Compliance Program Management

HIGH ADMINISTRATION SUPPORT

At Maringá Regional Airport we have the full support of our senior management, it is an indispensable and permanent condition for fostering an ethical culture and respect for the laws and for the effective application of the Compliance Program.
The behavior of senior management and the way it communicates with other employees are the items that most influence the culture. Much more than traditional codes of conduct and training.
With regard to culture, the example influences much more than any speech or document.
With compliance practices, any deviations from the Company's internal policy can be identified and even avoided. This brings security to all audiences influenced by our activities, such as customers, shareholders, the community and employees themselves, who are assured that all guidelines established for the organization are being met and have a process of control and control. management.
Simply put, Compliance works to make the Company trustworthy and it is up to all employees to contribute to our compliance with all applicable regulations.

RISK ASSESSMENT

Risks are events with negative impacts on the achievement of an objective. Risks are potential events, not certain. Therefore, it is very important that, before talking about risk assessment, you know the objectives of your Company and its Compliance program, as this pillar is one of the foundations of the success of the Compliance Program, since the code of conduct , policies and monitoring efforts should be built on the risks that are identified as relevant during the analysis phase. The effective conduct of a risk analysis involved planning, interviews, documentation and data cataloging, data analysis and establishment of necessary remediation measures.
Maringá Regional Airport also has in its structure the Internal Audit, which has, among other duties, the review and supervision of the Company's internal controls and risk management, in order to ensure the good management of resources and the protection and appreciation of equity.

CODE OF CONDUCT

The code of conduct is the main foundation. It establishes, among other topics, the rights and obligations of the Company's officers, managers, coordinators, employees, agents and business partners.
After our risk assessment and identification of the laws, regulations, codes applicable to your operations, we began the compliance program documentation with the elaboration of compliance policies. These documentation serve as the initial formalization of what the Company's stance is on the various issues related to its business practices, and will serve as a compass that will guide - along with the actions and examples of senior management, its employees on the way. of ethical and legal practices ('compliant') in conducting its activities. It will also serve to highlight the Company's commitment to the Compliance Program, as any discussion of the effectiveness of a Compliance Program involves evaluating the existence, level of formalization, quality and scope of policies and procedures related to the Program.

INTERNAL CONTROLS

Internal controls are mechanisms, generally formalized in writing in the Company's policies and procedures, which, in addition to minimizing operational and compliance risks, ensure that the accounting and financial books and records fully and accurately reflect the company's business and operations as required. various instruments, such as the FCPA and the Sarabannes-Oxley Act. Among other things, internal controls set the rules for review and approval of activities (especially those related to contractual commitments and expenses), existence of activities (to avoid payments for services not provided, for example), supporting documentation, processing and registration. of transactions.
Internal controls can be considered efficient and effective if senior management has reasonable assurance that:
- The Company's operations objectives are being achieved (operations objectives);
Publicadas Published financial statements are reliably prepared (financial reporting objectives); and
Aplicáveis ​​Applicable laws and regulations are being complied with (compliance objective).

TRAINING AND COMMUNICATION

After our identification of the risks, the definition of those responsible for the Program and the elaboration of the Code of Conduct and the Compliance policies, it is of utmost importance that all this be properly communicated to the rest of the Company. Each employee of the Maringá Regional Airport conglomerate, regardless of their position, must understand the objectives of the Compliance Program, the rules and, perhaps most importantly, their role in ensuring the success of the Program. There are several ways to conduct training and communications (face-to-face, concentrated or in-pill, conducted by internal or external professionals), each with its pros and cons, costs, ease of access and understanding. It is important for the Compliance Program Officer to strike a balance between cost and benefit.

Training Objectives within the Compliance Program:

- Dissemination of values, rules, policies and procedures on ethical and fair conduct in business; and
- Use of various education and awareness mechanisms such as online resources, lectures, workshops, learning assessments and certifications;

THIRD PARTY MANAGEMENT

The Company conducts business through service providers and / or partners and adopts a robust Due Diligence process (or pre-engagement assessment) protecting the Company's reputation and broadly assimilating the corporate structure and financial condition of the third party, as well as surveying labor, tax, environmental, potential agents and other business partners to ascertain whether they have unethical business practices, or otherwise expose us to unacceptable business or legal risks.

CHANNEL OF COMPLAINTS

"Reporting Channel" communication channels provide employees and business partners with a means of alerting the Company to potential violations of the Code of Conduct, other policies, or even misconduct by employees or third parties acting on behalf of the Company. Company. In addition to being required by regulators for the Companies to implement this type of communication channel, where employees or business partners may contact us to report their concerns and reports confidentially and anonymously, and within the terms of local law, this type Channel scamming is the main source of fraud identification. In addition, those employees who want to do the right thing and are seeing something wrong happening need to have a secure channel to communicate their concerns to the Company.

INTERNAL RESEARCH

The Company has internal processes that allow investigations to promptly address reports of unlawful or unethical behavior. Such processes ensure that the facts are verified, responsibilities are identified and, where necessary, define the most appropriate and consistent sanctions (disciplinary measures, for example) and corrective actions to be applied, regardless of the level of agent, manager or employee who provides them. caused.
Effective investigation protects the interests of the Company and its shareholders through the prevention and detection of misconduct, a reasonable assurance that the Company's activities are in compliance with applicable laws and regulations, and also by identifying areas for improvement. internal operations. It also demonstrates the Company's commitment to doing the right thing and punishing those who do not share the same ethical values ​​as it.
Maringá Regional Airport does not allow or tolerate any retaliation against employees, suppliers and customers who, in good faith, report communication on the Reporting Channel.

MONITORING AND AUDIT

The solid Compliance Program is measured by its effectiveness and to know if the Compliance Program is heading in the right direction, it is necessary to implement a constant evaluation process, called monitoring, as well as regular audits, which aim to identify if the various pillars of the Program Compliance policies are working as planned if the expected effects of employee awareness are materializing within the Company and if the previously identified risks are being controlled as anticipated (and also if new risks have arisen in the course of operations).