Organization,
Management and Control Model
pursuant to
Legislative Decree no. 231 /2001

Legislative Decree No. 231 of 8 June 2001 introduced a system of administrative liability for entities into the Italian legal system.

The issuance of the Legislative Decree is part of a domestic legislative context that implements international obligations.

The original text, which referred to a series of Crimes committed against the Public Administration, was supplemented by subsequent legislative provisions that expanded the list of the offenses that could result in administrative liability for the entity. Furthermore, Law 146/06 establishes the liability of the entity in the event of certain crimes (so-called transnational crimes) being committed.

Corporate liability – similar to criminal liability – arises when a person engaging in operational dealings with the corporate entity commits a Crime.

The entity may be held liable if the Crimes are committed in its interest or to its advantage, while it cannot be held liable if the perpetrator acted exclusively in his own interest or in the interest of third parties.

The operational relationship that bind the perpetrator of a Crime to the entity may consist of a representation, employment or a contracting relationship, within the limits established by the Legislative Decree.

A presumption of liability for the entity is established when the offender is a natural person who holds a function of representation, directorship, executive or supervisory function in the entity or one of its financially or operationally independent business units, or exercises, including on a de facto basis, the management and control of the entity. The rationale is that the natural person expresses, represents and implements the management policy of the organization.

Conversely, there is no presumption of liability on the part of the entity when the offender is someone subject to the direction or oversight of one of the officers mentioned above, as an illegal action by a subordinate gives rise to liability for the entity only if it is apparent that the offence was committed because of non-compliance with management and/or oversight obligations.

The (administrative) liability of the entity is additional to the (criminal) liability of the natural person and does not replace it. From the substantial independence of such liability there follows that the entity is called to answer for the Crime even when the offender has not been identified or is not chargeable, or if the Crime is extinguished for reasons other than amnesty. The criminal liability of the natural person remains governed by ordinary criminal law.

The Legislator has provided for a sanctioning system that involves the application of a sanction, usually a monetary one, to the entity.

In certain cases, restrictive sanctions may also be applied in addition to monetary sanctions. Restrictive sanctions may consist of a ban from carrying out business, suspension or revocation of authorizations, licenses, or concessions that were related to the perpetration of the offense, a ban on contracting with the Public Administration, exclusion from benefits, financing, contributions, or subsidies, possible revocation of those already granted, and a ban on advertising goods or services.

In addition to such penalties, the seizure of the price or proceeds of the Crime (or equivalent computation) may be ordered in the conviction ruling, which may, occasionally, be ordered to be published.

The law also provides that restrictive measures may be applied at the request of the public prosecutor, including as a precautionary measure, during the investigation stage of the proceedings, if there is serious evidence of the entity’s liability and there is specific, well-founded evidence of a risk that offences of the same nature could still be committed.

Furthermore, under specific conditions, when applying a restrictive penalty that would interrupt the operations of the entity, the Court may appoint an external commissioner to oversee the continuation of operations for a period equal to the duration of the restriction to be applied.

Foreign companies operating in Italy are also subject to the provisions of the Legislative Decree, regardless of whether or not similar regulations governing the same matter exist in their country of origin.

The Crimes that may give rise to administrative liability for the entity (so-called “predicate crimes”) are expressly set out in the Legislative Decree and in certain regulatory provisions that have broadened its scope:

• fraudulent appropriation of public funds, fraud to the detriment of the State, a public authority or the European Union to obtain public grants, computer fraud to the detriment of the State or a public authority and fraud in public supplies (Article 24 of Legislative Decree no. 231/2001);
• cybercrimes and data protection breaches (Article 24-bis of Legislative Decree 231/2001);
• organized crime (Article 24-ter of Legislative Decree 231/2001);
• embezzlement by public official, misappropriation of money or movable property, extortion by public official, illegal inducement to give or promise benefits, bribery (Article 25 of Legislative Decree 231/2001);
• counterfeiting of money, credit or debit cards, tax stamps and instruments or marks of identification (article 25-bis of Legislative Decree 231/2001);
• crimes against industry and commerce (Article 25-bis 1 of Legislative Decree 231/2001);
• corporate crimes (Article 25-ter of Legislative Decree 231/2001);
• crimes of terrorism and aimed at subverting the democratic order (Article 25-quater of Legislative Decree 231/2001);
• female genital mutilation (Article 25-quater of Legislative Decree 231/2001);
• crimes against the individual (Article 25 – quinquies of legislative Decree 231/2001);
• market abuse (Article 25-sexies of Legislative Decree 231/2001);
• manslaughter and serious or very serious bodily harm resulting from breaches of occupational health and safety regulations (Article 25-septies of Legislative Decree 231/2001);
• receipt of stolen goods, money-laundering, profit from proceeds of crime, self-laundering (Article 25- octies of Legislative Decree 231/2001);
• offences relating to non-cash payment instruments and fraudulent transfer of valuables (Article 25-1 of Legislative Decree 231/2001);
• crimes concerning breaches of copyright (Article 25 novies of Legislative Decree no. 231/2001);
• incitement to withhold evidence or to bear false testimony before the Judicial Authorities (Article 25-decies of Legislative Decree no. 231/2001);
• environmental crimes (Article 25-undecies of Legislative Decree 231/2001);
• employment of illegally-resident third-country nationals (Article 25-duodecies of Legislative Decree 231/2001);
• racism and xenophobia (Article 25-terdecies of Legislative Decree 231/2001);
• sports fraud and illegal gambling or betting and gambling through forbidden means (Article 25-quaterdecies of Legislative Decree 231/2001);
• tax crimes (Article 25-quinquiesdecies of Legislative Decree 231/2001);
• smuggling (Article 25-sexiesdecies of Legislative Decree 231/2001);
• crimes against cultural heritage (Article 25-septiesdecies of Legislative Decree no. 231/2001);
• laundering of cultural heritage assets and destruction and looting of heritage and landscape assets (Article 25-duodevicies of Legislative Decree 231/2001);

Furthermore, Law 146/2006, while not making any further changes to the text of the Legislative Decree, extended the liability of entities to include transnational crimes.

The description of criminally relevant individual conducts is referred to in Annex 1 – List of Crimes and Administrative Offences.

The Legislative Decree provides for a specific form of exemption from liability for the entity if:

1. before a Crime is committed, the board of directors adopted and effectively implemented appropriate 231 Models to prevent Crime;
2. an internal body with independent powers of initiative and oversight has been put in charge of supervising the operation, effectiveness and updating of, and compliance with, the models;
3. the offenders committed the crime in deliberate breach of the Organization, Management and Control Models;
4. the body referred to in letter b) above did not fail to apply sufficient oversight.

The Organizational Model encompasses the set of rules provided for in the Special Section and in the Protocols, which can have a behavioural nature (“Principles of Conduct“) or a control nature. Compliance with such rules, while performing activities connected to processes at risk of crime, allows for the prevention of illicit, incorrect, and irregular conduct.

Failure by the Recipients to comply with the Organizational Model, the Code of Ethics and/or the Whistleblowing Procedure may be subject to sanctions. To this end, the Organizational Model also includes a Disciplinary System, which is also provided for and illustrated in this document.

In preparing this document, Subaru Italia was guided by Confindustria’s Guidelines.

The choice not to adapt the Organizational Model to some of the indications set out in Confindustria’s Guidelines will not affect its validity in any way whatsoever. Indeed, Organizational, Management and Control Models are required to be drafted in line with the Company’s actual organization.

5.1 HISTORY AND ACTIVITIES OF SUBARU ITALIA

Founded in 1985, Subaru Italia is part of the Japanese Subaru Group, headed by the parent company Subaru Corporation based in Tokyo, one of the most important companies in the automotive sector, and is controlled by the sub-holding Subaru Europe NV/SA, based in Belgium.

The Italian company belongs to the automotive division and deals with the national and EU marketing, directly or through intermediaries, of new and second-hand vehicles, as well as the after-sales marketing of spare parts and accessories. The reference markets in which it operates are Italy, Croatia, Slovenia, Bulgaria, Greece, Romania, Austria and Slovakia.

In addition to its headquarters in Ala (TN), the Company has an administrative office in Milan and a local unit in Salzburg, Austria.

5.2 CODE OF ETHICS

Subaru Italia has a Code of Ethics in force (Annex 2) which defines the values that inspire the Company in carrying out its activities.

The Code of Ethics contains the ethical principles and rules of conduct that the Company’s Top Management, employees, all those who operate in the name or on behalf of the Company, as well as third parties, are required to respect and/or share.

In addition to the principles contained in the Code of Ethics, the Company complies with the behavioural and ethical principles set forth in the international standards under which the Company has obtained certifications, such as ISO 9001:2015 (Quality Management System) and UNI EN ISO 14001:2015 (Environmental Management System).

The provisions of the Organizational Model are inspired by the ethical principles and rules of conduct provided for the Code of Ethics and are integrated and compatible with it.

5.3 CORPORATE GOVERNANCE OF SUBARU ITALIA

The Company has a traditional organizational structure as follows: Chairman of the Board of Directors, Board of Directors, Shareholders, Board of Statutory Auditors, and Independent Auditors.

The Board of Directors, in compliance with the Articles of Association, has granted delegated authorities to the Chairman of the Board of Directors, the Chief Executive Officer, the Managing Director, and the Vice Chairman of the Board of Directors.

The Board of Directors plays a key role in the corporate governance system and is vested with the broadest powers for the ordinary and extraordinary management of the Company, resolving on significant strategic, economic, and financial transactions. It has the authority to perform all actions deemed appropriate for the implementation and achievement of the corporate purpose, excluding those that the law and the Articles of Association strictly reserve for the exclusive authority of the Shareholders or the Shareholders’ Meeting.

There is a board of auditors, consisting of three permanent members and two substitutes. The Board of Statutory Auditors monitors compliance with the law and the articles of association,  compliance with the principles of sound administration and, in particular, adequacy of the organizational, administrative and accounting structure adopted by the Company and its actual operation.

The financial statements of Subaru Italia are audited by independent auditors in accordance with applicable regulations and principles.

5.4 INTERNAL CONTROL SYSTEM

In building the Subaru Italia Model, the corporate governance tools that regulate its operation were taken into account.

They can be summarized as follows:

• Articles of Association – which, in accordance with current legislation, include various provisions on corporate governance designed to ensure a correct performance of business management;
• Code of Ethics – containing the rules of conduct and general principles that all internal and external co-workers, who directly or indirectly deal with Subaru Italia, must abide by and whose violation entails the application of the disciplinary measures provided for by the disciplinary system of this Model;
• Organizational system – consisting of organizational structures/offices and areas of responsibility, represented in the Company’s organizational chart, job descriptions and Authorization Chart;
• Procedural system – consisting of policies and procedures designed to regulate relevant processes and providing operating methods and control measures for carrying out company activities, including those adopted for the purpose of obtaining certifications, such as ISO 9001:2015 (Quality Management System) and UNI EN ISO 14001:2015 (Environmental Management System);

Other documents – i.e., corporate deeds and documents, for example contracts and agreements (contractual standards for after-sales assistance / distribution of original Subaru spare parts / sales concession or intercompany service and distribution agreements), suitable for regulating relevant organizational and management aspects relating to economic and commercial relationships between group companies and between Subaru Italia and the dealers/workshops.

The rules and principles contained in the documentation listed above, although not detailed in this Model, are a tool for preventing unlawful conduct in general, including that referred to in Legislative Decree 231/2001, which is part of the broader organizational, management, and control system of which the Model is part and which all recipients are required to respect, depending on the type of dealings they have with the Company.

5.5 PURPOSE AND STRUCTURE OF THE ORGANIZATIONAL MODEL

The adoption of an Organizational Model in line with the provisions of the Legislative Decree and in particular Articles 6 and 7 thereof, together with the Code of Ethics, was undertaken in the belief that this initiative could also represent a valid tool to raise awareness among Recipients, so that they adopt, in conducting their activities, correct and consistent behaviours, which may prevent the risk of Crimes.

More specifically, the Model aims to:

1. organize a structured and organic prevention and control system, aimed at the reduction of crime risk in relation to corporate activities and to the prevention/countering of illegal behaviour;
2. determine, in all those who operate in the name and on behalf of the Company in “risk areas of activity”, the awareness that by breaching the provisions hereof they might incur in a sanctionable offence, possibly of criminal relevance, which might lead to sanctions for the Company;
3. inform the Recipients that failure to comply with and/or a confirmed violation of the provisions contained in the Model, which they are required to comply with, will result in the application of specific sanctions and, in the most serious cases, termination of the contract;
4. stress that the Company will not tolerate illegal conduct of any type whatsoever, regardless of its purpose – even if the Company were apparently in a position to benefit from it – as they are contrary to the ethical principles with which the Company intends to comply in pursuing its corporate mission;
5. allow the Company to avoid liability and sanctions pursuant to Legislative Decree 231/2001, where the Model is suitable and effectively implemented (see more broadly Articles 5 and 6 of Legislative Decree 231/2001).

The Organizational Model prepared by the Company is aimed at defining a preventive control system, primarily designed to plan the formation and implementation of the Company’s decisions in relation to the risks/Crimes to be prevented and consists in particular of:

• the Code of Ethics, which identifies the primary values to which the Company intends to adhere and therefore establishes the general guidelines for its corporate activity;
• an updated, formalized and clear organizational system that guarantees an organic assignment of tasks and an adequate level of segregation of functions;
• Special Sections and Protocols aimed at regulating the performance of activities, particularly with regard to crime-risk processes, providing for appropriate control points, as well as the separation of duties between those who carry out decisive phases or activities within such processes;
• a clear assignment of delegated authorities and signing powers, in line with organizational and management responsibilities;
• control measures, relating, primarily, to the potential commission of predicate Crimes, and capable of providing timely notification that particularly critical general situations exist or may occur.

This Organizational Model addresses:

• Chairman, Chief Executive Officer, Managing Director, Vice Chairman of the Board of Directors and other members of the Board of Directors (Top Management).
• employees or other persons – regardless of their relationship with the Company – subject to the management or supervision of one of the above-mentioned directors and officers.

Compliance with the provisions set forth in the Legislative Decree, and with the behavioural principles indicated in the Code of Ethics, is also required of Third Parties through the provision – where possible – of specific contractual clauses.

Subaru Italia – within the framework of the existing preventive control system – has implemented the necessary activities to adapt this control system to the provisions of the Legislative Decree.

By adopting this Organizational Model, the Company has set itself the objective of equipping itself with a set of Principles of Conduct and operating methods designed to plan the formation and implementation of decisions relating to the Crimes to be prevented, in compliance with the system of attribution of functions and delegation of powers, as well as internal procedures.

The Special Section and the Protocols, intended as the rules to which the Recipients must adhere, are added to the entire organizational structure of Subaru Italia (Articles of Association, procedures, organizational charts and system of attribution of powers) and are integrated and compatible with it.

The Organizational Model was adopted by the Board of Directors of Subaru Italia.

Amendments of or additions to the Organizational Model must be approved by the board of directors.

For non-substantial changes, the board of directors appoints a delegate who can rely on the advice of the Supervisory Body. The board of directors will be informed of such changes and will ratify them. If necessary, they will be supplemented or modified at the first available meeting. The pending ratification does not deprive of their effectiveness the amendments adopted in the meantime.

7.1 IDENTIFICATION OF CRIME-RISK PROCESSES

Article 6, paragraph 2, letter a) of the Legislative Decree expressly provides that an entity’s Model must identify the business activities within which the crimes referred to in the Decree could potentially be committed.” Therefore, the Company analysed its corporate activities, its decision-making and implementation processes within individual company areas, as well as the internal control systems.

In particular, within the scope of the aforementioned activities, Subaru Italia, with the support of external consultants:

1. identified the corporate activities within which Crimes and administrative offences could theoretically be committed;
2. analysed the potential risks of illicit activities as well as the possible methods of committing them;
3. identified the persons and company functions involved;
4. defined and, where necessary, adapted the internal control system.

7.2 DETECTION AND IDENTIFICATION OF CRIME-RISK ACTIVITIES

Upon completion of the checks referred to in paragraph 7.1 above, the Company identified the corporate activities or relevant phases within which Crimes and/or administrative offences may theoretically be committed (hereinafter “Crime-risk Processes”).

In order to identify Crime-risk Processes, the Company – with the support of external consultants – has implemented the following activities:

1. examination of official company documentation;
2. detailed mapping of company operations on the basis of the Company’s organizational units, carried out through interviews and survey questionnaires;
3. detailed analysis of each individual activity, aimed at verifying the precise contents, the concrete operating methods, the distribution of responsibilities, as well as the existence or non-existence of each hypothesis of Crime.

Specifically, Crime-risk Processes within which Crimes may theoretically be committed are listed below:

• Purchasing and Supply Chain;
• Finance;
• Corporate and Legal Affairs;
• Sales and Aftersales;
• Management of judicial and extrajudicial disputes;
• Treasury, Accounting and Control;
• Logistics, Inventory and Warehouse;
• Marketing, communications, sponsorship, gift and donations;
• M&A transactions;
• Management of relationships with Public Bodies as well as European Public Authorities;
• Interactions with related company/subsidiaries/related party;
• Drafting of Financial Statement and related notes;
• Research and development (R&D);
• Human Resources;
• Environmental System;
• Health and Safety System;
• IT Systems.

The following categories of Crimes may theoretically occur in the Crime-risk Processes referred to above:

• crimes against the Public Administration (Articles 24 and 25);
• cybercrime and unlawful data processing (Article 24-bis);
• organized crime offences (Article 24-ter);
• embezzlement by public official, misappropriation of money or movable property, extortion by public official, illegal inducement to give or promise benefits, bribery (Article 25);
• counterfeiting of money, credit or debit cards, tax stamps and instruments or marks of identification (article 25-bis);
• crimes against industry and commerce (Article 25-bis 1);
• corporate crimes (Article 25-ter);
• crimes of terrorism and aimed at subverting the democratic order (Article 25-quater);
• Crimes against the individual (Article 25 – quinquies);
• manslaughter and serious or very serious bodily harm resulting from breaches of occupational health and safety regulations (Article 25-septies);
• handling of stolen properties, money laundering and investing the proceeds of crime (Article 25-octies);
• offences relating to non-cash payment instruments and fraudulent transfer of valuables (Article 25-1);
• crimes concerning breaches of copyright (Article 25 novies);
• incitement to withhold evidence or to bear false testimony before the Judicial Authorities (Article 25-decies);
• environmental crimes (Article 25-undecies);
• crimes consisting in the “employment of illegally-resident third-country nationals” (Article 25-duodecies);
• racism and xenophobia (Article 25-terdecies);
• tax crimes (Article 25-quinquiesdecies);
• smuggling (Article 25-sexiesdecies);
• transnational crimes (Law 146/2006).

Considering its corporate activity, the Company does not regard the following Crimes as applicable to its situation:

• female genital mutilation (Article 25-quater 1);
• market abuse (Article 25-sexies);
• sports fraud and illegal gambling or betting and gambling through forbidden means (Article 25-quaterdecies) introduced by Law 39/2019;
• crimes against cultural heritage (Article 25-septiesdecies);
• laundering of cultural heritage assets and destruction and looting of heritage and landscape assets (Article 25-duodevicies).

The Company is committed to the continuous monitoring of its activities both with regard to such Crimes and in relation to any amendments and supplements to the Legislative Decree.

7.3 DESIGN OF ORGANIZATIONAL AND PROCEDURAL CONTROLS

Pursuant to Article 6, paragraph 2, of the Decree, the Organizational Model must, among other things, “provide for specific protocols aimed at planning the formation and implementation of the entity’s decisions regarding the crimes to be prevented.”

The aforementioned provision highlights the need to establish – or improve, where  existing – specific mechanisms for proceduralizing management and decision-making, in order to document and verify the various phases of each business process.

It therefore seems clear that the set of organizational structures, activities, and operating rules that may be applied within the company — as directed by the management — must be geared toward this specific objective, to ensure, with reasonable certainty, that the objectives included in an adequate and efficient risk monitoring system can be achieved, while avoiding the sanctions provided for under the Legislative Decree.

The existing organizational structure is inspired by the following principles:

In aggiunta a quanto sopra, nella predisposizione dell’assetto organizzativo, la Società si è ispirata alle regole e ai principi contenuti nella documentazione adottata in conformità ai seguenti standard internazionali, che costituisce altresì presidio di prevenzione e controllo per idoneo a contenere la commissione dei Reati:

• ISO 9001:2015 (Sistema di Gestione della Qualità);
• UNI EN ISO 14001:2015 (Sistema di Gestione Ambientale).

Adequate training and ongoing/periodic information for staff on the principles and requirements of the Organizational Model are crucial for the proper and effective implementation of the company’s prevention system.

Recipients are required to acquire full knowledge of the objectives of correctness and transparency to be pursued through the Organizational Model and the methods the Company intends to use to achieve them, establishing an adequate system of procedures and controls.

8.1 THE INITIAL COMMUNICATION

The adoption of the Organizational Model with its annexes and the Whistleblowing Procedure is communicated to all Recipients at the time of adoption. Newly hired resources are provided with an information pack containing this “Organization, Management and Control Model pursuant to Legislative Decree 231/2001” with the related annexes and the Whistleblowing Procedure. Delivery of the above documentation must be confirmed by mechanisms—including electronic ones—that can prove its actual receipt. In compliance with current labour law regulations, the Model may be posted in a location accessible to all.

8.2 COMMUNICATION REGARDING ANY CHANGES TO THE ORGANIZATIONAL MODEL

Any changes to the Organizational Model must be communicated to the Recipients, with an explanation of such changes, using mechanisms – including IT – that can prove the effective and conscious receipt of the communication.

8.3 TRAINING

Training activities aimed at disseminating knowledge of the regulations outlined in the Legislative Decree are differentiated, in content and delivery methods, based on the qualifications of the recipients, the crime-risk level of the area in which they operate, and whether or not they hold Company representation roles.

In particular, training and information provided to the Company’s personnel will be more in-depth if the recipients operate in crime-risk areas of activity.

In addition to specific courses, training also includes the use of dissemination tools, such as, for example, occasional updating of emails or internal information papers.

After the board of directors has formally adopted the Organizational Model, a general introductory course will be held to illustrate the applicable regulatory framework, the principles underlying the Organizational Model, the disclosure requirements, and the rules of conduct to be followed in crime-risk areas.

The training program may be implemented in ways that allow, among other things, all Recipients to be updated on new developments and additions to the legislation and the Organizational Model.

For new hires working in crime-risk areas, specific training sessions will be provided, subject to prior agreement with their line manager.

Mandatory participation in training sessions will be formalized by requesting a signature, possibly electronically, to confirm attendance.

The unjustified failure to attend may be considered violation of the Organizational Model by the Company.

The Supervisory Body is responsible for ensuring that corporate functions implement initiatives to disseminate knowledge and understanding of the Organizational Model. Within the scope of its responsibilities, the Supervisory Body may provide for specific checks, including random checks or evaluation/self-assessment tests, which can verify the quality of the content of the training programs and the actual effectiveness of the training provided.

8.4 INFORMATION TO THIRD PARTIES

Subaru Italia promotes awareness and compliance with the Legislative Decree, the Code of Ethics, and the Whistleblowing Procedure, including among third parties. Therefore, the General Part of the Organizational Model, the Code of Ethics and the Whistleblowing Procedure are brought to the attention of Third Parties through publication on the Company’s website. Furthermore, contracts with Third Parties must include – where possible – specific contract clauses by which Third Parties undertakes to respect the principles of the Legislative Decree and the Code of Ethics.

In accordance with the provisions of Article 39, paragraph 1 of Legislative Decree 231/2001[1], if any proceedings are initiated against the Company under Legislative Decree 231/2001, the defines attorney must be appointed by a person with the necessary powers, after verification that there exist no conflicts of interest with the Company. The Company’s legal counsel may not be appointed by a person under investigation or a defendant in the mentioned proceedings.[2]

[1]“The entity is a party to the criminal proceedings through its legal representative, unless the latter is under investigation or charged with the crime on which the administrative offence depends”.

[2]In accordance with the dictates of recent case-law (i.e. Court of Cassation, decision no. 35387/2022 of 22 September 2022).

10.1 ROLE OF THE SUPERVISORY BODY

In implementation of the provisions of the Legislative Decree, the board of directors of Subaru Italia established a Supervisory and Control Body (OdV), which is in charge of monitoring the operation of and compliance with the Organizational Model, and proposing amendments of the Organizational Model to the Board of Directors and subsequently checking on their implementation. Therefore, the supervisory and control activities envisaged by the Organizational Model fall within the remit of the Supervisory Body of Subaru Italia.

The appointment of the Supervisory Body, as well as any revocation thereof (for just cause), are the responsibility of the board of directors. The Supervisory Body reports directly to the board of directors.

In accordance with Articles 6 and 7 of the Decree and the indications contained in the Report accompanying the Legislative Decree, the characteristics of the Supervisory Body must be:

1. Autonomy and independence

The requirements of autonomy and independence guarantee that the tasks and functions assigned to the Supervisory Body are actually complied with. These requirements must be assessed by taking into account the Company’s structure and organizational characteristics, ensuring that the members of the Supervisory Body perform their functions impartially and independently, despite their operational roles within the organization.

Any situations that could compromise the independence of judgment of the Supervisory Body as a whole and of its individual members must therefore be avoided by paying particular attention to the management of potential conflicts of interest (including family ties and hierarchical dependencies).

It is essential that operational tasks or responsibilities are assigned to the members of the Supervisory Body in such a way as not to compromise, in actual fact, their ability to carry out their supervisory activity independently and effectively. Internal members of the organization who also hold operational roles may be appointed, provided that adequate organizational and management measures are adopted to prevent conflicts of interest and ensure the independence of the Supervisory Body’s judgment and actions.

These requirements can be met by granting the Supervisory Body the highest hierarchical independence, by reporting directly to the Company’s Top Management, namely the President, Vice President, CEO, and other members of the Board of Directors.

In order to ensure that a mix of external and internal members for the Supervisory Body would not undermine these requirements, the Company has introduced specific compensatory measures, formalized in this Model, to guarantee information transparency, effective supervision and operational autonomy of the Body. Thus, the Company pursues a Supervisory Body structure that is in line with the principles of the regulation and can combine operational efficiency and the necessary independence of the Board.

2. Professionalism

The Supervisory Body must possess the technical and professional skills which are necessary to perform the functions required of it. These characteristics, combined with independence, ensure objectivity of judgment.

3. Continuity of action

The Supervisory Body must:

• constantly work to monitor the operation and compliance of the Organizational Model with the necessary investigation powers, including in part with the support of external consultants;
• see to the implementation of the Organizational Model and ensure that it is constantly updated;
• not carry out operational tasks that could affect the overall vision of the company activities required of him.

To this end, the Supervisory Body operates based on an Internal Regulation, adopted and updated by the Supervisory Body itself, which governs in detail the body’s operating procedures, including convening of meetings, resolution quorums, minute-taking, and information management. The Regulation also defines the criteria and methods for managing potential conflicts of interest, including, among other things, the obligation for internal members to abstain from participating in discussions and decisions on issues that directly concern their role or where there are reasonable doubts of interference.

10.2 COMPOSITION AND APPOINTMENT OF THE SUPERVISORY BODY

The Supervisory Body remains in office for the period defined by the board of directors in the appointment document and is eligible for re-election.

The replacement of one or more members of the Supervisory Body before the expiry of their mandate may only occur for just cause or justified reasons, such as, by way of example:

• the voluntary resignation of the Supervisory Body;
• the contingent incapacity for natural causes;
• the occurrence of one of the causes of ineligibility, forfeiture, suspension and revocation referred to in the following paragraph 10.3.

The Company’s board of directors establishes, for the entire duration of the office, the annual compensation due to the Supervisory Body.

The Supervisory Body has an annual budget, established by resolution of the board of directors, so that it can carry out its tasks in complete independence, without limitations that may arise from insufficient financial resources. In any event, the Supervisory Body may request from the board of directors additional resources beyond the endowment fund, to enable its normal operations and carry out the analyses and investigations deemed necessary to verify the adequacy of the Organizational Model.

In the event of dismissal, suspension, or revocation of a member of the Supervisory Body, the board of directors shall reinstate their membership.

The Supervisory Body is considered to have lapsed if the majority of its members are no longer in office due to resignation or other causes. In such event, the board of directors shall appoint the new members.

If a collective Supervisory Body is appointed, the Supervisory Body will self-regulate through a specific Regulation, accompanied by provisions aimed at ensuring that it works at its best. The adoption of this Regulation will be brought to the attention of the board of directors at the first available meeting.

10.3 CAUSES OF (IN)ELIGIBILITY, REVOCATION, FORFEITURE AND SUSPENSION OF THE SUPERVISORY BODY

• Ineligibility and forfeiture

Without prejudice to the assessment by the board of directors as indicated below, the following may not assume the role of members of the Supervisory Body and, if appointed, will be removed from office:

1. those related by kinship within the second degree or marriage (or de facto cohabitation situations equivalent to marriage) with members of the board of directors and the Board of Statutory Auditors, and with the top management of the Company;
2. those in situations of actual or unmanageable conflicts of interest with the Company and/or its subsidiaries, such as to concretely and objectively compromise the independence required of the role and duties of the Supervisory Body;
3. the owners, directly or indirectly, of shareholdings of such a size as to entail control or significant influence over the Company, also pursuant to Article 2359 of the Italian Civil Code;
4. holders of administrative functions with authorities or executive roles within the Company;
5. anyone interdicted, incapacitated, bankrupt or sentenced to a penalty which involves the interdiction, even temporary, from public office or the incapacity to exercise managerial positions;
6. anyone subject to personal preventive measures ordered by the judicial authority, without prejudice to the effects of rehabilitation;
7. anyone sentenced with an irrevocable sentence, without prejudice to the effects of rehabilitation:
   • for having committed one of the crimes referred to in the Legislative Decree;
   • to imprisonment for one of the crimes provided for in Title XI of Book V of the Civil Code or for one of the crimes provided for by the bankruptcy law and/or the Corporate Crisis Code;
   • to imprisonment for a term equal to or greater than two years for any non-culpable crime;
8. have received criminal convictions or other sanctions in foreign countries for offences corresponding to those mentioned above.

In this paragraph, conviction shall mean a sentence pronounced pursuant to Article 444 of the Italian Code of Criminal Procedure, without prejudice to the effects of the judicial declaration of extinction of the crime pursuant to Article 445, second paragraph of the Italian Code of Criminal Procedure.

The Supervisory Body will be responsible for promptly communicating to the board of directors any causes for forfeiture.

Should one of the above-mentioned causes for dismissal occur, the board of directors, having carried out the appropriate investigations, heard the interested party and the other members of the Supervisory Body, and having obtained the opinion of the Board of Statutory Auditors, must adopt by absolute majority the measures it deems appropriate until the member’s dismissal is declared.

If the Supervisory Body includes members of the Board of Statutory Auditors, the preliminary hearing of the Board of Statutory Auditors will only concern the members of the Board who do not belong to the Supervisory Body.

The resolution of forfeiture must be communicated to the Shareholders’ Meeting at the first available opportunity.

• Suspension

The following are grounds for suspension from the office for members of the Supervisory Body:

1. conviction with a non-final sentence for the crimes indicated in letter g) among the causes for ineligibility and forfeiture;
2. being temporarily subjected to one of the measures provided for in Article 10, paragraph 3, of Law 31 May 1965, n. 575, as replaced by Article 3 of Law 19 March 1990, n. 55, and subsequent amendments and additions.

Should one of the above-mentioned causes for suspension occur, the board of directors must adopt by an absolute majority the measures it deems appropriate until the member’s dismissal is declared, after conducting appropriate investigations, hearing the concerned party and the other members of the Supervisory Body and obtaining the opinion of the Board of Statutory Auditors.

If the Supervisory Body includes members of the Board of Statutory Auditors, the preliminary hearing of the Board of Statutory Auditors will only concern the members of the Board who do not belong to the Supervisory Body.

The resolution of suspension must be communicated to the Shareholders’ Meeting at the first available opportunity.

• Revocation

The following are grounds for revocation from the function of member of the Supervisory Body, by way of example and not limited to:

• significant failures to comply with the mandate conferred, in relation to the tasks indicated in the Organizational Model;
• violation of the obligations outlined in the Supervisory Body Regulations, where adopted;
• absence from three or more meetings, even if not consecutive, without providing a justified reason within a period of twelve consecutive months;
• circumstances that seriously and fundamentally undermine the independence or autonomy of judgment of a member;
• irrevocable conviction of the Company under the Legislative Decree or a final plea-bargain where the Supervisory Body is found guilty of “omitted or insufficient surveillance,” as provided for in Article 6 (1) (d) of the Decree;
• an irrevocable sentence of conviction, without prejudice to the effects of rehabilitation, or a definitive sentence which applies the penalty at the request of the parties, except in the event of extinction of the crime, issued against one of the members of the Supervisory Body for having committed one of the crimes provided for by the Legislative Decree;
• breach of confidentiality obligations.

Should one of the above-mentioned causes for revocation occur, the board of directors, having carried out the appropriate investigations, heard the interested party and the other members of the Supervisory Body, and having obtained the opinion of the Board of Statutory Auditors, must adopt by an absolute majority the measures it deems appropriate until the member’s revocation is declared.

If the Supervisory Body includes members of the Board of Statutory Auditors, the preliminary hearing of the Board of Statutory Auditors will only concern the members of the Board who do not belong to the Supervisory Body.

The resolution of revocation must be communicated to the Shareholders’ Meeting at the first available opportunity.

If the Supervisory Body includes Company employees, an employee who is part of the Supervisory Body, for the entire duration of the assignment and for the six months following its termination, may only resign or be dismissed for just cause or justified reason pursuant to the law, and will, in the last two cases, be duly motivated. The termination, for whatever reason, of the employment relationship with the Company of an employee who is also a member of the Supervisory Body determines the simultaneous forfeiture of the role of member of the Supervisory Body, unless otherwise resolved by the management body.

10.4 VERIFICATION PROCEDURES FOR THE EFFECTIVENESS AND CONSTANT ADAPTATION OF THE ORGANIZATIONAL MODEL AND INTERVENTION PLAN

The Supervisory Body must periodically verify the effectiveness and suitability of the Organizational Model to prevent the commission of the offenses referred to in the Legislative Decree. In particular:

• checks on individual documents. To this end, it will periodically review the documents and contracts relating to crime-risk processes, according to methods identified by it;
• verification of the Special Part and the Protocols. To this end, it will periodically verify the effectiveness and implementation of the Special Part and the Protocols of this Organizational Model;
• checks on the level of knowledge of the Organizational Model, including by examining the requests for clarification or whistleblowing reports received;
• periodic updating of the Risk Assessment activity aimed at reviewing the map of activities exposed to a potential crime-risk, particularly in the event of changes to the Company’s organization or business, additions or amendments to the Legislative Decree.

The Supervisory Body shall exercise its supervisory powers in line with an Intervention Plan that it will submit on an annual basis to the board of directors, containing information on the activities it plans to carry out and the areas that will be subject to inspections. The Supervisory Body may, however, carry out checks that have not been included in the Intervention Plan (so-called “random checks”) within the scope of sensitive company activities, as it deems fit for the performance of its duties.

In implementing the Intervention Plan, the Supervisory Body adopts procedures suitable to allow it to carry out its supervisory and control activities, which will be communicated to the relevant Corporate Functions, and may establish working groups on specific issues. In the event of particular circumstances (such as complaints for repeated Violations), the Supervisory Body will apply systematic procedures to research and identify the risks being analysed.

In particular, it may request to consult the documentation concerning the activities of individual business units and of the individuals in charge of the crime-risk processes being checked and/or audited, extracting copies if necessary, as well as conduct interviews and request written reports, if necessary. During these operations, the manager of the relevant organizational unit must be kept constantly informed.

Following the checks carried out, the Supervisory Body may bring any observations and/or suggestions to the attention of the senior manager of the individual who committed the Violation.

The activity carried out by the Supervisory Body must be documented, including by summary. To ensure confidentiality, the relevant documentation must be kept by the Supervisory Body in compliance with the legislation on the protection of personal data. External members of the Supervisory Body have the right to access documentation relevant freely and directly to the activities performed, without the need for prior intermediation by the internal member. Such access is extended, upon formal notification, to the heads of the main corporate functions involved in the crime-risk processes, to the Board of Statutory Auditors, and to the independent audit firm, whom external members may contact directly for clarifications or further information on specific activities.

The Supervisory Body, following the checks carried out, the regulatory changes that have occurred from time to time, and the possible emergence of new Crime-risk Processes, proposes to the board of directors the adjustments and updates to the Organizational Model that it deems appropriate.

For its audit activities, the Supervisory Body may rely on the support of external consultants with appropriate expertise in the field.

In compliance with the principle of autonomy and independence, the Supervisory Body may call meetings reserved for external members only, including on a regular basis, with or without the support of external consultants appointed by the Body, and of the Auditing Firm. Such sessions may be convened when such members deem it necessary, including to explore issues that directly involve the activities carried out by the internal member’s function and, in this case, potentially subject to a conflict of interest.

10.5 INFORMATION FLOWS TO THE SUPERVISORY BODY

For effective supervision of the implementation of the Organizational Model, the Recipients, by virtue of their role and responsibilities, are required to transmit information flows to the Supervisory Body as indicated in the Organizational Model and summarised in Annex 4 “List of Information Flows to the Supervisory Body” (hereinafter the “Information Flows”).

In any event, the Supervisory Body is granted all the powers under the Organizational Model to request any information, data, document, or news from the Recipients at any time. The Recipients must provide the requested information to the Supervisory Body without delay.

Any information or news that may be considered relevant pursuant to the Organizational Model must be transmitted to the Supervisory Body without delay.

In addition to the Information Flows indicated in the Organizational Model, the Company’s Top Management is required to inform the Supervisory Body of:

1. any change affecting either the system of delegations or the organizational structure of the Company;
2. the Company’s extraordinary corporate transactions;
3. any new business activity or establishment opening;
4. any information relevant to compliance, functioning and updating of the Organizational Model.

To guarantee external members of the Supervisory Body a full, detailed and up-to-date level of information, the Company ensures the activation of specific Information Flows, coming directly from the Company Functions involved in the Crime-risk Processes, with periodic deadlines indicated in the Annex “List of Information Flows to the Supervisory Body”.

10.5.1 ARCHIVING

All information flows sent to the Supervisory Body are processed and stored by the Supervisory Body itself in a specific electronic and/or paper archive maintained in compliance with the provisions of European Regulation 2016/679 on the protection of personal data (GDPR).

10.6 REPORTING VIOLATIONS – WHISTLEBLOWING

Recipients who decide to file a Violation Report must follow the procedures set out in the Whistleblowing Procedure.
In particular, whistleblowing reports can be filed as follows:

The ban on retaliation is provided for by Article 17 of Legislative Decree 24/2023, which is hereby fully incorporated into this article. [1]Any action taken in violation of this prohibition is void.

[1]Article 17 para. 1 “The entities or persons referred to in Article 3 may not suffer any retaliation” refers to:

whistleblowers (as defined in the Whistleblowing Procedure);
facilitators (as defined in the Whistleblowing Procedure);
people in the same work context (as defined in the Whistleblowing Procedure) as the whistleblower who are linked to them by a stable emotional or kinship relationship within the fourth degree;
the reporter’s work colleagues who work in the same work context as the whistleblower and who have a habitual and current relationship with the whistleblower;
entities owned by the reporting person or for which the same persons work, as well as entities operating in the same work context as the aforementioned persons.

10.7 INFORMATION FROM THE SUPERVISORY BODY TO THE CORPORATE BODIES

The Supervisory Body reports directly to the board of directors on issues relating to the Organizational Model.

The Supervisory Body shall inform the board of directors, including in writing, regarding the application and effectiveness of the Organizational Model at least on an annual basis (indicating in particular the controls carried out and their outcome, as well as any updates to the crime-risk processes), or at different times with reference to specific or significant situations.

The Supervisory Body may be summoned by the board of directors to report on its activities and may request to confer with it.

The Supervisory Body may also request to be heard by the board of directors whenever it deems it appropriate to promptly report violations or request attention to critical issues relating to the functioning and compliance with the Organizational Model. As necessary and/or urgent, the Supervisory Body may confer directly with the President or the Chief Executive Officer of the Board of Directors.

The Supervisory Body is responsible for providing appropriate clarifications in the presence of interpretative issues or questions relating to the Organizational Model.

10.8 RELATIONS WITH THE BOARD OF STATUTORY AUDITORS AND THE INDEPENDENT AUDITORS

The Supervisory Body convenes periodic meetings with the Board of Statutory Auditors and the Independent Auditors—and in any event before the approval of the financial statements, as recommended by the Confindustria Guidelines—to review the main activities carried out within their respective areas of responsibility and any concerns that may have arisen. Company functions concerned in the topics being analysed may be invited to these meetings.

Article 6, paragraph 2, letter c) of the Legislative Decree requires the identification of methods for managing financial resources suitable for preventing the commission of crimes. Therefore, the Company has deemed it appropriate to issue, in addition to the Organizational Model, a “Financial and Monetary Flows (Treasury, Accounting and Control)” Protocol which regulates the parties involved and their powers, the tools adopted and the connections with the administrative/accounting system for each type of transaction.

Article 6 para. 2, letter e) and Article 7, paragraph 4, letter b) of Legislative Decree 231/2001 specify, as a condition for the effective implementation of the Organization, Management and Control Model, the introduction of a disciplinary system suitable for sanctioning failure to comply with the measures indicated in the Model itself.

Therefore, the definition of an adequate disciplinary system represents an essential prerequisite for the Model’s exculpatory value with respect to the administrative liability of entities.

The sanctions provided for by the Disciplinary System (Annexes 5 and 6) will be applied to any violation of the provisions contained in the Model, the Code of Ethics and/or the Whistleblowing Procedure, regardless of whether a Crime has been committed or the conduct – and outcome – of any criminal proceedings initiated by the judicial authority in cases where the conduct constitutes a Crime. In any event, ownership, disciplinary power or contractual rights must be exercised in compliance with the system of delegations and powers of attorney in force.

Sanctions may be applied if the conduct consists of:

1. Violations;
2. failure to comply with the Code of Ethics and/or the Whistleblowing Procedure;
3. Violations constituting, directly or indirectly, a Crime;
4. failure to participate, without justification, in the training provided on the Legislative Decree, the Organizational Model and the Code of Ethics;
5. failure to provide evidence or untruthful evidence of the activity carried out in relation to the documentation methods, storage and control of documents, in such a way as to prevent their transparency and verifiability;
6. failure to comply with and/or circumvention of the control system, carried out through the removal, destruction or alteration of supporting documentation, or by carrying out activities aimed at preventing the designated persons and the Supervisory Body from controlling or accessing the requested information and documentation;
7. failure to comply with the provisions relating to signature powers and the delegation system;
8. failure to comply with information obligations towards the Supervisory Body.

The list is merely by way of example and without limitation.

The disciplinary measures envisaged against employees, managers, members of the Board of Directors, the control and audit body and the Supervisory Body, and Third Parties for non-compliance with the Model, the Code of Ethics and the Whistleblowing Procedure as well as for ascertained Violations are set out in Annexes 5 (Disciplinary System – Italy) and 6 (Disciplinary System – Austria), in relation to the provisions of the existing employment relationship, to which reference is made.

In the event of non-compliance and/or a violation of the Organizational Model, the Code of Ethics, or the Whistleblowing Procedure, the type and extent of specific sanctions will be applied in proportion to the seriousness of the shortcomings and, in any case, taking into consideration the elements listed below:

• the subjective element of the individual conduct, whether intentional or negligent;**
• the importance of the violated obligations;
• the hierarchical or technical level of responsibility;
• presence of aggravating or mitigating circumstances with particular regard to professionalism, previous work experience, the circumstances in which the crime was committed and any repeat offences;
• possible joint responsibility together with other individuals who contributed to determine the shortcoming;
• behaviours that could compromise, even potentially, the effectiveness of the Organizational Model and/or the Code of Ethics.

If multiple violations, punishable by different sanctions are committed with a single act, the most serious sanction will be applied.

• PT 1 – Treasury, Accounting and Control;
• PT 2 – Finance;
• PT 3 – Drafting of Financial Statement and Related Notes and Interactions with related companies/subsidiaries/related parties;
• PT 4 – Sales and Aftersales and Management of Extrajudicial Disputes;
• PT 5 – Marketing, Communications, Sponsorships, Gifts and Donations;
• PT 6 – Selection, hiring and management of Human Resources;
• PT 7 – Purchasing and Supply Chain;
• PT 8 – Logistics, Inventory and Warehouse.