The board’s responsibility for internal control is regulated in the Swedish Companies Act, the Annual Accounts Act, and the Code (Swedish Code of Corporate Governance), which contains requirements that information about the most important elements of Episurf’s system for internal control and risk management in connection with the financial reporting must be included each year in the corporate governance report.

The board must, among other things, ensure that Episurf has good internal control and formalized routines to comply with established principles for financial reporting and internal control. Episurf’s CFO reports to the audit committee, which must assess whether the company’s internal control function is sufficient from a corporate governance perspective and whether it does not need a separate internal audit function.

Episurf’s internal control procedures are based on the internal control framework published by the COSO (Committee of Sponsoring Organizations of the Treadway Commission). They are based on a controlled environment that creates discipline and structure for the other components: risk assessment, control activities, information and communication, and follow-up, evaluation, and reporting.

These routines have been designed to ensure reliable overall financial reporting and external financial reporting in accordance with IFRS, applicable laws and regulations, and other requirements to be applied by companies listed on Nasdaq Stockholm. This work involves the board, Episurf group management, and other staff.

The board has established instructions and governing documents to regulate the distribution of roles and responsibilities of the CEO and the board. The way in which the board monitors and ensures the quality of internal control is documented above all in the board’s rules of procedure and corporate governance, where the board has established a number of basic guidelines of importance for the work with internal control.

The work with internal control is also reflected in other governing documents, policies established by the board, and directives established by group management. These include, among other things, regular control and follow-up of outcomes compared to expectations and previous years, as well as oversight of, among other things, the accounting principles that Episurf applies.

The responsibility for maintaining an effective control environment and the ongoing work with risk assessment and internal control regarding the financial reporting is delegated to the CEO and CFO. However, the board is ultimately responsible. According to established procedures, group management reports regularly to the board and the audit committee. Responsibilities and powers, instructions, guidelines, manuals, and policies and directives constitute, together with laws and regulations, the control environment with regard to financial reporting.

Episurf carries out ongoing risk assessments to identify risks regarding financial reporting. These risks include, among other things, inaccuracies in the accounting (for example, regarding accounting and valuation of assets, liabilities, income, and expenses or other deviations) as well as irregularities and fraud. Risk management is built into every process, and various methods are used to assess, detect, and prevent risks and to ensure that the risks to which Episurf is exposed are managed by established policies, directives, and instructions.

The design of control activities is critical in Episurf’s work to prevent and detect risks and deficiencies in financial reporting. The control structure consists of clear roles in the organization that enable efficient distribution of responsibility for specific control activities, including authorization checks in IT systems and certificate checks. Continuous analysis of financial reporting is very important to ensure that it does not contain any material inaccuracies.

Episurf has information and communication channels to promote completeness and accuracy in financial reporting. Regular updates on changes to accounting principles, reporting requirements, or other information provisions are made available and known to affected employees. For the external provision of information, guidelines have been designed to ensure that Episurf meets the requirements of disseminating correct information to the market.