Internal systems and functions

• the compliance function carried out by an independent compliance unit (Compliance Department – BCM);
• internal control unit, i.e., the Internal Control Department (BKO) tasked with implementing and supervising system solutions for the ICS;
• independent internal audit unit (Internal Audit Department – BAW) responsible for carrying out independent and objective assessment and evaluation of adequacy and effectiveness of the internal control system and the system of governance.

The ICS is built on the basis of the said elements and is based on a model of three independent and complementary levels, where:

Supervision over the internal control system is exercised by:

• supervision and periodic evaluation of the internal control system by the Supervisory Board;
• activities of the Management Board, including the establishment of an adequate and effective internal control system and periodic assessment of the functioning of the ICS;
• supervision of PZU Group Directors and Managing Directors over the implementation of the control function in the areas reporting to them;
• supervision by the head of the Internal Control Department on systemic solutions to improve the efficiency and effectiveness of the ICS;
• supervision by the supervisor of the internal audit function in overseeing the tasks performed within the internal audit function;
• supervision exercised by PZU units in relation to their subordinate units or areas in the introduction and maintenance of effective and efficient internal control, adequate to the tasks performed in a given area.

As part of its cooperation with PZU Group entities, PZU analyzes information that it receives regularly from these entities concerning the organization of the internal control system, internal control conducted and evaluation of the internal control system, in order to improve unified standards for the operation of an effective internal control system.

Reporting is done through monthly and annual reports for the Management Board members and quarterly risk reports to the Supervisory Board’s Audit Committee and the PZU Supervisory Board itself, as well as in the form of current information provided on an ad hoc basis to the members of the Company’s statutory bodies if the need arises.

The internal audit function is run in a manner ensuring its unbiased nature and independence from operational functions, and its purpose is to add value and enhance the PZU Group’s operational performance. The activity of the audit function involves a regular and orderly assessment of the adequacy and effectiveness of the internal control system and other components of the management system. The internal audit function supports the PZU Group in the pursuit of its objectives by providing – also through consulting – certainty as to the effectiveness of these processes.

The duties of the internal audit function comprise in particular:

• development and implementation of an audit plan, which defines the scope of audit work to be undertaken in subsequent years, with regard to all types of activity and the Company’s overall system of management;
• making recommendations based on the results of the work carried out;
• checks of execution of the corrective measures following from the recommendations made

The timely implementation of audit recommendations by the business units is overseen by the responsible member of the Management Board or PZU Group Director. The Internal Audit Department monitors the progress of implementing the recommendations based on information obtained from the respective business units. After an analysis, it decides whether to consider them completed.

The following adopted principles guarantee the independence and impartiality of internal audit:

• The Managing Director of Audit, who heads the Internal Audit Department, reports functionally to the Audit Committee and organizationally to the President of the Management Board of PZU or to a person delegated to temporarily perform the duties of the the President of the Management Board of PZU;
• the appointment and dismissal of a person to the position of the head of the internal audit unit requires the opinion of the Audit Committee of the PZU Supervisory Board;
• The Managing Director on Audit participates in meetings of the Audit Committee of the PZU SA Supervisory Board and meetings of the Management Board, and representatives of the Internal Audit Department participate in meetings of selected committees operating within PZU’s structure;
• PZU’s internal auditors demonstrate outstanding professional and ethical qualifications and possess the proper knowledge and skills, including the knowledge of issues necessary to conduct audits. They have access to the necessary information, explanations, documents and data, allowing for the timely and correct performance of their tasks;
• the scope of audit activities performed during each audit and the resulting evaluations are autonomous decisions of internal audit. The tasks are allocated in such a manner so as to prevent potential and actual conflicts of interest. Each employee, before starting a task, is obliged to inform the supervisor in case of a potential conflict of interest – assigned tasks are rotated as necessary. In addition, no auditor may, before one year has elapsed, evaluate activities that they themselves previously performed or managed. They also cannot assume responsibility for operational activities that are subject to internal audit review.

In order to ensure the proper quality and continuous improvement of the internal audit function, internal (on an annual basis) and external (not less than once every five years) assessments of the Company’s internal audit activities are conducted. A third-party assessment of the internal audit function at PZU conducted by PwC Advisory and an analysis of coordination of the Group’s internal audit run by the Internal Audit Department demonstrated general compliance with the International Standards for the Professional Practice of Internal Auditing and the Code of Ethics developed by the IIA.

The process is conducted in compliance with:

• accounting principles (accounting policy) adopted by the Management Board;
• chart of accounts with a commentary;
• other detailed internal regulations approved by the PZU Management Board specifying key rules for recording business events in PZU, the valuation of assets and liabilities and the calculation of the financial result;
• method of keeping the accounting ledgers;
• reporting systems.

Data are prepared in the source systems using formal operating and acceptance procedures which specify the powers of specific persons.

The reporting process is carried out by qualified, skilled and experienced staff.

The key controls during preparation of the financial statements include:

• controls and permanent monitoring of the quality of input data, supported by financial systems with defined rules of data correctness, in accordance with PZU’s internal regulations governing the control of accuracy of accounting data;
• data mapping from the source systems to financial statements supporting the proper presentation of data;
• analytical review of financial statements by specialists to compare them with the business knowledge and business transactions;
• formal review of the financial statements to confirm compliance with the applicable legal regulations and market practice in terms of required disclosures.

Coordination of activities with regard to consolidated financial reporting processes at PZU and PZU Life is made possible by the Finance Divisions’ organizational model common to these companies, based on the principle of personal union. PZU controls all its consolidated subsidiaries through these companies’ management boards and supervisory boards.

Consolidation packages forwarded by subsidiaries are subjected to:

• verification procedures by a statutory auditor scrutinizing the PZU Group’s consolidated financial statements;
• analytical reviews by specialists.

Consolidation packages forwarded by banks are also reconciled with their published stock exchange disclosures.

The organization and the process of preparing the financial statements are regularly reviewed by the internal audit function.

The auditor for PZU’s individual and consolidated financial statements for 2023 was KPMG Audyt.

The cooperation with KPMG Audyt, pertaining to the reviews and audits of the standalone financial statements of PZU and consolidated financial statements of the PZU Group has continued without interruption since 2014.

The auditor for PZU’s individual and consolidated financial statements for 2024 was PwC.

The annex was concluded pursuant to Article 16(2) of the Act amending the Accounting Act, the Act on Statutory Auditors, Audit Firms, and Public Oversight, and certain other acts, which allowed the head of the entity (i.e., the Management Board) to enter into an agreement for the attestation of the PZU Group’s Sustainability Reporting for a financial year that began before 1 January 2025, with the audit firm selected to conduct the audit of the financial statements for that financial year.

On January 1, 2025, amendments to the Act of May 11, 2017 on Certified Public Accountants, Audit Firms and Public Supervision (i.e., Journal of Laws of 2024, item 1035, as amended), introduced by the Act of December 6, 2024 on amendments to the Accounting Act, the Act on Certified Public Accountants, Audit Firms and Public Supervision and certain other acts (Journal of Laws, item 1863), came into force. The law implemented the EU directive on corporate sustainability reporting (CSR Directive) into Polish law.

Taking the above into account, the Audit Committee of the PZU Supervisory Board updated the content:

• Policy for selection of the audit firm to perform the audit;
• Policy on the provision of permitted non-audit services by the audit firm conducting the audit, by affiliates of the audit firm and by a member of the audit firm’s network;
• Procedures for the selection of the audit firm

and aligned the titles of the policies and procedures with the current wording of the regulations.

The Supervisory Board amended the aforementioned documents with effect from January 1, 2025.

The amendments expanded the Audit Committee’s authority to monitor sustainability reporting.

According to the new provisions, the selection of the audit firm to carry out attestation of sustainability reporting is made by the body approving the entity’s financial statements until the Articles of Association of PZU are amended accordingly.