The year 2022 saw a tremendous shift in the geopolitical landscape as well as the imposition of unprecedented sanctions against the Russian Federation, which had a detrimental effect on all participants in the economy and social system. Amid restrictions on the supply of imported materials, spare parts, technology, and software, FPC recorded a large rise in passenger traffic as a result of air travel bans and border closures in a number of foreign countries.
Despite external challenges, JSC FPC proved in practise that it is prepared to maintain the transport accessibility of Russian Federation's citizens, in part by adopting a risk-oriented management strategy for the Company's management.
Risk Management System
Risk management at JSC FPC is a continuous and systematic process embedded throughout the organisation, integrated with business processes and aimed at mitigating exposure and strengthening the assurance that JSC FPC’s objectives and goals will be achieved.
All Company units are involved in the risk management process within their scope of responsibility.
The Risk Management Department is responsible for the overall coordination and methodological support of the risk management process, the creation and submission of reports to JSC FPC management, and the risk management training for the Company's workers.
The following documents serve as the foundation for risk management at JSC FPC:
JSC FPC Risk Management Policy approved by the decision of the Company’s Board of DirectorsMinutes No. 11 dated 27 December 2019.
Methodological recommendations on determining the acceptable value of risks (risk appetite), approved by the decision of the Board of Directors of JSC FPCMinutes No. 24 dated 2 July 2020.
Methodological Recommendations on Risk Management and Internal Control approved by the decision of the Director General of JSC FPCDecree No. 258r dated 20 March 2020 of JSC FPC.
Regulations on Interaction in the Risk Management and Reporting Process, approved by the order of the Director General of JSC FPCDecree No. 258r dated 20 March 2020 of JSC FPC.
In 2022, JSC FPC managed corporate-wide risks in accordance with the mentioned regulations. Lower-level operational risks were managed in a simplified manner, with limited procedures.
The Internal Audit Department is responsible for assessing the RM&ICS reliability and effectiveness.
Management Principles
The Board of Directors of JSC FPC approved the Risk Management and Internal Control Policy of JSC FPC (hereinafter, the Policy), which was developed in accordance with the Risk Management and Internal Control Policy of the parent company.
In accordance with the Policy, the main purpose of the RM&ICS is to provide reasonable assurance that the following will be achieved:
Strategic objectives
Operational objectives
Objectives in ensuring compliance with applicable international regulations, regulations of the Russian Federation and internal regulations of the Company
Objectives in ensuring the reliability, timeliness and quality of all types of reporting
The Risk Management and Internal Control Policy stipulates that RM&ICS organisation and functioning in JSC FPC is to be carried out in accordance with the principles set out in GOST R ISO 31000:2010 Risk Management. Principles and guidelines, namely:
Risk management creates and protects value
Risk management is an integral part of all organisational processes
Risk management is part of the decision-making process
Risk management is explicitly associated with uncertainty
Risk management is systematic, structured and timely
Risk management is based on the best available information
Risk management is adaptable
Risk management takes into account human and cultural factors
Risk management is transparent and takes into account the interests of stakeholders
Risk management is dynamic, iterative and responsive to changes
Risk management contributes to the continuous improvement of the organisation
Main objectives of the RM&ICS
Creation of infrastructure and a regulatory and methodological basis for the effective functioning of the risk management process
Integration of risk management and internal control procedures into the strategic and operational activities of the Company, which will enable proactive responses to risks and negative changes in the external and internal environment (through planning and implementation of risk treatment activities)
Awareness-building among RM&ICS participants and other stakeholders
Reduction in the number of unforeseen events that could have a negative impact on the achievement of JSC FPC’s goals
Central decision-making bodies for risk management at JSC FPC are its Board of Directors and the General Director.
The Company has the Audit and Risk Committee of the Board of Directors and the Risk Management Committee to prepare recommendations for management decision-making.
Improvement of the RM&ICS in 2022
In a period of uncertainty in 2022, the existing risk management system helped improve the adaptability of the Company, its core processes and systems, which enabled prompt adjustment of business goals and preparation of scenario options for JSC FPC’s development until 2025. Thus, the risk management system was designed to support the achievement of the Company's objectives.
In order to increase the effectiveness of the IC&RMS, a number of steps were put in place during 2022. The Company's important risks were defined, and methods for identifying, analysing, and assessing risks were applied at a higher quality level.
The Internal Audit Department assessed the reliability and efficiency of the risk management and internal control process for 2022. Based on the results of the assessment, a conclusion was drawn that the risk management and internal control process at JSC FPC is functioning in accordance with the principles and approaches approved by the Board of Directors of JSC FPC, COSO documents and GOST R ISO 31000-2019. A number of relevant recommendations were made in order to further enhance how the risk management and internal control process functions.
In 2023, it is planned to continue further improvement of JSC FPC’s RM&ICS, taking into account the implementation of a project to improve and develop an integrated risk management model elaborated by the Parent Company.
Three lines of defence model
In its operations, JSC FPC uses an approach driven by the three lines of defence model based on roles and responsibilities sharing. Each of the three lines increases the likelihood of FPC successfully achieving its objectives.
Risk Treatment Methods Applied
The following risk treatment methods are currently used at JSC FPC:
Risk avoidance – withdrawing from an activity or project associated with a particular (inherent) risk where other treatment strategies (risk mitigation, risk sharing, risk acceptance) are not economically viable or feasible. Given that any activity of the Company is associated with risks and complete withdrawal from any activity leads to its discontinuation, this strategy can be used to manage individual, specific risks (and/or new activities, projects).
Risk mitigation – risk treatment involving activities to reduce the likelihood of a risk event and/or the potential impact of its occurrence to an acceptable level. Risk mitigation activities may include both the deployment and execution of control procedures and the implementation of other measures (e.g. creating provisions to cover losses caused by a risk event).
Risk acceptance – a risk treatment method where no active risk treatment is used. Used in cases when:
the level of risk is at an acceptable level;
risk avoidance, risk mitigation, risk sharing is economically inefficient or impossible (e.g., political or macroeconomic risks).
Risk sharing – transfer of a risk where the Company’s risk mitigation is ineffective, while the level of risk is not acceptable (the risk cannot be accepted) and third-party services can be used for risk treatment. Risk sharing is mainly aimed to mitigate the consequences rather than the likelihood of risk occurrence.
Risk Management Structure of JSC FPC
The risk management structure showed is in line with FPC’s Risk Management and Internal Control Policy.
Risk Management Process Stages
In line with the Policy, the risk management process at FPC has five stages:
Risk identification
Risk analysis
Risk treatment
Monitoring and review
Communication and consultation
As part of these processes, risk reports are prepared to be submitted to the executive bodies, Audit and Risk Committee, the Company’s Board of Directors and external stakeholders (if necessary), including information on risks, risk treatment measures and effectiveness of the RM&ICS.
Risk Register of JSC FPC
In 2022, 104 risks were identified at JSC FPC, of which 92 risks were quantitatively assessed and 12 – qualitatively assessed; in 2021, 103 risks were identified.
A total of 32 risks were materialised in 2022 (21 risks in 2021).
Key Risks
The key risk register of JSC FPC for 2022 contains eight risks which have been identified based on their impact on the achievement of the Company's goals and grouped into categories by business process. They are further broken down into risks related to a line of business.
Business process
Risk factors
Measures to impact on risks
Financial and economic management
External factors:
Change in interest rates on loans.
Decrease in revenue streams relative to planned parameters.
Reduction in the amount of subsidies received from state tariff regulation.
Changes in legislation (Tax Code, Labour Code, Transport Safety Act, etc.).
Macroeconomic factors.
The geopolitical situation, which led to a decrease in passenger traffic while the number of scheduled trains cannot be changed promptly.
Internal factors:
Maintenance of single-option routes (most unprofitable destinations).
Over-budgeting by train allocations (not proportional to passenger turnover).
Inefficient use of assets (security costs for buildings and facilities not in use, security costs, utility and other bills, including property tax);
Increase in haulage costs to the budget is not proportional to the increase in passenger turnover.
Scheduling of passenger trains, trailing and through carriages in domestic and international traffic based on incorrect estimates of projected passenger turnover.
Failure to coordinate the activities of FPC's units regarding the development of passenger train schedules to align train layouts and make-up.
Lack of (insufficient preparation of) proposals to meet the needs of the consumers for long-distance passenger trains of JSC FPC.
Poor analysis of information on declining seasons of passenger traffic, unprofitable destinations, trains and carriage groups with a negative financial result.
Incorrect make-up of passenger trains.
Inadequate qualifications of staff.
Failure to account for changes in transport demand to offer supply.
Excess of actual inventories over their required amount.
Inexpediency of major repairs.
Lack of timely production and operating cost budgets.
Incorrect production and operating cost budgets.
Staffing of train crews to a level of 94% of the technological need, to comply with labour legislation regarding working and rest regimes.
Decisions made by the Financial Risk Management Commission of JSC FPC. (Internal).
Inefficiency of marketing initiatives.
Cost overruns.
Excess of funds attracted over the planned parameters defined in the JSC FPC's budget.
Organisation of traffic sizes and running costs
Work with the rolling stock fleet.
Refinancing of the Company’s debt obligations
Increase in revenue streams
Work with the rolling stock fleet. Refinancing of the Company's debt obligations Increase in revenue streams Improvement of operational efficiency and optimisation of budgeted costs
Shaping and implementing a marketing policy
External factors:
Changes in the macroeconomic environment taking place faster than anticipated.
Competition of alternative modes of transport.
Change in demand for passenger services.
Decline in real household earnings.
Non-indexation/insufficient indexation of passenger transport fares by the Federal Anti-monopoly Service of the Russian Federation.
Seasonal decline in demand for passenger transport.
Internal factors:
Change in passenger transport supply (change in JSC FPC traffic amount).
Change in carriage-kilometre and seat-kilometre performance compared to the previous year (plan).
Assignment of passenger trains with inconvenient arrival or departure times, long transit time.
Risk of ineffective marketing initiatives.
Implementation of special marketing promotions, special fare offers.
Development and formulation of methodologies for setting passenger transport fares based on market analysis, except for fares for the deregulated passenger transport segment in trains included in the yield management technology.
Preparation of proposals for fare indexation and maintenance of a schedule of flexible fare regulation for passengers in long-distance trains.
Study of the factors determining the structure and dynamics of consumer demand for long-distance passenger transport services, market conditions in the regions served by JSC FPC branches, and competitive analysis.
Keeping a close watch on fares of alternative modes of transport.
Security assurance
External factors:
Negative foreign policy environment in the world.
Presence of armed conflicts near Russia's borders.
Sharp drop in the standard of living of households.
Exacerbation of political, social, national and religious tensions.
Increase in terrorist acts.
Socio-political and economic instability in neighbouring nations.
People's loss of ideological and spiritual orientation in life.
Increased dissemination of terrorist methods and means through information networks, publication of necessary manuals.
Negative influence of the media giving a build-up to terrorists.
Excess of the cost of protection over the value of protected information assets.
Non-compliance by contractors with regulations.
Unauthorised access to FPC's information systems
Internal factors:
Failure of employees to comply with regulations on the use of personal computers in the workplace, industrial espionage.
Non-compliance by employees with the provisions of regulations.
Failure of the access control system, loss of magnetic pass by staff.
Loss (disclosure) of documents containing information that constitutes a trade secret of the Company.
Leaks of protected information, including personal data.
Inadequate performance of official duties by managers at all levels.
Communication of the provisions of regulatory documents of the Russian Federation and internal documents of JSC FPC to its employees.
Appointment of safety officers
Transport safety and certification of train managers, chief engineers and other employees of JSC FPC who handle transport safety.
Installation of video surveillance and registration systems in the carriages.
Establishment of FPC's in-house transport security unit.
Organisation of competitive procedures for the procurement of technical transport security means.
Transport safety drills and exercises.
Transmission of information to automated centralised personal databases on passengers and personnel (crew) of vehicles during passenger movements.
Implementation of a unified technical policy in the field of information security with the Parent Company.
Planning and implementation of measures to protect trade secret information and ensure information security at JSC FPC.
Planning and control over the implementation of information security measures at FPC's facilities, and participation in the acceptance of these measures.
Organisation of the operation of the technical subsystems and information protection means of JSC FPC.
Compliance
Internal factors:
Non-compliance by employees with the provisions of regulations.
Inadequate performance of official duties by managers at all levels.
Communication of the provisions of regulatory documents of the Russian Federation and internal documents of JSC FPC to its employees.
Checks on the performance of contractual obligations by contractors and their possible affiliation with JSC FPC employees.
Risk Map
In order to provide a visual representation of risk materiality, a risk map has been developed.
The Y-axis of the risk map displays the magnitude (degree) of the impact of identified risks on JSC FPC’s operations, while the X-axis shows the likelihood of their occurrence.
Map of Key Risks of JSC FPC for 2022
Key Risks and the Company’s Strategy
In addition, the Strategy identifies the following list of strategic benchmarks:
Passengers carried
Revenues
EBITDA
Net debt/EBITDA
Carriage acquisition volume
In 2022, the following factors had the main impact on JSC FPC's key performance indicators:
Changes in the macroeconomic environment taking place faster than anticipated
Deterioration of the geopolitical situation (imposition of sanctions on Russia)
Decrease in the households’ nominal income and inflation rising above forecast
The Strategy outlines a number of strategic projects that drive the achievement of the objectives set. FPC implements strategic initiatives while taking into consideration the macroeconomic conditions in the country and making the necessary modifications to the pace, scale, and resource requirements.
Since key risks may have a significant negative impact on JSC FPC’s operations, the achievement of strategic goals, and the implementation of the Strategy, the Company pays due attention to managing its key risks. The register of key risks is approved by the General Director based on a decision of the Board of Directors (taken after the review of the register) and taking into account the opinion of the Audit and Risk Committee of the Board of Directors. The Board of Directors then supervises the implementation of measures to treat such risks by JSC FPC’s business units.
Moreover, JSC FPC identified the risk related to the deviation from achieving the planned effects of the implementation of JSC FPC strategic initiatives, whereby the Company keeps track of the deviation from the planned effects for all strategic initiatives.
Sustainable Development Risks
JSC FPC also identified sustainability risks, possible consequences for the Company in case of their occurrence and developed measures to treat the same.
Sustainable development risk register
Sr.No.
Risk
Possible consequences
Treatment measures
1
Violations of traffic safety rules for passenger trains
Increase in the number of events related to the violation of railway traffic and operational safety rules
Conducting scheduled modernisation of passenger carriages.
Organising the claim activities in the event of poor performance of contractual obligations on the part of service providers and contractors.
Implementing FPC’s Programme of measures to reduce the frequency of traffic incidents and accidents and the severity of their consequences, and to achieve the set targets for traffic safety.
Checking the availability of the design documentation for the design enhancement activities when accepting the carriages for repair
2
Dissatisfaction with JSC FPC's activities in the public setting
Transition of the population to road and air transport
Responding to abnormal situations on a information-driven basis.
Reacting promptly to typical information threats
3
Violation of environmental laws
Violation of laws in terms of environmental protection provisions (administrative proceedings, administrative penalties in the form of fines)
Preparing the operational programme for the environmental protection activities of JSC FPC and control over its implementation.
Conducting industrial environmental oversight.
Planning and implementing investment projects of environmental significance (wastewater treatment facilities, carriage washing facilities, storm sewers).
Training the managers and specialists responsible for environmental protection
4
Risk of violation of industrial safety requirements
Violation of industrial safety requirements resulting in injuries, loss of life, losses and damage from accidents and incidents (administrative penalties and fines imposed on the organisation and officials, administrative suspension of activities)
Preparing the operational programme for the environmental protection activities of JSC FPC and control over its implementation.
Replacing technical devices that reached the end of their standard service life under the Investment Programme of JSC FPC.
Training and certifying responsible managers and specialists.
Implementing the production control
5
Shortage of rolling stock
Failure to meet passenger traffic targets
Failure to meet capacity utilisation targets
Increase in rolling stock rental costs.
Increase in expenses for repairs of the passenger carriage fleet
Planning, organising and monitoring the implementation of programmes for depot repairs, overhauls and modernisation of passenger carriages, including repairs of third-party carriages.
Developing and organising the measures to minimise the use of freight series locomotives in passenger traffic.
Overseeing the lease contracts for manned locomotives, including the introduction of necessary alternations/additions and reconciliation of services provided.
The use of conserved carriages
6
Shortage of service staff
Reduced transport safety.
Reduced quality of passenger service, more complaints.
Failure to comply with work/rest regime
Monitoring the staffing levels of the business units that support the transportation process.
Analysing the competitiveness of occupations and positions on the labour market and taking appropriate corrective measures to improve their competitiveness.
Organising staff surveys to investigate dissatisfaction factors and take timely corrective action.
Providing professional training
7
Work-related injuries
Occurrence of work-related injuries
Developing local regulations in the field of occupational safety.
Investigating into work-related injuries followed by development of corrective measures
8
Passenger dissatisfaction with the quality of services
Loss of loyalty from the passenger side
Issuing penalties to lessee-companies.
Conducting joint reviews with the lessee-companies to develop solutions to eliminate non-conformities.
Conducting random inspections of dining carriages by employees of the Catering Department
9
Leakage of personal data of Bonus Loyalty Programme members
Unauthorised deletion/transfer/copying of personal data on registered members of the Bonus Loyalty Programme, resulting in violation of applicable law of the Russian Federation and reputational and financial risks for JSC FPC
Monitoring the requests from the loyalty programme members in terms of compliance with Federal Law No. 152-FZ On Personal Data.
Transmitting members’ personal data on banking products (co-branded cards) through an encrypted channel.
Monitoring ARM vulnerabilities.
Preventing the breach of rules relating to personal data of the Bonus Loyalty Programme members
