2.2.2

The Company’s principal risks

Risk profile

The principal risks that may impede the achievement of X5’s objectives with respect to strategy, operations, compliance and reporting matters are described below. It should be noted that there are additional risks that management believes are immaterial or otherwise common to most companies, or that we are currently not aware of. This Annual Report presents the updated Risk Profile; risks mentioned in the 2016 Annual Report are re-grouped, descriptions and activities are updated, and risk-appetite is indicated per identified risk.

Strategy

Group risk	Risk appetite	Influenced indicator	Mitigation
Market and customer value proposition (CVP)
If the client value proposition of X5's retail formats fails to meet customer needs and preferences, this can lead to a slowdown in expansion, slower revenue growth and lower profit. The risk can be caused by: Failure to promptly respond to changes in customer preferences, behaviour patterns and lifestyle Failure to promptly respond to new business models, services and technologies used in the retail and related markets Failure to take local consumption and regional economic potential into account in the CVP Investment in inefficient or unproven retail formats and lines of business	Minimalist to Cautious	Net Sales, Gross Profit	Constantly monitor retail and related markets in Russia and internationally Revise the CVP on an annual basis and have it reviewed and approved by the Supervisory Board Strictly adhere to the approved CVP and oversee compliance with it, analyse operating performance indicators and NPS on the parent company level Explore, test and implement new retail technologies and emerging retail market segments Also see section Our brands and Our strategy in action, as well as the section on each retail format
Economic and market conditions
Major changes in the economic environment may challenge the existing business strategy, have a material impact on financial performance and lead to a competitive disadvantage. Such changes include: A sharp drop in consumer demand (structural changes and shrinking consumer demand in money and absolute terms), depending on real income, consumer confidence and the unemployment level Social and demographic developments Excessively low or high consumer inflation Unexpected decline in fiscal revenues, muted business activity, slowdown in manufacturing, and, consequently, lower personal income, shrinking markets for commercial and non-commercial goods and services Political events with a potentially negative impact on markets, resulting in lower supply, shortage of goods and higher purchase prices	Cautious to Open	Gross Profit	Rely on a multi-format model that enables the Company to respond to changes in customer demand and meet the needs of customers with various lifestyles and income levels (all groups of customers in Russia) Monitor the economic environment, manage the product mix and pricing policy and identify geographies for further expansion based on local customer demand Develop direct imports, partner with direct suppliers and develop private labels to drive expansion of the product mix and bring purchase prices down Work to ensure the robust growth of retail formats in regions that demonstrate the strongest potential Also see section Economic and consumer trends
Growth and expansion
The Company is committed to opening new stores and providing logistics capacities while also ensuring the efficiency of new openings and refurbishment of existing stores. These business goals are the pillars of the Company’s strategy. The Company’s growth and development are associated with the following risks: Lack of cost-efficient locations for new openings may result in slower growth Higher costs of opening and refurbishment projects can erode margins and net profit Lack of logistics capacities to accommodate expansion of the retail format could bring about higher logistics costs and, consequently, lower margins Suboptimal geographical plan for expansion and overly optimistic expectations for project economics in certain locations Inefficient synergies from M&A deals to acquire local players	Cautious to Open	Selling Space, Number of Stores, Net Sales	Analyse the economy in Russia's regions, optimise the expansion strategy at the Company and retail format level Have a valuation methodology in place for stores of each format, ensure that investment and post-investment valuation is carried out Maintain and leverage M&A competencies Project the Company’s future need for logistics capacities and open new distribution centres to accommodate the target growth rate for each format Drive expansion based on a decentralised model, improve store opening and refurbishment processes Optimise the performance of stores with negative margins Also see section Geography of operations, as well as the section on each retail format

Efficiency

Group risk	Risk appetite	Influenced indicator	Mitigation
Retail operations
The operational efficiency of the logistics network, stores and back office units determines the operating performance of existing and new stores and the Company’s margins in general. Operating activities are subject to the following risks: Operational disruptions and drawbacks in implementing the CVP Lower efficiency of the logistics network and higher logistics costs Lower efficiency of inventory management at the DCs and stores (reduced availability of goods, increase in inventories and write-offs)	Minimalist to Cautious	Gross Profit, Operation Cost	Ensure an optimal level of decentralisation for operational business processes Manage the product mix across the retail formats in line with the CVP on an ongoing basis, and develop strategic partnerships Develop the logistics strategy, manage supply chains within the existing logistics network Improve and automate processes involving the back office, DCs and stores Monitor the operating performance of stores and DCs based on management accounts Monitor the operations of national and regional competitors on an ongoing basis and ensure a prompt response Also see section Retail operations infrastructure, as well as the section on each retail format
Human resources
The Company's strategic goals are heavily dependent on the competencies and performance of its officers and employees. Risks related to HR management include: High turnover rates Shortage of qualified professionals and employees at the operational level level Strong competition Underqualified staff Inadequate or lack of succession planning	Cautious to Open	Operation Cost	Monitor the labour market and provide employee benefits in line with the market Have a system for employee onboarding, training, and development in place, along with a talent pool Plan the recruitment process, use various employee search and recruitment instruments, rely on outstaffing and outsourcing practices Develop the Company’s corporate culture Monitor the level of reliance on selected employees, develop their job descriptions and redistribute their duties Automate operations Also see section People review
IT performance, continuity
The Company's operating model and scale of business depends on the capabilities and reliability of its IT systems. Changes in the operating processes of retail companies require agile adjustments of the IT infrastructure. The inability to meet business-driven IT requirements can limit expansion and decrease profitability. IT management is subject to the following risks: Failure to match IT capabilities, scalability and reliability in relation to business requirements Disruptions of business continuity due to IT issues	Minimalist to Cautious	Revenue Operation Cost	Engage the best external experts and develop partnerships and in-house expertise in key IT solutions used at X5 Use effective outsourcing practices, introduce an SLA and monitor compliance Ensure corporate governance of IT architecture and the integration of IT systems Ensure sufficient reliability of centralised IT infrastructure Implement policies and procedures to ensure cybersecurity Also see section Information technologies
Cybersecurity
The Company understands the rising trend of external threats to information security, including cyberattacks, viruses and other malicious actions to, for instance, infiltrate our IT systems or damage data.	Minimalist to Cautious	Revenue Operation Cost	Implement policies and procedures to ensure cybersecurity The Information Security Unit was established to monitor issues related to cyber-risks Use of special hardware and software for protection against malicious software, spam, external and internal cyberattacks, data leaks Use of information systems to detect atypical behaviour in the corporate network. Also see section Information technologies
Real estate, rent and maintenance
Maintaining the existing chain of stores is a major objective of our operations. Keeping the stores and facilities in a proper state of repair is part of the CVP and contributes directly to a better customer experience and revenue generation. Optimal service costs also affect the Company's margins. In pursuing these objectives, the following risks can arise: Unplanned increases in lease rates Termination of lease agreements by the lessor Poor technical maintenance of stores and equipment Higher utility rates Higher vacancy rates and a resulting decrease in revenues from subleased areas	Minimalist to Cautious	Operation Cost	Have store refurbishment projects collectively approved on the Company level Sign long-term lease agreements, specify rules for their termination, and manage rental rates Manage relations with lessors and sub-lessees Standardise and monitor the utility and technical maintenance of stores and automate store monitoring processes Optimise selling space and subleased areas, ensure timely refurbishments
Financial risks
Financial risks are driven by external factors. They can have an adverse impact on X5’s liabilities and margins. The most common financial risks include: Significant volatility of foreign exchange rates Increases in interest rates and/or banking fees Liquidity risk Credit risk	Averse to Minimalist	See Financial Statements	Plan and monitor the budget and its performance, introduce changes needed to achieve financial targets Monitor repayment schedules for long-term and short-term accounts receivable, oversee the use of short-term lending via available credit lines to manage liquidity Manage the effective financing rate Raise financing in Russian roubles, avoid FX-denominated agreements in operating activities, include a currency clause in agreements Implement the KYB (“know your bank”) criteria for partner banks, providing banking or cash-related products, in order to minimise risks related to partner banks Ensure continuity of funding on the best available market terms, with a diverse credit portfolio in Russian roubles Arrange funding ahead of requirements and maintain sufficient undrawn credit limits in banks Maintain a strong credit rating so that maturing debt may be refinanced as it falls due Also see section Financial risk management

Compliance

Group risk	Risk appetite	Influenced indicator	Mitigation
Reputation and social responsibility
As X5’s success depends to a significant extent upon brand recognition, the brand names Pyaterochka, Perekrestok, Karusel and X5 and their associated reputations are key long-term assets of X5’s business. As a market leader, X5 is fully aware of its social responsibility and is committed to managing social aspects involved in its operations, thus building a foundation for sustainable development. In terms of reputation and social responsibility, the following risks can arise: Unethical conduct, unscrupulous practices by X5 management and employees in their relations with customers, counterparties, government authorities, non-profit associations, investors and other stakeholders A mismatch between the Company’s social responsibility standards and the expectations of communities, market players and stakeholders based on X5’s role, scale of business and growth potential Abuse by third parties using X5’s trademarks and brands Misleading information about X5 in social and mass media that may damage the reputation of the Company and its retail formats Leakage of critical (sensitive) information onto the Internet or to competitors	Averse to Minimalist	N/A	Use X5’s Code of Business Conduct and Ethics; X5’s Policy on Countering Misconduct, Including Fraud and Corruption; X5’s Charity Policy Raise awareness, train employees and develop the corporate culture to make sure unethical behaviour is seen as unacceptable and that there is zero tolerance for any fraudulent activities Use the X5 Retail Group Code of Interaction with Business Partners, review complaints filed by counterparties and engage the Conciliation Commission to look into any incidents that take place Take disciplinary action in cases of unethical behaviour Record, arrange and process reports received from the Company’s employees via the hotline Use the Customer Service Standards and the hotline for customers, and work with reports and complaints Engage in external and in-house social and charity projects In emergencies, use dedicated channels of communication and rely on the Crisis Response Team to mitigate financial and non-financial damage to X5 Ensure accessibility for special-needs customers and employees Also see section Community investment review
Environment
X5 is committed to preserving and protecting the environment and making sustainable use of natural resources. Unsustainable use of natural resources Environmental pollution	Averse to Minimalist	N/A	Monitor the vehicle fleet, purchase vehicles that meet improved emission standards and optimise transportation by car Sell the Company’s used equipment and reuse it in refurbishment and other projects Collect waste and send it for recycling, and expand the list of waste suitable for recycling Implement energy-efficient technologies and equipment Make wider use of paperless document flows Monitor contractors in their work for X5 Also see section Environmental review
Humаn rights
While most human rights laws concern relationships between the state and individuals, it is widely acknowledged that non-state organisations can affect individuals' human rights, and they thus have a responsibility to respect them. In its operations, X5 addresses the following human rights violations: Discrimination against employees, customers and representatives of the Company's partners on the grounds of age, gender, sexual orientation, social status, nationality or ethnicity, cultural or political beliefs, etc. X5’s involvement in human rights violations by third parties Unethical behaviour on the part of employees in violation of human rights (forced or unpaid labour, harassment or workplace bullying, offensive language, humiliation of human dignity) Restriction of freedom of assembly and association Inequality in terms of employees’ rights and opportunities	Averse to Minimalist	N/A	X5’s Declaration on Human Rights (available on the Company’s website) Use the Code of Business Conduct and Ethics, provide training to employees and develop the corporate culture Use the Internal Labour Rules and the Compensation and Benefits Policy and communicate them to employees Receiving and processing complaints from the Company’s employees via the hotline and taking disciplinary actions in case of violations of labour or other legislation, internal Company policies and procedures, revising the Company's business processes to reduce the number of complaints Improvement of the Company's business processes to eliminate the root causes of complaints received through the hotline are monitored by the Audit Committee Use the Customer Service Standards and the hotline for customers, and work with reports and complaints Ensure accessibility for special-needs customers and employees Also see section People review
Health and safety
The health and safety of our employees and customers is a top priority for the Company. Injuries or fatalities may have a negative impact on the trust and loyalty of our customers and X5’s business reputation. The Company addresses the following risks: Accidents causing injuries, including fatal injuries, to employees or individuals at X5 facilities and in adjacent areas Injuries to employees due to an unsafe and uncomfortable working environment Failure to provide first aid on a timely basis as required	Averse to Minimalist	N/A	Provide a safe and comfortable working environment (premises, equipment, uniform) at the Company’s offices, DCs and stores, and carry out workplace assessments Ensure compliance with employees’ working hours and holiday schedule (work and rest schedule) Provide employees with life and health insurance programmes and seasonal vaccinations Arrange regular medical examinations for employees and health screening assessments to confirm that they are fit to work Also see section Occupational health and safety
Product safety and quality
Product safety and quality are important criteria for our customers and part of the Company’s CVP. Products of poor quality and with little shelf life remaining after delivery by suppliers can lead to lower revenue and a decrease in operational efficiency. This risk may be triggered by: Selling products that fail to meet safety standards and representations about quality Violations of operational process rules that may lead to spoilage and contamination Accepting from suppliers products that fail to meet safety standards and representations about quality	Averse to Minimalist	N/A	Audit suppliers, carry out laboratory tests of product samples before adding the products to the product mix or expanding the product mix. Remove unscrupulous suppliers from the product mix Ensure inspection of incoming products at DCs and stores (for products coming from both suppliers and DCs) Comply with approved rules for product transportation, storage and sale Comply with sanitation and personal-hygiene rules Provide training for employees to ensure quality, including quality assurance Have products with flaws in production withdrawn or discontinued Handle complaints and requests from customers Also see section Product safety and production quality
Legislation and litigation
X5’s activities are governed by a wide range of laws and regulations. By complying with these, the Company maintains its reputation and manages operating expenses. Unfavourable legislative developments may affect X5’s strategy and margins. Contractual terms that are unfavourable for X5, failure of counterparties to fulfil their obligations and court action against X5 due to contract violations may have a negative impact on the Company’s performance and reputation. Risks related to legislation and protection of X5’s interests can include: Non-compliance with applicable laws, including failure to change or adjust the Company’s activities on a timely basis in line with new developments Unfavourable changes in retail laws (e.g. market share limitation, sales restrictions introduced for certain types of products) and obsolete requirements Unfavourable changes in legislation that result in higher operating expenses for the Company Risk of legal action against X5 initiated by regulators and counterparties Counterparties taking advantage of laws and contractual provisions that fail to properly protect X5’s interests Issues related to violations of data protection compliance (see Cybersecurity risk).	Averse to Minimalist	N/A	Interaction with government agencies as prescribed by applicable laws, participation in public organisations, representation of interests Monitoring of draft laws, timely initiation of internal projects to alter and adjust X5’s activities to legislative developments Implementation of X5’s Compliance Policy: assessment of compliance risks, rollout and improvement of compliance procedures to integrate them into the Company’s processes, consistent efforts to identify violations and non-compliance with laws, and disciplinary action Personnel training to ensure compliance with laws Legal support, audit of contracts, development and use of contract templates
Fraud and corruption
Like any other industry, the retail sector is exposed to risks of fraud and corruption. The scale of X5’s activities and the diversity of its business lines and operations can result in fraud risks and corruption. These risks include: Theft, fraud, acts of corruption and abuse on the part of X5 employees Hidden conflicts of interest Fraud, commercial bribery and theft by third parties (customers, counterparties)	Averse to Minimalist	Operation Cost	Use the Code of Business Conduct and Ethics and X5’s Policy on Countering Misconduct, Including Fraud and Corruption Promote among employers zero tolerance of abuse, and provide personnel training Implement automated and manual controls in business processes, and separate the rights to access information systems (SoD) Ensure security of the Company’s assets and inventories Conduct background checks on counterparties and employees Identify abuses, fraud and theft by independent units (Inspection and Audit Division, Risk and Monitoring Department, Security Department), carry out internal checks, take disciplinary action, initiate administrative or criminal proceedings against employees, counterparties or customers Record, arrange and process reports received from the Company’s employees via the hotline, from counterparties in the Conciliation Commission and from the Security Department Required declaration of a conflict of interest for all employees
Taxation
Compliance with taxation regulations is often complex, open to differing interpretations and depends on the Company’s risk appetite. Tax risks may be related to: Unfavourable changes in tax calculation rules, introduction of new taxes and fees Federal and regional authorities interpreting tax laws in a way that is adverse for X5 Developments in case law involving tax disputes Attempts to challenge previous transactions and amounts of associated tax payments	Averse to Minimalist	See Financial Statements	Monitoring of taxation-related legislative initiatives and case law, changes to business processes Tax planning with preliminary reviews and advisory sessions Tax risk assessment before executing transactions and signing contracts Tax budgeting, provisioning for tax risks Tax control during transactions

Reporting

Group risk	Risk appetite	Influenced indicator	Mitigation
Reliability of financial reports
The reliability and completeness of financial reports is an integral element when it comes to ensuring the trust of shareholders and other stakeholders. Management accounts and financial statements are directly linked to the timeliness and quality of the decisions taken by X5’s management. The preparation, distribution and use of accounts and statements are exposed to the following risks: Non-compliance with statutory requirements on financial reporting Misrepresentation of management accounts and financial statements Ambiguity of management accounts and financial statements Disclosure level not in line with shareholder, lender and market expectations	Averse to Minimalist	N/A	Monitoring of legislative initiatives and case law regarding financial statements, changes in reporting methodologies Audit by external auditors Management of the methodology used in preparing management accounts Internal controls for the preparation of financial statements Internal audit to assess the effectiveness of the internal controls used for the preparation of financial statements

Group risk

Risk appetite

Influenced indicator

Mitigation

Reliability of financial reports

The reliability and completeness of financial reports is an integral element when it comes to ensuring the trust of shareholders and other stakeholders. Management accounts and financial statements are directly linked to the timeliness and quality of the decisions taken by X5’s management. The preparation, distribution and use of accounts and statements are exposed to the following risks:

Non-compliance with statutory requirements on financial reporting
Misrepresentation of management accounts and financial statements
Ambiguity of management accounts and financial statements
Disclosure level not in line with shareholder, lender and market expectations

Averse to Minimalist

N/A

Monitoring of legislative initiatives and case law regarding financial statements, changes in reporting methodologies
Audit by external auditors
Management of the methodology used in preparing management accounts
Internal controls for the preparation of financial statements
Internal audit to assess the effectiveness of the internal controls used for the preparation of financial statements

Expected risk tendency

For the designated risk groups, X5 analysed the actual risk impact in 2017 and made predictions about the expected future impact, taking external conditions and trends into account.

Statement of the Management Board

The Management Board reviewed and analysed the strategic, operational, compliance and reporting risks to which the Company was exposed, as well as the effectiveness of the Company’s internal risk management and control systems over the course of 2017. The outcome of this review and analysis has been shared with the Audit Committee and the Supervisory Board and has been discussed with X5’s external auditors.

The Management Board reviewed the effectiveness of X5’s internal risk management and control systems, based on:

internal audit reports on reviews performed throughout the year; observations and measures to address issues were discussed with management and the Audit Committee;
a systematic review of scoping, control execution and control assessments in the context of the internal control strategy for 2017-2020;
periodic risk reports reported by the management of corporate functions and the three main business segments (retail formats):
ongoing monitoring of key risk-management initiatives aimed at mitigating risks and keeping risks at an acceptable level;
the external auditor's ongoing reflections on the control framework on the control framework, and the management letter from the external auditor with observations and remarks regarding internal controls. This letter has been discussed with the Audit Committee and Supervisory Board.

For more information on X5’s risk management activities, internal control, risk management systems and key risks, see the section How we manage risk. The purpose of X5’s internal risk management and control systems is to adequately and effectively manage the significant risks to which the Company is exposed. Such systems can never provide absolute assurance as to the realisation of operational and strategic business objectives, nor can they prevent all misstatements, inaccuracies, errors, fraud and non-compliance with legislation, rules and regulations. These systems do not provide certainty that the Company will achieve its objectives.

Based on the annual evaluation and discussion of X5’s internal control and risk management systems and identified risk factors, the Management Board confirms that, according to the current state of affairs and to the best of its knowledge:

X5's internal risk management and control systems provide reasonable assurance that the Company’s financial reporting does not contain any material inaccuracies;
there have been no material failings in the effectiveness of X5's internal risk management and control systems;
there are no material risks or uncertainties that could reasonably be expected to have a material adverse effect on the continuity of X5’s operations in the coming 12 months;
it is appropriate that the financial reporting b prepared on a going concern basis.

In view of all of the above, the Management Board confirms that, to the best of its knowledge, the financial statements give a true and fair view of the assets, liabilities, financial position and profit or loss of the Company and its consolidated subsidiaries, and the management report includes a fair review of the position on the balance sheet date and of the development and performance of the business during the financial year together with a description of the principal risks and uncertainties that the Company faces.

The Management Board

28 March 2018

2.2.2 The Company’s principal risks