Birra Peroni S.r.l. ORGANISATIONAL, MANAGEMENT AND CONTROL MODEL GENERAL PART

Transcription

1 Birra Peroni S.r.l. ORGANISATIONAL, MANAGEMENT AND CONTROL MODEL GENERAL PART

2 Contents 1. LEGISLATIVE DECREE N. 231/ The system of administrative liability pursuant to Lgs. Decree 231/ The authors of the crime: Subjects in top management positions and subjects under the direction of others Types of offence System of sanctions Attempted crime Events which modify the corporate entity Offences committed abroad The Organisational, Management and Control Model Confindustria guidelines Case law precedents The Birra Peroni S.r.l. Organisational Model A brief history of Birra Peroni S.r.l Methodology followed in the drafting of the Birra Peroni S.r.l. Organisational Model The Birra Peroni S.r.l. Organisational, Management and Control Model Approval of and amendments and additions to the Organisational Model Addressees of the Organisational Model THE ELEMENTS OF WHICH THE MODEL IS COMPOSED Mapping Activities carried out by top management Controls to protect the at-risk activities General controls - the internal audit system Specific controls Management of financial flows The Supervisory Board The requisites of the Supervisory Board The powers and duties of the Supervisory Board Information flows to and from the Supervisory Board The appointment of the Supervisory Board The Code of Ethics The disciplinary system Circulation of the Model BRIEF NOTES ON CRIMINAL LAW GLOSSARY

3 1. LEGISLATIVE DECREE N. 231/ The system of administrative liability pursuant to Lgs. Decree 231/01 Legislative Decree n. 231 of 8 th June 2001 (hereinafter Lgs. Decree 231/2001 ), issued in implementation of the delegation conferred on the Government by art. 11 of Law n. 300 of 29 th September has introduced, for the first time into our legal system, discipline on the responsibility of corporate entities for administrative offences consequent to crime (Appendix n. 1). The said discipline applies to corporate entities with legal status and to companies and associations also without legal status 2. Lgs. Decree 231/2001 is based on certain international and Community conventions ratified by Italy which impose the recognition of forms of responsibility on the part of corporate entities in the case of certain types of crime. In fact, according to the discipline introduced by Lgs. Decree 231/2001, a company can be held responsible for certain crimes committed or attempted in the interest or to the advantage of the company by members of the top management or those who are directed or supervised by the latter (art. 5, paragraph 1, of Lgs. Decree 231/2001) 3. A company s administrative liability does not depend on the criminal responsibility of the individual who committed or was an accomplice to the crime. This expansion of liability aims, among other things, to involve the company s capital and, therefore, the economic interests of the shareholders who, until the entry into force of the decree in question, suffered no direct consequences from the crimes committed in the interest or to the advantage of their company by directors and/or employees 4. 1 Lgs. Decree 231/2001 was published in the Official Journal n. 140 of 19 th June 2001, and Law 300/2000 was published in the Official Journal n. 250 of 25 th October On this point, the Supreme Court, Section VI, of 22 nd April 2004, n , has established that the provisions on the administrative liability of corporate entities are not applicable to sole-proprietor businesses. 3 Art. 5, paragraph 1 of Lgs. Decree 231/2001: The entity s liability - The entity is liable for offences committed in its interest and to its advantage: a) by persons holding positions of representation, administration or management of the entity or one of its organisational units with financial and functional autonomy or by persons who in fact manage and control the same; b) by persons under the direction or supervision of one of the subjects referred to in letter a). 4 Thus the introduction of the Linee guida per la costruzione dei modelli di organizzazione, gestione e controllo ex D.lgs. n. 231/2001 (Guidelines for the construction of the organisational, management and control models pursuant to Lgs. Decree 231/2001) of Confindustria, released on 7 th March 2002, with additional appendix issued on 3 rd October 2002 relative to so-called Corporate Offences (introduced into Lgs. Decree 231/2001 by Lgs. Decree 61/2002) and last updated on 24 th May 2004: The expansion of liability aims, among other things, to involve in the punishment of certain criminal offences the company s equity and, therefore, the economic interests of the shareholders who, until the entry into force of the law in question, suffered no direct consequences from the crimes committed, to the advantage of the company, by directors and/or employees. The principle of personal criminal liability in fact left them untouched by any consequent sanctions, other than the possible indemnity for the damage, if and as far as existing. With regard to criminal consequences, in fact, only arts. 196 and 197 of the criminal code contemplated (and 3

4 With the introduction of Lgs. Decree 231/2001, fines and imprisonment can now be directly and autonomously imposed on a company in relationship to a crime committed by a subject functionally linked to the company as contemplated by art. 5 of the decree. However, the company bears no administrative liability if it has, among other things, adopted and effectively implemented, before the crime was committed, an organisational, management and control model suitable to prevent the crimes in question. Such models can be adopted on the basis of codes of conduct drawn up by the associations which represent the companies, including Confindustria, communicated to the Ministry of Justice. In any case, a company bears no administrative liability if the top management subjects or their subordinates have acted exclusively in their own interests or those of third parties The authors of the crime: Subjects in top management positions and subjects under the direction of others As mentioned above, according to Lgs. Decree 231/2001, the company is responsible for offences committed in its interest and to its advantage: - by persons holding positions of representation, administration or management of the entity or one of its organisational units with financial and functional autonomy or by persons who in fact manage and control the same (i.e. the aforementioned top management subjects; art. 5, paragraph 1, letter a) of Lgs. Decree 231/2001); - by persons subject to the direction or supervision of a top management subject (so-called subjects under the direction of others; art. 5, paragraph 1, letter b) of Lgs. Decree 231/2001). It must be remembered that the legislative provision (art. 5, paragraph 2 of Lgs. Decree 231/2001) expressly contemplates that the company does not answer for the offence if such subjects have acted exclusively in their own or third parties interests. 1.3 Types of offence Pursuant to Lgs. Decree 231/2001, the company can be considered responsible only for the crimes expressly referred to by arts. 24 et seqq. of Lgs. Decree 231/2001, if still contemplate) an obligation under civil law to pay imposed fines or other economic penalties, but only in the case of the insolvency of the person who actually committed the fact. 5 Art. 5, paragraph 2 of Lgs. Decree 231/2001: The entity s liability The entity does not answer if the persons indicated in clause 1 have acted in their own exclusive interest or that of third parties. 4

5 committed in its interest or to its advantage by subjects qualified pursuant to art. 5, paragraph 1, of the said decree. The types of offence referred to by Lgs. Decree 231/2001 are listed in Appendix 2 of this Model, to which we invite you to refer for further details. 1.4 System of sanctions Pursuant to Lgs. Decree 231/2001, if the abovementioned crimes are committed or attempted, the company may be sanctioned by: a) a fine up to a maximum of Euro 1,549, (and precautionary attachment); b) debarment (also applicable as a precautionary measure) of no less than three months and no more than two years (with the specification, pursuant to art. 14, paragraph 1, of Lgs. Decree 231/2001, that Debarment regards the specific activity on which the company s offence depends ) which, in turn, can consist of: bar on practising the business activity; suspension or revocation of authorisations, licences or concessions functional to the offence committed; bar on contracting with the Public Administration; exclusion from grants, loans, contributions or subsidies and possible revocation of those already granted; bar on advertising goods or services; c) confiscation (or precautionary attachment); d) publication of the decision (in the case of the application of debarment). With regard to the amount of a fine, the judge determines: - the number of quotas taking into account the gravity of the fact, the degree of responsibility borne by the company, and the activity carried out to eliminate or mitigate the consequence of the fact and to prevent further offences; - the amount of the single quota, on the basis of the company s economic and equity situation. 5

6 Debarment is applied in connection with all crimes contemplated by Lgs. Decree 231/01 except for those referred to in art. 25-ter (Corporate offences), 25-sexies (Market abuse) and 25-novies (Induction to refrain from making statements or to make false statements to the judicial authorities), providing at least one of the following conditions is fulfilled: a) the company has gained profit of a relevant amount and the crime has been committed by top management subjects or by subjects under the management of others when, in this case, the crime has been determined or facilitated by serious organisational deficiencies; b) in the case of the repetition of an illicit fact. The judge determines the duration of the bar taking into account the suitability of the single sanctions to prevent offences of the type committed and, if necessary, applying them jointly (art. 14, paragraph 1 and clause 3, Lgs. Decree 231/2001). In the more serious cases, debarment from business practice, from contact with the Public Administration and from advertising goods or services can be permanent. Furthermore, instead of debarment, the company s business may be continued by a commissioner appointed by the judge pursuant to and under the conditions of art. 15 of Lgs. Decree 231/ Attempted crime In the case of the attempt 6 to commit the crimes indicated in Chapter I of Lgs. Decree 2321/2001 (arts. from 24 to 25-novies), fines and debarment are reduced by one third to one half, and no sanction is imposed if the company voluntarily prevents the action of the execution of the event (art. 26 of Lgs. Decree 231/2001). Non-application of sanctions is justified, in such a case, pursuant to the interruption of every relationship between the company and the subjects who intended to act in its name and on its behalf. 1.6 Events which modify the corporate entity Lgs. Decree 231/2001 disciplines the entity s property liability also in the case of events which modify the entity such as transformation, merger, spin-off and sale of the company. 6 According to art. 56, paragraph 1, of the criminal code, The person who carries out suitable actions directed unequivocally in pursuit of committing a crime... if the action is not completed or if the event does not take place must answer for attempted crime. 6

7 According to art. 27, paragraph 1, of Lgs. Decree 231/2001, the entity pays the fine with its capital or common funds: capital in the case of companies and entities with legal status, and common funds in the case of associations without legal status. Articles from 28 to 33 of the Decree discipline the incidence on the entity s liability of modifying events linked to company transformation, merger, spin-off and sale operations. In the case of transformation, art. 28 of Lgs. Decree 231/2001 contemplates that the entity shall remain liability for the offences committed prior to the date on which the transformation took effect. Pursuant to art. 29, the entity resulting from the merger (also by incorporation) answers for the offences for which the legal subjects which have merged were liable. The entity resulting from the merger, in fact, assumes all rights and obligations of the companies merged (art bis, paragraph one, of the civil code) and, taking over the companies activities, also incorporates those within the sphere of which the offences were committed for which the participants to the merger would have had to answer. Art. 30 of Lgs. Decree 231/2001 contemplates that, in the case of partial spin-off or unbundling, the separated company remains liable for the offences committed prior to the date on which the spin-off or unbundling took effect. The entities resulting from the unbundling (whether total or partial) are jointly obliged to pay the fines due by the unbundled entity for offences committed prior to the date on which the unbundling took effect, within the limit of the effective value of the shareholders equity transferred to the single entity. This limit is not applied to the beneficiary companies to which the branch of the business within the sphere of which the offence was committed has been transferred. Debarment relative to the crimes indicated prior to the date on which the spin-off took effect is imposed on the entities which have maintained the branch of the business within the sphere of which the offence was committed, or to which the said branch has been transferred, even only partially. Art. 31 of Lgs. Decree 231/2001 contemplates the same rulings for the determination of the sanctions in the case of merger or spin-off if such extraordinary operations took place before the conclusion of the legal proceedings. It is necessary to clarify, in particular, the principle on the basis of which the judge must calculate the fine, according to the criteria contemplated by art. 11, paragraph 2, of Lgs. Decree 231/2001, taking into consideration, in every individual case, the economic and financial conditions of the originally responsible entity, and not to those of the entity on which the sanction is imposed subsequent to merger or spin-off. In the case of debarment, the entity which is liable subsequent to merger or spin-off, may request the judge to convert the debarment into a fine, providing: (i) the organisational guilt which made it possible to commit the crime has been eliminated, and (ii) the entity has indemnified the damage and made available (for confiscation) any 7

8 profit that it may have gained. Art. 32 of Lgs. Decree 231/2001 allows the judge to take into account the sentence already imposed on the companies involved in the merger or spin-off in order to take into consideration, pursuant to art. 20 of Lgs. Decree 231/2001, the possible repetition of the offence on the part of the company resulting from the merger or beneficiary of the spin-off, in the case of crimes committed successively. In the case of the transfer or conferment of a company, the same discipline is applied (art. 33 of Lgs. 231/2001); the transferee, in the case of the transfer of the company within the sphere of whose business the crime has been committed, is jointly obliged to pay the fine imposed on the transferor, with the following limitations: (i) the prior benefit of discussion on the part of the transferor holds firm; (ii) the transferee s obligation is limited to the value of the company transferred and to the fines which result from the obligatory accounting records, or due for administrative infringements of which the transferee was, in any case, aware. Debarment, however, shall not be imposed on the transferee. 1.7 Offences committed abroad Pursuant to art. 4 of Lgs. Decree 231/2001, the company may be called upon to answer in relationship to crimes always contemplated by Lgs. Decree 231/2001 committed abroad. The company is responsible in the case of crimes committed abroad: (i) (ii) (iii) if the crime is committed abroad by a subject functionally linked to the company, pursuant to art. 5, paragraph 1, of Lgs. Decree 231/2001; if the company s head office is in Italy; in the cases and under the conditions contemplated by arts. 7, 8, 9 and 10 of the criminal code. The reference to arts. from 7 to 10 of the criminal code must be combined with the provisions of articles from 24 to 25-novies of Lgs. Decree 231/2001, although also in observation of the principle of legality expressed by art. 2 of Lgs. Decree 231/2001 in the case of the series of crimes mentioned in arts of the criminal code, the company may answer only for those for which its liability is contemplated by an ad hoc legislative provision; (iv) in the cases and conditions referred to in the aforesaid articles of the criminal code, if the State in which the fact was committed does not prosecute the company. 8

9 1.8 The Organisational, Management and Control Model Lgs. Decree 231/2001 attributes exempting value to the Organisational, Management and Control Model adopted by the company, if maintained suitable by the proceeding judicial authority. In the case of a crime committed by a member of the top management, in fact, the company is not liable if it proves that (art. 6, paragraph 1, of Lgs. Decree 231/2001): a) the Board of Directors had adopted and effectively implemented, before the fact, organisational and management models suitable to prevent offences of the kind which has been committed; c) the supervision over the functioning and observance of the models and the updating of the same has been entrusted to a company department endowed with autonomous powers of initiative and control; c) the offence has been committed by persons who have fraudulently eluded the organisational and management models; d) the controls of the Supervisory Board are adequate and have been carried out. The company must therefore demonstrate that it is extraneous to the facts with which the top management is charged, proving the existence of all the above-listed requisites and consequently that the crime was not due to an organisational fault on the part of the company itself. However, in the case of a crime committed by a person subjected to the direction and supervision of another, the company answers if the crime was made possible by breach of the direction and supervision obligations which the company is held to guarantee. In any case, breach of the obligations of direction or supervision is excluded if the company, before the offence is committed, has adopted and effectively implemented an Organisational, Management and Control Model suitable to prevent the offences of the type that has been committed. Art. 7, paragraph 4, of Lgs. Decree 231/2001 also defines the requisites of effective implementation of the organisational models, namely: periodic verification and, if necessary, modification of the Model if significant infringements of the prescriptions are discovered or in the case of changes in the organisation or in the activity; a disciplinary system which sanctions failure to respect the measures indicated in the model. Lgs. Decree 231/2001 outlines the content of the Organisational and Management Models, specifying, with regard to the extension of delegated powers and the crime risk, that they must: identify the activities within the sphere of which crimes can be committed; 9

10 include specific protocols aimed at programming the development and the implementation of the company s decisions regarding the crimes to be prevented; identify modalities for the management of the financial resources required in the prevention of the crimes; contemplate obligations of reporting to the body deputed to supervise functioning and observance of the models; introduce a disciplinary system which sanctions non-respect of the measures indicated in the Model. 1.9 Confindustria guidelines Art. 6, paragraph 3 of Lgs. Decree 231/2001 established that the Organisation and Management Models can be adopted, guaranteeing the needs indicated in clause 2, on the basis of the codes of conduct drawn up by the associations which represent the companies, communicated to the Ministry of Justice which, in concert with the competent Ministries, may, within thirty days, present observations on the suitability of the models to prevent the crimes. Confindustria has drawn up the Guidelines for the construction of the organisational, management and control models (hereinafter "Confindustria Guidelines") which include, among other things, methodological indications for identifying the at-risk areas (sectors/activities within the sphere of which the crimes can be committed), the planning of a control system (the so-called protocols for programming the development and implementation of the company s decisions) and the contents of the organisational, management and control models. The most recent version of the Guidelines was approved by the Ministry of Justice on March 31 st In particular, the said Guidelines contemplate the following phases for the drafting of the model: identification of risks and drafting of protocols; adoption of certain general instruments, including: the Code of Ethics of the specific company and relative to the crimes contemplated by Lgs. Decree 231/2001; ad hoc disciplinary system; identification of criteria for the choice of the Supervisory Board, indicating its requisites, duties and powers and reporting obligations. 10

11 1.10 Case law precedents For drawing up this Model, the most significant case law decisions on the question have been analysed and taken into consideration 7. The opinion of case law, together with the Guidelines of the category associations, represent an essential parameter to be followed in preparing a Model which can be considered effective and adequate to absolve its intended exempting function. A Model will be deemed suitable if it is concretely and specifically efficient, effective and dynamic. In the drafting of the Model, particular attention must be specifically paid to: off-book funds; accounting registration modalities; financial statement drafting modalities; invoicing and liquidity movements; modalities for the execution of tender contracts and relative controls; possible modalities for the execution of offences taking into account the internal and external context in which the company operates; the history of the company (previous events, including legal problems); segregation between subjects responsible for at-risk processes; powers of signature for granting authorising, coherent with organisational and managerial responsibilities; control over the operating system, in order to guarantee continual verification and effectiveness; monitoring system which ensures the detection of critical situations; 7 See ex plurimis decision of 11 th January 2010 Court of Trani separate section of Molfetta judge Hon. Gadaleta; decision of 17 th November 2009 Court of Milan; order of 20 th December 2004 Court of Milan Investigating Magistrate Hon. Secchi ; order of 18 th April 2005 Court of Bari Investigating Magistrate Hon. de Benedictis; order of 4 th April 2006 Court of Turin Investigating Magistrate Hon. Noce. 11

12 management of financial resources; disciplinary system specific to both concepts and sanctions. Case law has focused in particular on the modalities of the composition and functions of the Supervisory Board. The Board must in fact be able to perform its duties autonomously and independently. To this regard, it is worth underlining that members of the Supervisory Board may also be subjects internal to the Company, providing they do not have operating duties and providing the external member has predominance. Furthermore, a recent court order 8 has emphasised the need to contemplate specific sanctions in the case of the obligations or reporting to the Supervisory Board. Also as regards controls, case law has been clear 9. After mapping the risks found in the sensitive areas, special prevention protocols must be established in each case which discipline the at-risk activities as strictly and effectively as possible. The said protocols must be supported with adequate and specific sanctions to be imposed in the case of breach, to guarantee effective implementation of the entire system thus developed. In this way, the Model will not be merely an instrument representing a facade, with only formal value, but a concrete and above all dynamic instrument which can be constantly adapted to operating and organisational changes in the corporate entity. Furthermore, in companies where crimes have already been committed, the programmatic content of the Model, with regard to the areas in which the risk indicators are more evident, must perforce be calibrated and aimed at adopting the most stringent measures to prevent or ward off the possibility of a repetition of the specific offence that has already occurred. In fact, the procedures for taking and implementing decisions regarding the activities deemed most at-risk must be precisely determined: the adoption of a protocol with clear rules to obtain the desired result. This involved precise identification of the subjects responsible for taking the decisions and of the parameters to be followed in the choices to be taken, precise rules to be applied for documenting contacts, proposals, and every single development and implementation phase of the decisions taken. After the adoption of the Model, to ensure that it is suitable, the company must organise special training courses aimed at guaranteeing adequate knowledge, comprehension and 8 Order of the Court of Naples, 26 th June 2007, Investing Magistrate Hon. Rosanna Saraceno. 9 Order of the Court of Naples cit. 12

13 application of the Model on the part of employees and managers. Attendance of the said courses must also be compulsory Idem, cit. 13

14 2. The Birra Peroni S.r.l. Organisational Model 2.1 A brief history of Birra Peroni S.r.l. The company was founded in 1846 in Vigevano, during the Reign of the Savoys, when Francesco Peroni built his first brewery. A second brewery was later bought in Rome and one of the most important Italian industries was created. At the beginning of the XX century the company, under the management of the founder s sons, Giovanni and Cesare Peroni, expanded with the creation of two new breweries (in Bari and Naples) and with a greater sale of the products it reached the position of leader in Italy. In 1853 Franco Peroni placed his stakes on a fast recovery in Italy and built the most modern brewery of the time in Naples, later followed by three others: Bari (1963), Rome (1971) and Padua (1973). In the 1970s and 1980s, Birra Peroni expanded to foreign markets, with diversification of the products portfolio and collaboration with international companies, becoming one of the symbols of Italian Style. Nastro Azzurro conquered the markets in the United States, the United Kingdom and Australia. In the 1990s, thanks to important international agreements and targeted marketing campaigns, Birra Peroni consolidated its leadership both in the premium segment which includes the most appreciated beers and in the products destined for mass distribution. The Company s production capacity increased further with the opening, in Rome, of the largest brewery in Europe. In 2003 Birra Peroni confirmed its position as an international company when it entered the SABMiller Plc. Group, the second largest beer producer, present in 60 countries and 6 continents. In 2016, Birra Peroni has joined the Asahi Group Holdings Group. Asahi has 120 years of history is a Japanese international company, with a product portfolio that includes beers, spirits, soft drinks and food and is the market leader in Japan. Today, Birra Peroni is a company with about 800 employees working in the three breweries: Rome where the administrative head office is also located Padua and Bari, as well as the malthouse in Pomezia. The Peroni Group until June 2011 also included the distribution company Doreca srl with approximately 1100 employees. The annual production of beer in 2015 amounted to over 5 million hectolitres. The brands produced by Birra Peroni are: PERONI, the most popular and well known beer in Italy, NASTRO AZZURRO, the most popular beer abroad and other highly prestigious national and international brands such as TOURTEL, PERONI GRAN RISERVA DOPPIO MALTO, PERONI GRAN RISERVA ROSSA, PERONI GRAN RISERVA PURO MALTO, PERONI FORTE, PERONI SENZA GLUTINE, PERONI CHILL LEMON, RAFFO e WUHRER. 14

15 2.2 Methodology followed in the drafting of the Birra Peroni S.r.l. Organisational Model The activity carried out for the preparation of the Birra Peroni S.r.l. Organisational, Management and Control Model consists of the phases briefly described below: Phase 1. Constitution of a workgroup with the task of i) defining the guidelines for the performance of the activities involved, ii) involving and sensitising the managers of the various company departments, iii) checking on the progress of the activities pursued for the adoption of the Organisational Model, iv) approving the approaches and the decisions taken. This first phase also included the collection and analysis of the documentation present in the Company, and identification of the processes and activities within the sphere of which the crimes contemplated by Lgs. Decree 231/2001 could theoretically be committed. Phase 2. Identification and analysis of sensitive processes and activities and of the existing control mechanisms. Phase 3. The drafting of a work document containing the mapping of the so-called sensitive and instrumental activities. Sharing the relative results with the whole Workgroup. Examination and assessment of the control system. Phase 4. Definition of the Organisational Model pursuant to Lgs. Decree 231/2001 divided into all its components, including the appendices which are an inseparable part of the same. Further information on the individual phases Phase 1: Art. 6, paragraph 2, letter a) of Lgs. Decree 231/2001 indicates, among the requisites of the Model, the identification of the processes and activities within the sphere of which the crimes expressly contemplated by the decree could be committed. The purpose of Phase 1 was identification of the said company environments, concerned by the Model, and the preliminary identification of the processes and activities which theoretically could lend themselves to the possibility of committing the crimes contemplated by the Decree. Preparatory to the identification of the sensitive activities, the corporate and organisational structure was analysed, in order to acquire an overall view of the activity performed and the organisation of the company at the start of the Project and to identify company departments to be subjected to intervention. The collection of the relevant documentation and the analysis of the same from both a technical-organisational viewpoint and a legal viewpoint allowed for identifying the sensitive processes/activities and a preliminary identification of the subjects responsible for the same. 15

16 Phase 2: The purpose of Phase 2 was to identify the persons responsible for the sensitive processes/activities, i.e. the subjects with in-depth knowledge of the sensitive processes/activities. In particular, the managers of the company departments were interviewed with the aid of a special questionnaire. At the end of the second phase, a preliminary mapping of sensitive processes/activities was produced, towards which to direct the analysis activities. Phase 3: The purpose of Phase 3 was to analyse, for each sensitive process/activity identified in Phases 1 and 2, the departments and roles/responsibilities of the internal and external subjects involved and the already the existing controls, in order to identify the areas/sectors of activity, and the relative modalities, where the offences contemplated by Lgs. Decree 231/2001 could theoretically be committed. In this phase, a work document containing the mapping of the so-called at-risk activities was drawn up within the sphere of which, in consideration of their specific contents, the crimes contemplated by Lgs. Decree 231/2001 could be potentially committed. In the said document, the at-risk activities were divided into two categories: the sensitive activities involving direct risk of the crimes contemplated by the said Decree; the instrumental activities which present risks of crime only when, in combination with the directly sensitive activities, they lend themselves to the crime since they represent the execution modality. This second type includes the so-called funding activities which represent the channels by which hidden funds can theoretically be created for the purpose of corruption. In documenting the existing control system, among other things the following control principles were taken into account: the existence of formalised procedures; the ex post traceability and verifiability of transactions by means of adequate documental/it supports; the segregation of tasks; the existence of powers of attorney/deeds of delegation, consistent with organisational responsibilities assigned; 16

17 the existence of a process which allows for periodic/immediate updating of powers of attorney/delegations; monitoring carried out by third party subjects/departments/independent bodies. The various activities of Phase 3, on conclusion of which the at-risk activities were mapped and on which the Special Part of this Model was based, are listed below: a) the drafting of a questionnaire for the interviews; b) the execution of structured interviews with the managers of each company department in order to collect, for the sensitive processes/activities identified in the preceding phases, the information required in order to understand: b1) the elementary processes and activities carried out; b2) the departments and/or subjects, both internal and external, involved; b3) the relative roles and responsibilities; b4) the quantitative and qualitative factors of relevance in the process (e.g. frequency, value of the underlying transactions, the evidence of historic deviant behaviour, impact on company targets, etc.); b5) the existing system of controls; c) the drafting of the mapping of the sensitive processes/activities in which the following elements, referred to in the Special Part, were pointed out: c1) the company department concerned and the Process Owner and the Public Bodies involved; c2) the activities potentially exposed to risk; c3) the potential crimes associated to the said activities. To this regard, for mapping purposes, the single crimes were taken into consideration not only as committed but also as attempted (art. 26 of Lgs. Decree 231/2001); c4) the Public Administrations involved. On the basis of the mapping of the activities exposed to a crime risk, specific behaviour protocols were conceived. 17

18 Phase 4: The purpose of Phase 4 was to define the Company s Organisational, Management and Control Model pursuant to Lgs. Decree 231/2001 both the General Part and the Special Part in all its components according to the provisions of Lgs. Decree 231/2001 and the indications given in the Guidelines drawn up by Confindustria. 2.3 The Birra Peroni S.r.l. Organisational, Management and Control Model Although the adoption of this Organisational Model is facultative and not compulsory, Birra Peroni S.r.l. has decided to conform with the provisions of Lgs. Decree 231/2001, since it is aware that the initiative represents an opportunity of also reinforcing its own control system, and to simultaneously take advantage of the opportunity of sensitising its human resources on the aforesaid matters in order to prevent crime even more effectively. The Model, in fact, represents a coherent series of principles which: i) regulate the internal functioning of the Company and the modalities by which it relates to external subjects; ii) discipline the control system. The Model, as approved by the Company s Board of Directors, is composed of a general part and a special part. The General Part of the Model contains: a brief summary of the provisions of reference, the purposes and principles on which the Model is based (the addressees, the structure, the approval, the modification, the updating, etc.), the methodology used for drafting the same and a brief introduction to each element of which it is composed; the Code of Ethics; the disciplinary system; the composition and powers of the Supervisory Board. The Special Part is composed of: specific sections diversified according to type of sensitive activity. To this regard, the particular nature of activities the following activities have been treated separately, in two separate appendices: aspects regarding Health and Safety in the Workplace (App. 8) and Computer Crime and Illicit Data Processing (App. 9). 2.4 Approval of and amendments and additions to the Organisational Model The Organisational Model, in compliance with art. 6, paragraph 1, of letter a) of the Decree is a deed issued by the Board of Directors or equivalent. Therefore, on 4 th 18

19 November 2010, the Board of Directors of Birra Peroni S.r.l. approved the adoption of this Model. Supervision to ensure the adequacy and implementation of the Model, pursuant to Board of Directors resolution, is guaranteed by the Supervisory Board which periodically reports on the results of its work to the Board of Directors. Nevertheless, the Board of Directors remains directly responsible for implementation of the Company s Model. The Board of Directors, also assisted by the Supervisory Board, provides for the any later amendments and additions to the Model, in order to ensure that it constantly complies with the prescriptions of the Decree and to any changes in the Company structure. Regardless of the above-mentioned circumstances which would require immediate updating (such as, for example, a change in the internal organisation of the Company and/or the methods by which the Company performs its business, or legislative amendments, etc.), this Model will normally be reviewed annually. 2.5 Addressees of the Organisational Model This Model is applied to all those who in fact carry out the management, administration, direction and control of the Company, as well as all Company employees and managers and those without the power of representing the Company outside the same. However, external collaborators and consultants, including professionals, and anyone who works for the companies of the Group in any way, without power of representation in as much as external subjects, cannot be directly held to respect the rules of the Model, nor can they be subjected to a disciplinary sanction in the case of breach of such rules. Nevertheless, the Company shall deliver a copy of the Code of Ethics to all such subjects, and shall assess whether to include specific withdrawal and/or rescission clauses, as penalty, in the case of breach of the provisions of the Code of Ethics and of the principles on which this Model is based. 19

20 3. THE ELEMENTS OF WHICH THE MODEL IS COMPOSED 3.1 Mapping As already mentioned several times, art. 6, paragraph 2, letter a) of Lgs. Decree 231/2001 indicates, as essential elements of the Organisational, Management and Control Models contemplated in the Decree, among other things, the identification of the so-called at-risk activities, i.e. the company activities within the sphere of which the risk of one or more of the crimes expressly referred to by Lgs. Decree 231/2001 exists. The said mapping resulted in the extrapolation of the sensitive processes examined in the Special Part of the Model and in the above-mentioned appendices Activities carried out by top management As mentioned in the Introduction to this Model, pursuant to Lgs. Decree 231/2001, the company can bear liability for a crime which may be carried out by a top management subject or by a subject under the direction or supervision of a top management subject. Pursuant to Lgs. Decree 231/2001, in the case of a crime committed by a top management subject, the burden of proof is reversed: in such a case, the Company must demonstrate the fraudulent bypassing of the Model drawn up and effectively implemented. In the case of a crime committed by a top management subject, it is not sufficient to demonstrate that it was committed by such a subject, but it is also necessary to demonstrate that the Supervisory Board was not negligent or inefficient in supervising respect for the Model. Furthermore, the members of the Boards of Directors and Auditors are the natural executors of certain types of the crimes contemplated by Lgs. Decree 231/2001. In fact, certain crimes to which Lgs. Decree 231/2001 connects the Company s administrative liability can only be committed by subjects holding a specific qualification (e.g. falsehood in company reports can only be carried out by directors, managing directors, the accounting reporting manager, auditors, liquidators and those who, pursuant to art of the civil code, are also included in the category of top management subjects). Please see the Special Part of this Model for specific aspects of interests. By effect of the aforesaid legislative indications, the control activity delegated to the Supervisory Board must mainly regard the work of the top management and other subjects delegated with similar responsibilities. 3.2 Controls to protect the at-risk activities The system of controls, drawn up by the Company on the basis of the indications of the Confindustria Guidelines and international best practice, refers to the sensitive activities and the instrumental processes identified: general principles of control relative to at-risk activities; specific protocols for the single at-risk activities. 20

21 3.2.1 General controls - the internal audit system The system of controls implemented by the Company has been analysed and assessed, applying the audit principles defined below: - Regulations: company provisions which lay down principles of conduct, operating methods for the execution of the sensitive activities, and methods for filing the relevant documentation; - Traceability: i) every operation relative to a sensitive activity must be adequately documented whenever possible; ii) it must be possible to verify at any later moment the decision-making, authorisation and execution processes of the sensitive activity, also by means of opportune documental supports; - Segregation of tasks: the activities must be authorised, performed and checked by different subjects; - Powers and delegations: authorisation powers and powers of signature must be: i) consistent with the organisational and managerial responsibilities assigned, with indication, when requested, of the expenditure approval ceilings; ii) clearly defined and known by everyone in the Company. Furthermore, with regard to the internal audit system, the Birra Peroni S.r.l. Board of Directors lays down the guidelines of the said system, understood as a system composed of the rules, the procedures and the organisational structures which, by the adequate identification, measuring, management and monitoring of the main risks, allows for the Company to be managed i compliance with the prescriptions of law. The Board of Directors also evaluates and periodically assesses the adequacy, efficiency and effective functioning of the internal audit system. To this regard, the Company has adequate organisational and reporting system to guarantee the monitoring of the administrative system, the adequacy and reliability of the accounting, and the observance of the procedures on the part of the various company departments Specific controls For the at-risk activities, specific protocols and selected operating procedures have been identified to protect the same. Please see the relative appendices for details. 3.3 Management of financial flows To this regard, please see the Special Part of this Model. 3.4 The Supervisory Board Pursuant to the provisions of Lgs. Decree 231/2001 art. 6, paragraph 1, letters a) and b) the company may be exempted from liability consequent to a crime committed by a subject qualified pursuant to art. 5 of Lgs. Decree 231/2001, if the Board of Directors has, among other things: 21

22 adopted and effectively implemented organisational, management and control models suitable to prevent such crimes; entrusted the supervision over the functioning and observance of the models and the updating of the same to the Supervisory Board a structure endowed with autonomous powers of initiative and control. The assignment of the aforesaid duties to a structure with autonomous powers of initiative and control, together with the correct and effective execution of the same, therefore represent the indispensable conditions for the exemption contemplated by Lgs. Decree 231/2001. Although it is a structure within the company, it is in the position of an independent third party in respect of the company s other structures The requisites of the Supervisory Board The requisites that the Supervisory Board must satisfy for effective execution of the aforesaid duties are: 1. Autonomy and independence The Supervisory Board must have no operating duties and must have relations only with top management staff. First and foremost, the members of the Supervisory Board members must not be linked to the Company where they perform their duties of control, by relevant economic interests or by any situation which could generate a conflict of interests. 2. Professional skill in the execution of its institutional duties For this reason, the members of the Supervisory Board must have specific knowledge of the techniques by which the crimes can be committed, in order to be able to detect those already committed and to identify the causes, and to monitor respect for the Model on the part of all members of the Company. 3. Continuative action To guarantee the effective implementation of the Organisational Model, the Supervisory Board must be constantly present The powers and duties of the Supervisory Board The Supervisory Board is endowed with the powers of initiative and control necessary for ensuring effective and efficient supervision of the functioning and observance of the Model as established by art. 6 of Lgs. Decree 231/2001. For the performance of its duties, the Supervisory Board has the following duties and powers: 22

23 - to verify the efficiency and effectiveness of the Model also as regards correspondence between the operating modalities adopted in practice and the procedures formally contemplated by the Model; - to verify the maintenance over time of the requisites of efficiency and effectiveness of the Model; - to develop and promote the constant updating of the Model, formulating proposals for possible updating and adaptation by amendments and/or additions that may be necessary consequent to: i) significant breach of the prescriptions of the Model; ii) significant change in the internal organisation of the Company and/or the methods by which the Company s business is carried out; iii) legislative amendments; - to ensure the periodic updating of the system for the identification, mapping and classification of the sensitive activities; - to maintain constant contact with the auditing firm, maintaining its necessary independence, and with the other consultants and collaborations involved in the activities for the effective implementation of the Model; - to record any behavioural shortcomings that may emerge from analysis of the information flows and from the reports which the managers of the various departments must make; - to immediately report, in order to allow for the opportune measures to be taken, any ascertained breach of the Model which could lead to liability bearing on the Company; - to provide for the reports and ensure the information flows of its competence towards the Board of Directors; - to discipline its own functioning also by the adoption of regulations governing its own activities, which contemplate: the programming of activities, determination of the frequency of controls, identification of analysis criteria and procedures, reporting on the meetings, disciplining the information flows from Company departments; - to promote and define initiatives to spread knowledge and understanding of the Model, and initiatives for personnel training and sensitisation as regards observance of the principles contained in the Model; - to promote and prepare communication and training actions on the contents of Lgs. Decree 231/2001, on the impact of the legislation on the Company s business and on the behavioural rules; - to give clarifications on the meaning and application of the provisions contained in the Model; 23

24 - to provide an effective system of internal communication to allow for the transmission of news relevant as regards Lgs. Decree 231/2001, guaranteeing the reporting subject protection and confidentiality; - to draw up the budget for the correct execution of the duties assigned, it remaining understood that the budget must always be adequate to guarantee full and correct performance of its duties; - to have free access to any Company document and unit without the need for prior consent to request and obtain, from all employees and managerial staff, information, documentation and data deemed necessary for the performance of the duties contemplated by Lgs. Decree 231/2001; - to request external collaborators and consultants for any relevant information; - to promote the activation of disciplinary procedures when opportune; - to verify and assess the suitability of the system of sanctions pursuant to and by effect of Lgs. Decree 231/ in the case of controls, inquiries or requests for information on the part of the competent authorities aimed at verifying the correspondence of the Model to the provisions of Lgs. Decree 231/2001, to cooperate with the subjects appointed to carry out such activities, giving them adequate informative support. For the functioning of the Supervisory Board at Birra Peroni S.r.l., please see the Statute (appendix n. 3) Information flows to and from the Supervisory Board At regular intervals (at least once every six months) the Supervisory Board shall draw up a written report on the activity carried out and forward it to the Board of Directors. Any reports of presumed breach of this Organisational Model must be reported to the Supervisory Board For this purposes, specific "dedicated information channels are described below, in order to facilitate the flow of reports and information towards the Supervisory Board; All employees and all those who cooperation in the pursuit of the Company s aims must immediately inform the Supervisory Board of any breach of the Model and of any other aspect that may be potentially relevant for the implementation of Lgs. Decree 231/2001. More specifically, the Supervisory Board must be informed immediately of: 24