| | | | | | |
Principle | | Best Practice | | Comply With? | | Explanation |
4.4 Internal Audit | | 4.4.1 – The company must have an internal audit area reporting directly to the Board of Directors. | | Yes | | The company has an internal audit area that reports both to the Board of Directors and to the Executive Board, depending on the matter at hand. |
4.4 Internal Audit | | 4.4.2 – Where internal audit is outsourced, the services in question must not be rendered by the same firm that renders financial statements audit services. The company must not hire as internal auditors those who have rendered independent audit services to it three years or less in the past. | | Does not apply | | |
4.5 Risk Management, Internal Control, Compliance | | 4.5.1 – The company must embrace a risk-management policy to be approved by the Board of Directors and to include the definition of the risks against which it seeks to protect, the instruments used to this end, the organizational risk-management framework, an assessment of the adequacy of the operational framework and internal controls to verify their effectiveness, and definitions of guidelines for the establishment of acceptable levels of exposure to these risks. | | Yes | | The company has: (i) internal audit, risk management, and internal controls areas that assist the businesses in maintaining high levels of control, provide support during crises and in risk management, and analyze and correct any process failures, contributing to an integrated view of the Company’s risks. These areas are associated with the Risk, Compliance and Audit Division (“Diretoria de Riscos, Compliance e Auditoria”—DRCA), which is supported by the Audit and Conduct committees according to their purviews, reporting to the main Corporate Governance bodies of the Company, including the Board of Directors; and (ii) A duly structured Ethics and Compliance Program whose terms and operational structure are disclosed as part of the Corporate Anti-Corruption and Relationship with Public Authorities Policy, in addition to maintaining a Conduct Committee, an advisory body to the Board of Directors whose duties include “monitoring, with support from Ultra’s Risk, Compliance and Audit Division, the scope of and compliance with Ultra’s Ethics Code and Corporate Policies”. Furthermore, the Risk, Compliance and Audit Division’s jurisdiction to annually review the effectiveness of the relevant policies and to audit the compliance program is provided for, respectively, in Ultra’s Corporate Risks Management Policy and the Code of Ethics. |
4.5 Risk Management, Internal Control, Compliance | | 4.5.2 – The Board of Directors must make sure that the Executive Board has the mechanisms and internal controls to know, evaluate and control risks so as to keep them at levels compatible with the limits set, including a compliance program to ensure compliance with internal and external laws, regulations and standards. | | Yes | | The company has: (i) internal audit, risk management, and internal controls areas that assist the businesses in maintaining high levels of control, provide support during crises and in risk management, and analyze and correct any process failures, contributing to an integrated view of the Company’s risks. These areas are associated with the Risk, Compliance and Audit Division (“Diretoria de Riscos, Compliance e Auditoria”—DRCA), which is supported by the Audit and Conduct committees according to their purviews, reporting directly to the Executive President, as well as to the Board of Directors; and (ii) A duly structured Ethics and Compliance Program whose terms and operational structure are disclosed as part of the Corporate Anti-Corruption and Relationship with Public Authorities Policy, in addition to maintaining a Conduct Committee, an advisory body to the Board of Directors whose duties include “monitoring, with support from Ultra’s Risk, Compliance and Audit Division, the scope of and compliance with Ultra’s Ethics Code and Corporate Policies”. Furthermore, the Risk, Compliance and Audit Division’s jurisdiction to annually review the effectiveness of the relevant policies and to audit the compliance program is provided for, respectively, in Ultra’s Corporate Risks Management Policy and the Code of Ethics. |
4.5 Risk Management, Internal Control, Compliance | | 4.5.3 – The Executive Board must evaluate, annually at least, the effectiveness of the risk-management and internal controls policies and systems, as well as of the compliance program, and report to the Board of Directors on the resulting evaluation. | | Yes | | The company has: (i) internal audit, risk management, and internal controls areas that assist the businesses in maintaining high levels of control, provide support during crises and in risk management, and analyze and correct any process failures, contributing to an integrated view of the Company’s risks. These areas are associated with the Risk, Compliance and Audit Division (“Diretoria de Riscos, Compliance e Auditoria”—DRCA), which is supported by the Audit and Conduct committees according to their purviews, reporting directly to the Executive President, as well as to the Board of Directors; and (ii) A duly structured Ethics and Compliance Program whose terms and operational structure are disclosed as part of the Corporate Anti-Corruption and Relationship with Public Authorities Policy, in addition to maintaining a Conduct Committee, an advisory body to the Board of Directors whose duties include “monitoring, with support from Ultra’s Risk, Compliance and Audit Division, the scope of and compliance with Ultra’s Ethics Code and Corporate Policies”. Furthermore, the Risk, Compliance and Audit Division’s jurisdiction to annually review the effectiveness of the relevant policies and to audit the compliance program is provided for, respectively, in Ultra’s Corporate Risks Management Policy and the Code of Ethics. |