Annexes

The following annexes accompany the Handbook. They are practical tools and examples that companies may adapt to their own circumstances; the sub-chapter in which each annex is referred to is shown in brackets.

Annex 1 Board competencies: hard and soft (sub-chapter 3.2)

Annex 2 Recommended topics for corporate governance policies (sub-chapters 1.2 and 7.4)

Annex 3 Risk categories and types (sub-chapter 5.2.3)

Annex 4 Risk register: suggested elements (sub-chapter 5.2.3)

Annex 5 Annual Board plan and Board calendar: examples (sub-chapter 6.1)

Annex 6 Board submission (cover) letter: template (sub-chapter 6.1)

Annex 7 Functions and responsibilities of the Board secretary (sub-chapter 6.5)

Annex 8 Board self-assessment questionnaire: example (sub-chapter 6.6)

Annex 9 Questionnaire for the executives: example (sub-chapter 6.6)

Annex 10 Board work improvement plan: template (sub-chapter 6.6)

Annex 1 Board competencies: hard and soft

The hard competencies below should be covered by the Board as a whole; no individual member is expected to hold all of them. The soft competencies are expected of every Board member.

Hard competencies

Soft competencies

Annex 2 Recommended topics for corporate governance policies

Each Board should decide what policies are necessary for the company in particular stage of corporate governance and business development. The list of topics provided below is indicative to get ideas for the board to consider when establishing corporate policies. Topics in bold are highly recommended.

1. Anti-bribery and corruption prevention
2. Business continuity
3. Board nomination and selection
4. Charities and donations
5. Community development and support
6. Compliance
7. Corporate governance (defines how governance is functioning)
8. Conflict of interest
9. Diversity, equal opportunities and inclusion, Human rights
10. Dividends (listed, SOEs, MOEs)
11. Ethics, Responsible business conduct (RBC)
12. Fraud prevention
13. Information security
14. Investment
15. Key employees’ succession
16. Remuneration (top executives, employees, board members)
17. Personal data protection, data retention
18. Performance evaluation of the governing bodies, individual directors and key executives
19. Procurement
20. Project management oversight
21. R&D, Innovation
22. Related party transaction (may be part of a conflict of interest or ethics or other)
23. Risk governance oversight
24. Safety at work, health, well-being and prevention of occupational risks
25. Stakeholder relationship
26. Supplier code of conduct
27. Sustainability (ESG);
28. Whistle-blower
29. (for SOEs) Policy on the types of non-commercial services SOE can provide, and the rationale for provision of services and how such services are compensated
30. (for family owned) Family policies relating to family members’ employment, transfer of shares, and CEO succession

Annex 3 Risk categories and types

Strategic risks

1. Corporate governance risk

The risk that employees will not act in the interests of shareholders and other stakeholders.

2. Competitive risk

The risk of losing competitive advantage.

3. Innovation risk

The risk that innovations will make your company less successful.

4. Intellectual property risk

Risks related to intellectual property.

5. Merger and acquisition risk

Risks related to these processes.

6. Business risk

The risk that your overall business strategy and plan will be ineffective and/or fail to deliver results.

7. Economic risk

The risk that the economy will enter a recession.

8. Technological change

The risk that technology will become obsolete.

9. Change management risk

Risks related to the management of change.

10. Project risk

The risk that projects will fail (deadlines, budget).

11. Ethics risk

The risk that your core principles and ethics will be breached.

12. Reputational risk

The risk of damage to your company’s image.

13. Sustainability risk

The risk of failing to meet sustainability goals and targets.

Financial risks

14. Profit risk

The general risk that profit will decline or a loss will be incurred.

15. Availability of capital

The risk that you will be unable to finance your business.

16. Asset risk

Risk related to asset prices or values (for example, real estate).

17. Interest rate risk

The risk that interest rates will change (rise).

18. Currency risk

The risk of exchange rate changes when you buy or sell.

19. Inflation risk

The risk of price increases in critical costs (for example, energy).

20. Investment risk

The risk of changes in the value of investments.

21. Liquidity risk

The risk that you will be unable to sell assets efficiently (quickly and at an acceptable price).

22. Systemic risk

The risk that the global financial system or the national financial system will suffer a collapse.

23. Concentration risk

Having one or a few dominant customers or suppliers.

24. Credit risk

The risk that debtors will not repay their debts.

25. Fraud risk

The risk of losses from fraud.

26. Accounting risk

The risk of accounting errors.

27. Breach of trust risk

The risk that your company breaches its fiduciary duties (for example, inside information).

28. Counterparty risk

The risk that other companies will fail to honour their contractual obligations.

29. Tax risk

The risk that your taxes will increase.

Marketing and sales risks

30. Revenue shortfall risk

The general risk that revenue will decline.

31. Demand risk

Lower than planned demand for your products.

32. Market competition risk

The risk that competitive forces will reduce your company’s revenue (for example, a price war).

33. Sales forecast risk

The risk that sales forecasts will be inaccurate.

34. New product development risk

The risk that new products will appear on the market.

35. Customer relationship risk

The risk of damaged relationships with customers.

36. Brand value risk

The risk of a decline in brand value.

37. Publicity risk

The risk of negative public information.

38. Key customer risk

The risk of losing a major customer.

39. Location risk

The risk of choosing an unsuitable location (for example, a retail site).

Operational risks

40. Infrastructure risk

Risks related to infrastructure (for example, interruption of electricity or gas supply).

41. Maintenance and repair risk

Risk in the maintenance and repair process (for example, human error during equipment servicing).

42. Product failure risk

The risk that your product will fail or your services will not be delivered properly.

43. Product liability risk

The risk of legal liability related to your products and services.

44. Operational quality risk

The general risk of operational disruption (for example, your website or e-shop is not working).

45. Production interruption risk

Failure to achieve production targets.

46. Logistics risk

The risk of logistics failure (for example, failure to deliver goods to your retail outlets on time).

47. Procurement risk

Risk related to the purchase of goods and services.

Information technology

48. IT architecture risk

The risk that the architecture of your IT systems will not meet business objectives.

49. Data quality and data loss risk

The risk of poor quality data or loss of data.

50. Technology quality risk

The risk of quality problems in software and hardware.

51. Platform risk

The likelihood of choosing a technology platform that is unsuitable for achieving business objectives effectively.

52. Information security risk

The risk of information security incidents.

People risks

53. Employee safety risk

The risk that accidents will occur or that a poor working environment will affect employees and their health.

54. Employer reputation risk

The risk that the company will acquire a poor reputation and find it difficult to recruit the best talent.

55. Employer liability risk

The risk of a claim being brought against you for work-related actions or incidents.

56. Employment law compliance risk

The risk of non-compliance with employment laws and regulations.

57. Talent management risk

The risk of losing top talent and key employees.

58. Remuneration and benefits risk

The risk that remuneration and benefits will be ineffective or applied inappropriately.

59. Recruitment risk

The risk of hiring the wrong candidate or breaching ethics or the law in the recruitment process.

60. Employee data privacy risk

The risk that you will disclose personal information about your employees.

Compliance and legal risks

61. Compliance risk

The risk of failing to comply with laws and other regulations.

62. Mandatory reporting risk

The risk of failing to meet regulatory reporting requirements.

63. Liability risk

The risk of legal claims.

External risks

64. Force majeure

Acts of nature, war and terrorism.

65. Political risk

Risk related to political change.

Annex 4 Risk register: suggested elements

Important! Each company in the current status of its risk management development should set its own elements of the risk register and review them regularly.

Companies are creating an easy-to-use Excel file incorporating the following risk register elements.

1. General information

1. Risk ID. Unique identifier for each risk.
2. Risk category. Broad grouping (e.g., strategic, operational, financial, compliance, reputational, environmental).
3. Risk name. Short descriptive label.
4. Risk description. Detailed explanation of the risk event/scenario.
5. Risk owner. Person (not the name, but position) responsible for managing this risk.

2. Risk assessment

6. Cause. Why this risk exists (root cause).
7. Potential impact. What could happen if this risk materializes.
8. Probability. Rating on scale 1 to 5, where 5 is the highest probability; you should describe what means each probability (once a month, once a year, etc.)
9. Impact. Rating of consequences of each type of impact (e.g. impacts to company’s possibilities to achieve strategic goals and objectives, health and safety, financial, environmental, business continuity. reputation).
10. Risk level. Result of multiplication of the probability and the highest impact rate before any risk mitigation actions are applied.

3. Response / Mitigation

11. Existing risk mitigation measures. Measures already in place to mitigate risk.
12. Effectiveness of current mitigation. How effective current actions are.
13. Required mitigation action(s). Specific activities to manage the risk in order to reduce it.
14. Owner of the action(s). Employee (position) who is responsible for mitigation actions.
15. Action(s) deadline. Deadline for risk mitigation action.

4. Monitoring and Reporting

16. Last updated. When this risk was last reviewed.
17. Reporting line. To whom this risk management should be reported to (e.g. board, risk committee, top management)

Annex 5 Annual Board plan and Board calendar: examples

This annex gives an example of an annual Board calendar for a company whose Board meets every month. However, each Board has to make decision on the appropriate number of the meetings it wants to plan for a year. It will depend on the company type (e.g. private or listed; regulated or not) complexity of its operations and many other factors. It combines the two formats commonly used in practice: a meeting-by-meeting plan, which shows the focus and the main items of each meeting, and a calendar matrix, which shows in which months each recurring activity of the Board takes place. The example assumes a financial year equal to the calendar year, an annual general meeting in April, quarterly reporting and three committees (audit, remuneration and nomination). The wording is neutral and can be used by a one-tier Board or by a Supervisory Board (also called the Council). Companies should adapt the calendar to their own size, ownership, reporting cycle and regulatory requirements; a Board that meets less often can merge adjacent meetings.

Standing items at every meeting are not repeated in the tables: approval of the agenda and of the minutes of the previous meeting, follow-up of decisions taken, the CEO’s report on business performance and key events, the financial report against budget, the risk and compliance dashboard, reports of the committee chairs and a private Board-only session without management at the end of each meeting.

Important: items in the calendar are for illustration only and should not be understood as the best governance practice.

1. Meeting-by-meeting plan

2. Calendar matrix: activities by month

A dot marks the month in which the activity is on the Board’s agenda. Committees meet one to two weeks before the Board meeting for which they prepare recommendations.

This matrix is for indicative purposes only and should not be understood as the best practice

The matrix is a planning tool for the Chair and the Board secretary: once filled in, it shows at a glance whether every matter reserved to the Board has its place in the year, whether the workload is evenly spread and whether the Board leaves enough time for strategy and forward-looking topics. It should be reviewed after the Board evaluation and approved, together with the meeting dates, at the last meeting of the preceding year.

Annex 6 Board submission (cover) letter: template

Company “XXX”

Form for submitting an item for consideration at a Board meeting

The form below is an example. Where necessary, the persons preparing a submission may add other sections at their discretion, depending on the nature of the item under consideration. The right-hand column explains what each section should contain; in a completed submission it is replaced by the actual content.

Annex 7 Functions and responsibilities of the Board secretary

The Board secretary plays a very important role in the governance and administration of a company. The secretary’s main function is to ensure that the Board works effectively and complies with legal and regulatory requirements. The main functions and duties of the Board secretary are set out below.

1. Support for Board meetings

• Planning and organising the meetings of the Board and its committees.
• Preparing and distributing notices of meetings, agendas and supporting materials.
• Coordinating the logistics of meetings, including the venue, technology and, where needed, catering.
• Taking the minutes of Board meetings and keeping the minutes of all meetings.

2. Ensuring good governance practice

• Ensuring that the company’s governance practices comply with the applicable laws, regulations and the articles of association.
• Informing the Board of changes in governance requirements and best practice and of new developments.
• Helping the Board to maintain an effective corporate governance system.

3. Fiduciary duties of Board members

• Helping the Board to understand and fulfil its fiduciary duties, including the duties of loyalty and care.
• Advising on the legal duties and ethical obligations of Board members.

4. Management of corporate documents

• Maintaining and safeguarding the company’s documents, including the articles of association, governance documents, Board meeting materials and Board resolutions.
• Safeguarding other important corporate documents and records.

5. Compliance and reporting

• Ensuring that the company complies with all legal and regulatory requirements, including annual reporting and disclosure.
• Informing the Board of changes in laws, regulations and governance practice and advising the Board on these matters.
• Helping to prepare and submit the reports required by regulatory authorities.

6. Support for Board communication

• Acting as the link between the Board and the CEO and the executive team.
• Helping to maintain communication between Board members, shareholders and other stakeholders.

7. Induction and development of Board members

• Supporting new Board members by providing them with the essential information about the company, its governance and their roles and responsibilities (induction).
• Organising training and professional development for Board members where needed.

8. Management of conflicts of interest

• Helping to identify and manage the conflicts of interest of Board members and senior executives.
• Helping to develop and implement the conflict of interest policy.

9. Board evaluation and improvement of Board work

• Helping the Board to carry out its evaluation and to improve its work.
• Helping to collect and analyse feedback in order to increase the effectiveness of the Board.

10. Administration of the secretary’s office

• Managing the administrative matters of the company secretary’s office, including budgeting, recruitment and the allocation of resources.
• Maintaining an effective and well-organised document management system.

The Board secretary is the key person ensuring the transparency and accountability of the company’s activities and effective good governance within the company. The secretary helps to maintain the integrity of the Board’s actions and promotes the confidence of shareholders and stakeholders. The specific duties may differ depending on the size of the organisation, its industry and the applicable legal requirements.

Annex 8 Board self-assessment questionnaire: example

Company: ______________________ Assessment date: ______________

Board member (first name and surname): ______________________

For each statement, enter your score in the appropriate column (1–5), not a cross: 1 – definitely not; 2 – not quite; 3 – neutral / do not know; 4 – yes, in principle; 5 – yes, without a doubt. Add comments where useful.

Annex 9 Questionnaire for the executives: example

Dear executives,

As part of its annual self-evaluation, the Board requests your structured and candid feedback on its performance, behaviours, and ways of working.

Purpose of your input

The primary purpose of this input is to help the Board improve its work by providing the executive perspective on:

• How the Board’s actions and processes are experienced by leadership;
• How effectively the Board supports the organization's strategy and long-term objectives;
• How the Board could bring even more value into interaction with CEO and other executives.

It is not about the judgement, but about higher efficiency of the Board and better Board-CEO-executives interaction that will improve the whole organisation.

Call to action

Please provide open and balanced input, highlighting both strengths and areas for improvement. This process is crucial for strengthening alignment, trust, and effectiveness between the Board and executives, benefiting the entire organization.

The Board thanks you for your contribution to strengthening the organization's governance and leadership.

Questionnaire

Score each question from 1 (lowest) to 5 (highest) and add your answer or comment. Open questions are answered in the last column only.

Annex 10 Board work improvement plan: template

Company "XXX" Board performance improvement plan for the year 20xx

Date of preparation: ________________________

Signature of the Board Chair: ________________________ Date: _______________________