's Risk Management and Internal Control Policy (hereinafter referred to as the Policy), the main objective of the RM&ICS is to provide reasonable assurance the following will be achieved:

• Strategic objectives
• Operational objectives
• Objectives in the area of compliance with the requirements of regulatory legal acts of the Russian Federation and (or) international legal acts and the Company's by‑laws (compliance)
• Objectives in ensuring the reliability, timeliness and quality of all types of reporting

The Policy also stipulates that the organisation and functioning of the RM&ICS at JSC FPC shall be aligned with the following principles:

1. Integratedness and comprehensiveness

Internal control is an integral part of the risk management system, and the risk management and internal control system is part of corporate governance.At the same time, risk management is embedded in strategic and operational activities, process and project management and is an intrinsic part of the entire Company's activities (in part, through risk consideration in planning, organisation of activities, decision‑making, development and adoption of regulatory documents). In its risk management process, JSC FPC takes into account the best available information, the balance of opportunities and risks, risk management costs, expected benefits, and maintains stakeholder awareness and knowledge.

2. Structuredness

Risk management takes into account unified regulatory and methodological approaches to obtain an insight into the risk universe and risk portfolio to ensure comparability of information, including risk assessment and understanding of their impact on certain parameters (indicators).

3. Adaptability and dynamicity

Risk management shall factor in the Company's internal and external environment (including corporate culture and structure), current objectives, accumulated experience and respond flexibly to them, including in the process of continuous improvement of the RM&ICS.

Main tasks of the risk management and internal control system

The main tasks of the RM&ICS include:

• To create infrastructure and regulatory and methodological framework for the implementation of the risk management process, including within the scope of strategic and operational activities, process and project management
• To integrate risk management and internal control procedures into the Company's strategic and operational activities
• To improve the sustainability and efficiency of the Company, projects, and business processes through risk management, including risk‑based goal setting and decision‑making

The Board of Directors and the General Director are JSC FPC's risk management decision‑making centres, for whom the Audit and Risk Committee of the Board of Directors and the Risk Management Committee develop recommendations in the area of risk management.

Improvement of the risk management and internal control system in 2024

In 2024, in accordance with the Risk Management and Internal Control Policy of OJSC Russian Railways, the Risk Management and Internal Control Policy of JSC FPC was updated and approved. Adopting this document will help the Company, as well as and its fundamental systems and processes, become more flexible while also supporting the accomplishment of JSC FPC's goals.

During 2024, the Programme for the Development of the Risk Management and Internal Control System at JSC FPC for 2024 was carried into effect, aiming to develop and improve the effectiveness of the RM&ICS. The programme's scope:

• Approaches to identifying, analysing and assessing the Company's risks were upgraded
• Advanced training of risk owners was provided through one of the country's leading educational institutions
• Continued automation of the risk management process, including the development and implementation of an automated information panel for monitoring risk indicators

The Internal Audit Department assessed the reliability and effectiveness of the risk management and internal control process for 2023. The results of the assessment showed an improvement in the performance of the RM&ICS in 2023 compared to previous periods, while some weaknesses remained, limiting the rise in the RM&ICS efficiency and its development in line with the best practices. In this regard, a number of recommendations for development areas were prepared in 2024 and included in the Risk Management and Internal Control System Development Programmes of JSC FPC for 2024 and 2025.

In 2025, JSC FPC plans to implement the following concepts and measures (projects) in order to improve the RM&ICS:

• To develop the RM&ICS in line with the delivery of the project to improve and develop the integrated risk management model of OJSC Russian Railways
• To upgrade the skills and expertise of the staff involved at various levels
• To continue the automation of the risk management process
• To further improve approaches to identifying, analysing and assessing the Company's risks

Three lines of defence model

In the normal course of business, JSC FPC uses a three lines of defence model approach, which is based on the allocation of roles and responsibilities. Each of three lines increases the likelihood of JSC FPC successfully achieving its objectives.

Risk treatment methods applied

The following risk treatment methods are used at JSC FPC:

• Risk avoidance – refraining from an activity or project associated with a particular (inherent) risk where other treatment strategies (risk mitigation, risk sharing, risk acceptance) are not economically viable or feasible. This strategy is applicable for managing certain specific risks and (or) new lines of business, projects
• Risk mitigation – risk treatment involving activities to reduce the likelihood of a risk event and/or the potential impact of its occurrence to an acceptable level. Risk mitigation activities may include both the deployment and execution of control procedures and the implementation of other measures (e.g., creating provisions to cover losses caused by a risk event)
• Risk acceptance – a risk treatment method utilising no active risk treatment. It is used when the a is at an acceptable level or when avoiding, minimising and transferring risk is not cost‑effective or possible (e.g., political or macroeconomic risks)
• Risk transference – transfer of a risk where the Company’s risk mitigation is ineffective, while the level of risk is outside the risk tolerance scope (the risk is unacceptable), but the risk treatment process can use third‑party services. Risk transference is mainly aimed at mitigating the impact of consequences rather than reducing the likelihood of risk realisation.

Organisational structure of JSC FPC's risk management

The organisational risk management structure is aligned with JSC FPC’s Risk Management and Internal Control Policy.

Risk management process stages

In line with the Policy, the risk management process at JSC FPC has the following stages:

1. Risk identification
2. Risk analysis and assessment
3. Treatment of risks identified
4. Monitoring and review
5. Communication of information and consultation

These processes yield risk information that may be submitted to executive bodies, the Audit and Risk Committee of the Board of Directors, the Board of Directors, and other interested parties. Such information is also provided in documents, plans, programmes and reports, which may include materials for the financial plan, key performance indicators, investment programme, innovation development programme, annual reports, long‑term development programme and reports on its implementation, as well as other strategic documents of the Company.

Key risks

In 2024, JSC FPC's Risk Management Committee formed and approved a compliance risk register. A correlation analysis was conducted using the branch data array to identify risk factors affecting passenger satisfaction with the quality of travel, and the architecture for interaction between the Company's management and its branches in the area of the RM&ICS was determined.

JSC FPC's register of key risks was updated in terms of both quantitative and qualitative composition:

• Number of risks in the register did not change and amounted to 23 risks
• Number of key risks decreased from 12 to 7 risks
• Number of risk owners remained at the same level and amounted to 15 risk owners

Relations of key risks and the Company’s strategy

JSC FPC's Development Strategy until 2030 defines the following list of strategic benchmarks:

• number of passengers dispatched
• Revenues
• EBITDA
• Net debt/EBITDA
• Carriage acquisition volume

In 2024, the following factors had the main impact on the achievement of key performance indicators of JSC FPC:

• Improvement of the macroeconomic situation expressed in the above‑the‑target growth of GDP and increase in the real disposable household income
• Changes in the structure of domestic traffic due to continued restrictions on flights in the south of Russia and reduction in the number of aircraft

The Strategy outlines a list of strategic projects that drive the achievement of the objectives set. The Company implements strategic initiatives while taking into consideration the macroeconomic conditions in the country and making the necessary adjustments to the pace, scale, and resources required.

Since key risks can have a significant negative impact on JSC FPC’s operations, the achievement of strategic goals, the Company pays due attention to risk management. The register of key risks is approved by the General Director based on the resolution of the Board of Directors (taken after the review of the register) and taking into account the opinion of the Audit and Risk Committee of the Board of Directors. The Board of Directors then supervises the treatment of key risks by JSC FPC’s business units.

Sustainable development risks

JSC FPC also identified sustainability risks, determined the possible consequences for the Company in the event of their realisation and developed measures to influence them.