INTRODUCTION
Following the approval of the National Anti-Corruption Strategy 2020-2024, the National Anti-Corruption Mechanism (“MENAC”) and the General Regime for the Prevention of Corruption (“RGPC”) were established through Decree-Law No. 109-E/2021 of December 9.
In compliance with the aforementioned diploma, guiding its activity by high standards of professional responsibility and ethics, and governed by the principles of integrity, transparency, honesty, loyalty, rigor and good faith, the VILA NOVA CARNEIRO GROUP - a group of companies owned and participated in by Vila Nova Carneiro, SA (hereinafter, “VNC”) - prepared this Corruption and Related Offenses Risk Prevention Plan (hereinafter referred to as “PPR”), which covers the entire organization and activity of VNC.
1. OBJECTIVES
The purpose of this PPR is to identify and manage the risks of corruption and related offences at VNC and is based on the following pillars:
a) Identification and systematization of external and internal legal and regulatory requirements;
b) Adoption and implementation of a PPR containing the identification, analysis and classification of risks and situations that may expose VNC to acts of corruption and related offences;
c) Planning and development of activities to control and mitigate identified risks, including preventive and corrective measures to reduce the probability of occurrence and the impact of these risks;
d) Monitoring the implementation of the PPR.
The identification and assessment of corruption risks and related offences is carried out periodically or whenever events occur that lead to significant changes in the legal and regulatory context or in the organizational context.
VNC ensures that the PPR is known to its Employees, publishing it on its website.
2. ORGANIZATION STRUCTURE
Currently, the Vila Nova Carneiro Group is composed of the following entities:
• COFEMEL – Clothing Company, SA;
• Vilanova Accessories, SA;
• 2012-01-01;
• VNC Capital, SGPS, SA
3. RISK MANAGEMENT AND ASSESSMENT METHODOLOGY
The methodology for identifying, analyzing and classifying risks and situations that may expose VNC to acts of corruption and related offenses, in line with the requirements listed in Decree-Law No. 109-E/2021, of December 9, considered:
a) The area of activity of VNC and the consequent risk of committing acts of corruption and related offences;
b) The probability of occurrence and the foreseeable impact of each situation, in order to allow the grading of risks;
c) Preventive and corrective measures that reduce the probability of occurrence and the impact of the risks and situations identified;
d) In situations of high or maximum risk, the most exhaustive prevention measures, with their implementation being a priority;
e) The designation of the General Responsible for Execution, to control and review the PPR, having, for this purpose, the Responsible for Regulatory Compliance been designated.
3.1. Risk area
Bearing in mind the objectives and scope of this PPR, as well as VNC's mission and the activities carried out by its employees, it is important to understand the degree of risk and the probability of a future event of corruption or related offence occurring, with a view to its prevention and mitigation.
To this end, the construction of this PPR followed the following methodology:
• Risk identification;
• Risk assessment;
• Identification of controls to mitigate risks;
• Identification of those responsible for monitoring controls;
• Definition of the action plan for monitoring risks and respective mitigation measures.
With regard to risk identification, the circumstances and/or activities likely to give rise to irregular situations are defined, namely:
• Processing of inappropriate payments to partners or subcontracted entities;
• Allocation of offers/gifts/donations/sponsorships related to the award of a contract or in exchange for a benefit or advantage;
• Payment or invoicing for a fictitious service or favoritism towards a supplier or customer in exchange for an undue advantage;
• Payment (or promise of payment) to a public agent (or similar) to obtain preferential treatment;
• Fraud in obtaining or misappropriating subsidies;
• Acquisition/construction and/or licensing of goods or services that exceed real needs or with overpriced prices in exchange for advantage/benefit;
• In the context of stock management, acquisition or diversion of goods in exchange for an advantage/benefit;
• Use/disclosure of privileged and/or confidential information in exchange for an advantage/benefit;
• Favoritism in hiring (HR) in exchange for an undue advantage;
• Undue salary/fee processing in exchange for advantage/benefit.
In the risk assessment, each of the identified situations is evaluated according to the impact and probability of occurrence.
3.2. Risk assessment matrix
After identifying the risk, it is assessed in terms of its probability of occurrence and impact, according to the following tables:

Thus, the level of inherent risk is obtained by applying the levels of probability of occurrence and impact for each of the identified risks.
Finally, taking into account the classification of the risk listed, internal control is assessed in accordance with the following table:

3.3. Control mechanisms
For the identified risks, a set of measures has been implemented that aims to reduce both the probability of their occurrence and the degree of their impact.
In addition to these measures, it is also important to highlight that VNC has a set of internal mechanisms and policies, which contain the Group's fundamental principles and values and which emphasise its position in the uncompromising fight against corruption and related offences, namely:
• Code of Conduct;
• Reporting Channel;
• Rules for Using the Reporting Channel;
• Training programs;
• Between others.
3.4. Risk and Control Matrix
The Risk and Control Matrix (RCM) presented below identifies a set of risks in VNC's activity, which were analyzed in terms of their probability of occurrence and impact. Furthermore, and for each of these risks, the respective mitigation controls, the applicable prevention policies, as well as the existing mitigation measures are also identified.
Taking into account the main processes/areas likely to involve the occurrence of corruption phenomena and related practices and the main risk factors, the assessment of the level of criticality of each risk was carried out taking into account its classification in terms of probability of occurrence and its impact.
The evaluation was carried out considering:
a) The inherent risk (risk before the application of any type of control);
b) The level of control existing in the organization (preventive measures, corrective measures, existing mitigation measures);
c) Residual risk (risk after applying the organization's existing controls).

4. MONITORING, EVALUATION AND MONITORING OF THE PPR
The VNC Board of Directors has appointed a Regulatory Compliance Officer to monitor and control the implementation of the Regulatory Compliance Program and its review, without prejudice to the powers legally conferred on other VNC bodies or employees.
The role of Regulatory Compliance Officer is held by a senior management member or equivalent of VNC. As part of their duties, the Regulatory Compliance Officer has access to internal information and the necessary technical and human resources, and has the authority to request information from the various departments of the company, acting independently and autonomously in decision-making.
In this sense, monitoring of the PPR is ensured through periodic testing of controls, implementation and records of evidence of their execution.
Additionally, and under the terms set out in paragraphs a) and b) of paragraph 4 of article 6 of Decree-Law no. 109-E/2021, of 9 December, the implementation of the PPR is subject to other controls, namely:
• The preparation, in October, of an interim assessment report on situations identified as having high risk;
• The preparation, in April of the year following the year in which the implementation relates, of the annual assessment report, which must contain, in particular, the quantification of the degree of implementation of the preventive and corrective measures identified, as well as the forecast for their full implementation.
The PPR is reviewed every three years or whenever there is a change in the attributions or in the organic or corporate structure of VNC, which justifies its review.
5. FINAL PROVISIONS
The VNC PPR, as provided for in paragraph 6 of article 6 of Decree-Law no. 109-E/2021 of December 9, will be made available within 10 days of its implementation and respective revisions or preparation.