Pozavarovalnica Sava

Audit Report / Information • Aug 1, 2016

Internal Audit Service

Translation of the ANNUAL REPORT OF THE INTERNAL AUDIT SERVICE ON INTERNAL AUDITING FOR 2015

Business secret

Distribution list:

• - Management board, Pozavarovalnica Sava d.d.
• - Supervisory board members, Pozavarovalnica Sava d.d.
• - Audit committee members, Pozavarovalnica Sava d.d.

Ljubljana, 24 March 2016

1. INTRODUCTION

This annual report on internal auditing for 2015 has been prepared by the Internal Audit Service (SIA) in accordance with Article 165 of the Slovenian Insurance Act (ZZavar-1, hereinafter "Insurance Act"), the internal audit policy of Sava Reinsurance Company, and International Standards for the Professional Practice of Internal Auditing.

This report includes:

• an assessment of the effectiveness and efficiency of the system of internal controls, risk management and corporate governance of Sava Reinsurance Company,
• a review of implementation of the 2015 annual plan and departures from the work plan,
• summary of major findings established in internal audit engagements,
• overview of monitoring the realisation of recommendations,
• overview of other activities of the IAS (personnel, training and education),
• summary of the quality assurance and improvement programme.

The IAS is an autonomous organisational part, functionally and organisationally separate from other parts of Sava Reinsurance Company and reports directly to the management board. Its position in the Company ensures autonomy and independence of operation.

2. ASSESSMENT OF THE EFFECTIVENESS AND EFFICIENCY OF THE SYSTEM OF INTERNAL CONTROLS, RISK MANAGEMENT AND CORPORATE GOVERNANCE OF SAVA REINSURANCE COMPANY

The assessment of the effectiveness and efficiency of control procedures, risk management and corporate governance is given for the period from 1 January 2015 to 31 December 2015 on the basis of audit engagements performed in Sava Reinsurance Company and other group members.

Based on all tests and methods used in individual areas of auditing, it is the opinion of the IAS that at Sava Reinsurance Company internal controls are largely adequate and that the degree of their reliability is satisfactory. The IAS is also of the opinion that management of the Sava Reinsurance Company is appropriately in order to achieve important business objectives and the Company successfully manages risk, striving for efficient and economical operations. In the performance of audit engagements, individual irregularities and weaknesses have been identified to which the IAS drew attention, and relating to which it made recommendations to remedy aimed at improving control procedures, corporate governance and risk management. The above is to result in greater efficiency of internal controls and regularity of operations. Some irregularities and weaknesses have been eliminated within the deadlines. The recommendations that have been made in the last quarter, and recommendations relating to the improvement of information technology need a longer period of time to realize.

Regular audit engagements have also been targeted to establishing the probability of fraud, and exposure and vulnerability to IT risks. In the fields subject to audit engagements, internal control systems have been set up and are operating so as to prevent fraud. As part of audit reviews, recommendations were given to improve the information system, which is currently being implemented.

3. REVIEW OF IMPLEMENTATION OF THE 2015 ANNUAL PLAN AND DEPARTURES FROM THE WORK PLAN

In 2015, the IAS carried out audit reviews and other activities in accordance with the 2015 IA work plan. There were 9 audit engagements planned; of these, 7.7 have been completed. This year we planned our audits in such a way that one audit engagement covers a specific process in several Sava Re Group companies. As a result, several reports were issued as part of a single audit engagement. Throughout the year, Sava Re conducted 2 audits, for which interim reports were prepared. We also completed 3 audit reviews from the previous year.

We carried out the following internal audits at Sava Reinsurance Company:

• - solvency II harmonisation project,
• - Navision implementation project
• - project of amending the Reinsurance Contract application.

In the Group, the following internal audit operations were carried out:

• - solvency II harmonisation project (4 companies),
• - Navision implementation project (10 companies),
• - process of business continuity management system (9 companies),
• - process of information security management (9 companies),
• - process of corporate governance (8 companies out of 11),
• - claims settlement process (1 company),
• - recourse claims process and collection of recourse receivables (7 companies).

At Sava Reinsurance Company, we have started the audit of the reinsurance process, which we will also cover testing of REvolve IT system supporting the process. The reinsurance process is just in the process of implementing new software – Revolve, which was being tested and implemented in the production environment during the audit. The process of reinsurance and Revolve are related primarily through the process of technical accounting so processes were being changed during the audit and certain recommendations have been realized during the preparation of the report. We concluded that it was meaningful to wait for outwards reinsurance accounts to be fully implemented and then review the process in its entirety. This is the reason why the audit has not been completed.

An audit of corporate governance was planned to be carried out in all Group companies. Due to changed circumstances in the course of the audit, it was caried out in 8 companies of 11. We believe that the implementation of audits of corporate governance in the subsidiaries Zavarovalnica Maribor and Zavarovalnica Tilia is not meaningful because of the EU project.

The planned audit of the SII project at Sava Reinsurance Company took up more time, so the audit of corporate governance at Sava Reinsurance Company has been postponed to 2016.

The IAS conducted informal consulting at Sava Reinsurance Company in 2015 with the aim of improving both the control environment and risk management. In 2015 there were 27 auditor days spent for informal consulting.

The IAS was primarily involved in the following informal consulting:

• participation in risk management and in setting up a risk register,
• cooperation with compliance and the corporate legal department,
• cooperation in the SII project,
• participation in project groups and committees,
• reviews and making proposals for strategic documents, policies and rules,
• participation in the meetings of internal auditors within the SIA.

4. SUMMARY OF MAJOR FINDINGS ESTABLISHED IN INTERNAL AUDIT ENGAGEMENTS

Following is a brief summary of the audit engagements performed, the effectiveness and efficiency of the internal control systems and corporate governance in particular transactions, including major findings and irregularities that have been discovered in transactions.

A detailed overview of engagements with all the findings, irregularities and recommendations is reported by the IAS in quarterly reports for the management board, the audit committee and the supervisory board.

4.1 Sava Reinsurance Company

2-2015 Audit of monitoring the Solvency II harmonization project

The aim of the internal audit engagement was monitoring the activities necessary for compliance with requirements of the SII Directive, including verification of the action plan and amendments thereto (the correctness of approval, documentation of changes, critical activities, key deadlines, sources for power and assignments) and realization of the action plan (monitoring of realization and reporting).

On the basis of the audit engagement of the SII harmonization project in 2015, we estimate that the project management (mode of organization, management, planning, monitoring and reporting on the progress of the project implementation) was good.¹

¹ Pursuant to standards 2410.A1, 2120, the IAS assesses the governance of the organization as follows:

The IAS assessed that over the last quarter, the project activities had extremely intensified. The board of Sava Reinsurance Company was duly informed and has been closely involved in the process of approving policies for specific areas. On 1 January 2016, EU insurers formally joined the SII regime. Given the fact that the Insurance Act was adopted with a delay and implementing regulations had only just been drafted or had not been drafted at all because of limited human resources, the company was forced to make only the most urgent adjustments. The IAS also checked SII harmonization in EU subsidiaries and assessed that harmonization in EU subsidiaries was done in an appropriate manner. The IAS alerted the management board that in the terms of the new legislative framework, some of the company's functions were less efficient and recommended that the management board provide as soon as possible suitable solutions for efficient and effective operations.

3-2015 Audit of overseeing the Navision implementation project

The objective of the internal audit engagement was to oversee the business activities related to the alignment to the Solvency II Directive by means of checking the action plan, including any changes thereto (the correctness of approval, documentation of changes, critical activities, key deadlines, sources for power and assignments) and realization of the action plan (monitoring of realization and reporting).

Navision software support was implemented in an appropriate manner, on time and within the estimated costs and we do not see any significant deviations, which should be noted. With the implementation of Navision, we unified the manner (in content and technically) of transferring data from other systems used by the company to use the same data transfer method in all companies. We estimated that the project management (organization, management, planning, monitoring and reporting on the progress of project implementation

VERY GOOD: Effective corporate governance (ethics and values are promoted, effective organizational performance management and accountability; risk and control information is communicated to the management and supervisory bodies). Supervision is optimal. The risk is very low. There are no findings assessed as medium or high risk.

GOOD: Corporate governance is generally good; minor weaknesses may be addressed by the head of any business function / organisational unit in the course of the business process. The management is in good control of management; authorizations and powers are observed in practice. In case of departures, immediate action follows and processes are improved continuously. Monitoring is carried out regularly. The risk is low. 1–2 findings assessed as medium risk, there are no findings assess as high risk. Minor deficiencies in the governance of the organization.

ADEQUATE: Combination of weaknesses in the governance system requires immediate corrective action by head of business function / organisational unit. Management is aware of required monitoring and supervision; procedures and responsibilities are roughly defined. Supervision is occasional Risk is medium. Most findings are medium risk. Governance of the organization (employees of the audited unit/process are not familiar with the code of ethics, accountability is not clearly defined, management and supervisory bodies lack information).

INADEQUATE: The corporate governance is seriously flawed with irregularities, non-compliance with the law, untimely reporting to management. The organization has not identified the risks it is exposed to / does not manage risks.

UNSATISFACTORY: High degree of major weaknesses (non-compliance, complete lack of controls), requiring complete reorganisation of business function / organisational unit. Supervision is not conducted. Risks are very high. Serious deficiencies in the governance of the organization, risk management is not carried out or risks are not managed, the organization's goals are not reached.

With regard to the professional and ethical standards required of the certified internal auditor, part of the assessment of the internal control system remains the discretion of the certified internal auditor, despite the given scale.

Navision) had been very well in all cases and we recommend it a best practice to other companies in the Sava Re Group.

4-2015 Audit of overseeing amending of the REvolve project

The objective of the internal audit engagement was to oversee the business activities by means of checking the action plan, including any changes thereto (the correctness of approval, documentation of changes, critical activities, key deadlines, sources for power and assignments), realization of the action plan (monitoring of realization and reporting) and ongoing reviewing of appropriateness of claims for amending the Reinsurance Contract application.

Revolve is a key application for reinsurance operations. Its main functionalities that have already been put into production and ensure data accuracy and completeness are working, however we have noticed weaknesses in the user interface architecture (in our opinion, the application is less functional than expected from the user's point of view). The IAS estimated that the project management (organization, management, planning, monitoring and reporting on the progress of the Navision project implementation) was good and found that the basic objective of the activity had been achieved. Project management has been preparing appropriate, timely and quality reports, submitting them to the management board of Sava Re for information. The ISA estimated that the project was very complex, because it was a development project designed specifically for the company with changes in business processes made along the way.

4.2 Subsidiary companies

11-2014 Audit of the claims handling process (post-audit)

The objective of the internal audit was to review the existence and effectiveness of the internal control system and risk management in claims handling. The internal audit included an examination of the internal rules and the examination of the claims handling process. Based on our audit, we assessed that the internal control system was good. The company has realized most of the recommendations. We recommended that the development of software linking the claims handling application and the regulator's application for mandatory motor insurance be completed as soon as possible and that ongoing training of claims assessors for the use of the claims application be organised.

12-2014 Audit of financial management and cost management (post-audit)

The objective of the internal audit was to review the existence and effectiveness of the internal control system and risk management in the financial management and the adequacy of cost management. Based on our audit, we assessed that the internal control system was good. The company has realized most of the recommendations. We recommended that because of the requirement that the executive director be present in the company when the company was effecting payments, the articles of association be amended and the rules

regarding signing be harmonized with internal controls. In addition, we recommended that the company starts using the loss claims module as soon as possible. In this audit review, we participated in the examination of compliance with regulatory requirements and recommended internal auditor to monitor compliance of the company with legal requirements as part of the monitoring of recommendations.

5-2015 Audit of the Business Continuity Management System Process and

6-2015 Audit of the information security process²

The objectives of the internal audit of the information security management systems and business continuity were: assessment of the company's readiness for extraordinary events that may result in its temporary or permanent suspension of operations,examination and assessment of the compliance of the framework and other information security policies with the law of the countries of individual Group members, assessment of the consistency of existing computer system instructions and processes with the framework information security policy and individual policies of existing companies,and assessment of the compliance of implemented controls with existing computer system instructions and the requirements of the security policy.

The ISA examined the business continuity management and information security in nine companies. Based on the audits carried out, the IAS assessed the effectiveness and efficiency of the internal control system for management of business continuity and information security process in eight subsidiaries as adequate and in one company as good. The ISA assessed that it would be meaningful to harmonize business continuity management and information management for all companies (same rules) and proposed to the management board that activities are implemented at the same time in all companies.

We found that business continuity management was in implementation (in one case) and that companies do not have complete systems for business continuity. We proposed that the companies set up business continuity systems as soon as possible that they provide an analysis of business impacts, adopt an appropriate business continuity plan and implement it in the company in a sustainable way.

We found that companies have not in place a comprehensive information security system. We proposed that the companies put in place information security systems, that they prepare all relevant documentation to update the existing policies in place, that they introduce a system of regular reviewing of controls to ensure the security of information and to report regularly to the management.

²Since the contents of the two audits: of the business continuity management system process and information security process are interdependent, we have combined the findings of these audits into one report.

7-2015 Audit of the corporate governance process

The objective of the internal audit engagement was to verify the compliance of company's operations with the adopted policies, standards and procedures. As part of the internal audit of corporate governance, with a focus on reviewing compliance of the company with adopted policies, standards and procedures, we verified the implementation of policies and strategies in subsidiaries. As regards the four fundamental pillars representing corporate governance: management board, supervisory board, internal and external audit, we reviewed the approval system for resolutions, internal documents, their recording and reporting to the parent, the system of monitoring the realisation of resolutions, regulatory reporting and information-flow within the company.

Based on the audits carried out, the IAS assessed the effectiveness of corporate governance regarding business continuity and information security in five subsidiaries as adequate and in two companies as very good. The companies rated "very good" use good practices, implement their policies adopted in the company, there is a high degree of awareness of the significance of the matters, responses are very prompt, guidelines of the parent company are complied with and the company is successfully adapting to the changes in the market and in the group. Internal rules are set up that are followed in practice, there is regular control and review of compliance with internal rules. Reporting and informing is well organized.

Other companies have been recommended to adopt missing policies, to enhance record keeping, to ensure regular reviewing of monthly reports by the relevant bodies, to monitor the implementation of recommendations of bodies, to ensure that extension of recommendations of are duly authorized and audit reports examined in the presence of internal auditors.

8 – 2015 Audit of the claims handling process

The objective of the internal audit was to review the existence and effectiveness of the internal control system and risk management in claims handling. The internal audit included an examination of the internal rules and the examination of the claims handling process. Based on our audit, we assessed that the internal control system was good. The company mostly observes adopted instructions and rules and carries out claims handling procedures in an appropriate and transparent way. We recommended the supplementing and harmonization of adopted instructions, amendment of the claims adjustment process by improving the documentation process and introduction of a more rapid systemic approach to claims handling and creation of electronic files.

9-2015 Audit of the recourse claims process and collection of recourse receivables

The objective of the internal audit engagement has been examining and assessing the functioning of internal controls and their effectiveness and efficiency in the process of recording recourses and their collection. As part of the audit, we examined the organization and segregation of responsibilities in the process of collecting recourse receivables, the relevance and adequacy of internal controls. We examined whether the recourse claims procedure complied with applicable regulations and internal rules, their recording and collection of recourse receivables, timeliness and correctness of the recording of recoveries and the adequacy of IT support.

The companies in which we carried out the audit use different IT support for recourse claims. Based on the audit of the recourse process and collection of recourse receivables, we estimated that the internal control system was adequate (five companies) and good in one company. Companies have in place different rules, so we recommend that these be unified on the group level. In the integration process, the rules of companies should be examined and combined into one that is the most optimal for the job.

Since individual process phases were insufficiently defined, we proposed these be amended so that rules are clear. We found that in some companies, the recording method of recourse receivables is inadequate and not up to date. We proposed that all companies verify the correctness of their records, ensure proper recording of recourse receivables, examine if data is not recorded correctly, introduce controls for periodic verification of recording and monitor the handling of recourse claims on an ongoing basis. In one company, we discovered that data was captured by the ASP application in an inadequate way, so we suggested that the company – soonest possible – ensures the correctness of data management in ASP to ensure accurate and complete data transfer to the Navision general ledger. We also proposed that the ASP software be upgraded.

5. IMPLEMENTATION OF RECOMMENDATIONS FOR ELIMINATION OF WEAKNESSES AND IRREGULARITIES

The IAS is required to report periodically on the implementation of recommendations made and proposals given based on irregularities and weaknesses identified. At 31 December 2014 there were 30 recommendations outstanding; from 1 January 2015 to 31December 2015 we made 73 recommendations; at 31 December 2015 there have been 45 recommendations implemented. Of these, at 31 December 2015 there were 58 recommendations outstanding; of these 12 recommendations were partially implemented, 46 recommendations were not yet past due. The share of implemented recommendations was 79 % for the Group.

The percentage of realized recommendations (79 %) at 31 December 2015 was on the same level as at 31 December 2014. The bulk of outstanding recommendations relate to audits that were completed in the last quarter. Larger progress in implementing recommendations was made by subsidiaries relating to the recommendations given in previous periods. The director of IAS assesses the implementation of the recommendations as active.

6. OTHER ACTIVITIES

The director of the IAS I regularly participated in meetings of the management board, supervisory board and audit committee, and monitored the operations of Sava Reinsurance Company and the group, and managed the IAS.

In accordance with the ISA methodological bases and criteria, the IAS prepared a medium term work plan for 2015–2017, the annual work plan for 2015, a report of the IAS for 2014 and four quarterly reports on internal auditing. All reports have been prepared in compliance with statutory regulations and internal rules of the IAS.

We have prepared the framework for the annual work plan for 2016 on the basis of our risk assessment. We have conducted annual interviews with the management board of Sava Re regarding key risks and obtained their opinion on the satisfaction with the work of the IAS.

In the observed period, the IAS coordinated work on the preparation of contracts for external auditors, and participated during the preliminary audit and the final audit in the coordination of work and meetings between the external auditor and Sava Re.

In 2015 prepared amendments to internal audit documents in line with the SII Directive, drew up the internal audit policy of Sava Reinsurance Company and the Sava Re Group.

We had several monthly meetings with the Slovenian part of the group mainly on (i) upgrading the methodology of internal auditing on the basis of an external assessment and (ii) understanding of the role of internal auditor in the SII regime.

As director of IAS, I participated in the spring and autumn strategic conferences of the Sava Re Group and briefed my colleagues on novelties in internal auditing.

As part of cooperation with the IAS of subsidiaries, we performed peer reviews in Sava osiguruvanje and Sava Montenegro. The IAS provided professional assistance to auditors of subsidiaries primarily to transfer the methodology in written or telephone communications, but mostly during the conduct of audits in subsidiaries.

Personnel, training

In 2015 the IAS was staffed by 3 persons: the director (professional designation: certified internal audit) and one internal auditor – senior auditor, both full-time, one internal auditor – senior auditor with split employment (1 hour Sava Re, 7 hours Zavarovalnica Maribor – professional designation: certified internal auditor).

As from 1 January 2015, the department employs an IT auditor, meaning an improvement of the IAS in terms of expertise and skills.

The director of the IAS estimates that the number and structure of IAS staff generally allows for proper fulfilment of the planned activities, assuming that the service is not faced with

prolonged unplanned absences and/or the need for implementation of major unplanned tasks.

IAS staff attended training events planned in the annual plan for 2015. We also attended internal Serbian and English language courses. The IAS contributes to activities of the Slovenian Insurance Association, Internal Audit Section.

Expenses were planned at € 153,224. We spent € 148,069. Realized expenses of the IAS were € 5,155 lower than planned (higher travel expenses for carrying out audits but significantly lower expenses for external contractors and one workshop for group internal auditors had not been realized).

7. IAS QUALITY ASSURANCE AND IMPROVEMENT PROGRAMME

In accordance with the requirements of the Standards, the IAS conducted a quality assessment of the IAS. The assessment was carried out on the basis of a programme for quality assurance and improvement, covering all aspects of the IAS in every respect and continually monitoring its effectiveness. The programme results are reported to the management board and the audit committee.

External quality assessment was last carried out in 2014. It showed that the operation of the IAS was consistent with the Standards.

Pursuant to the Standards, the IAS conducted a self-assessment for 2015. The results showed that the operations of the IAS complied with the definition of internal auditing, the standards and the code of ethics. However, in individual substandards where operations were not fully compliant, the IAS prepared an action plan for improvement and follows it in its day-to-day dealings (especially relating documentation of engagements and compliance with audit due dates).

For the purpose of obtaining feedback on their satisfaction with the work of the internal audit, the IAS sent a questionnaire on the satisfaction with the work of the IAS to all stakeholders (SB, AC, MB, auditees). Assessors generally expressed satisfaction with the work of the internal audit and made some suggestions for improvement.

In line with internal audit guidelines, we amended the programme with a declaration on the compliance with the Standards, the code of ethics and declaration on disclosure and avoidance of conflicts of interest for the 2016, which are enclosed.

As director of IAS, I believe that the operations of the IAS in 2015 had been consistent with the Standards.

The IAS planned the measuring of performance of the internal audit in the annual work plan.

The IAS monitors the realization of the recommendations proposed by the IAS to the management board. In 2015, all the recommendations were adopted by resolutions. IAS also monitors the implementation of the recommendations, which amounted to 79 % in 2015.

The IAS aims at enhancing internal audit procedures through IT solutions. We have prepared IT supported reports intended for post-audit reporting and analyzed product offers in the market. In 2016, we will be testing – free of charge – applications for internal auditing so that a contractor can be selected next year.

As director of IAS, I believe that the annual plan was carried out effectively and efficiently.

Director of IAS Danijela Pavlič

OPINION OF THE SUPERVISORY BOARD TO THE ANNUAL REPORT OF THE INTERNAL AUDIT SERVICE ON INTERNAL AUDITING IN 2015

In 2015, the Internal Audit Service of Sava Reinsurance Company ("IAS") carried out audits in the areas set out in its annual work plan, which had been adopted by the management board of Sava Reinsurance Company in its meeting on 26 January 2015 and was granted consent by the supervisory board in its meeting on 5 March 2015.

The audit goals pursued by the IAS were geared towards verifying whether risk management procedures were adequate and efficient and whether internal controls and governance processes in the most important operating segments were effective and efficient. The IAS assessed the adequacy of internal controls for the prevention of fraud and potential threats to information technology supporting operations.

There were 7.7 internal audit reviews carried out in subsidiaries and in Sava Reinsurance Company in 2015 and some processes were audited in several companies. Based on these engagements, the IAS issued 73 recommendations. The supervisory board is of the opinion that the IAS operated in line with the guidelines of both the supervisory board and the management board, thereby contributing significantly to risk management and the functioning of Sava Reinsurance Company.

Based on all tests and methods used in individual areas of auditing, the IAS is of the opinion that at Sava Reinsurance Company internal controls are largely adequate and that the degree of their reliability is satisfactory. The IAS is also of the opinion that management of the Sava Reinsurance Company is appropriate in order to achieve important business objectives and the Company successfully manages risk, striving for efficient and economical operations. During the performance of audit engagements, individual irregularities and weaknesses were identified to which the IAS drew attention, and relating to which it made recommendations for remedying them to improve control procedures, corporate governance and risk management. Identified weaknesses and deviations were addressed and relevant control procedures were put in place within the specified time frames.

Supervisory board members monitored the effectiveness and efficiency of the IAS through quarterly reports and the annual report of the IAS. The supervisory board was submitted a summary of the self-assessment carried out by the IAS. The results of the internal assessment showed that the IAS's operation compiles in all material respects with the law and the International Standards for the Professional Practice of Internal Auditing.

Based on the above, the supervisory board hereby gives its positive opinion to the annual report of the IAS on internal auditing in 2015.

Ljubljana, 6 April 2016

Supervisory board of Sava Reinsurance Company Chairman Branko Tomažič