Organisational structure of the risk management and internal control framework
The risk management and internal control framework is a set of organisational measures, methods, practices and standards of corporate culture. It also embraces actions taken by the Company to strike the right balance between value growth, profitability and risks, support sustainable development, and ensure efficient operations, protection of its assets, compliance with applicable laws and internal documents, along with timely and accurate reporting.
The Board of Directors defines the key principles of, and approaches to, risk management and internal controls, oversees the Company’s executive bodies, and performs other key functions, including setting the overall risk appetite and reviewing material risks and ways to manage them.
The Board’s Audit Committee focuses on assessing and making proposals to improve the risk management and internal controls. On top of that, its members supervise the preparation of accounting (financial) statements and the measures taken to prevent fraudulent behaviour of the Company’s employees or third parties.
The Review Committee elected by the General Meeting of Shareholders exercises control over the financial and business operations of the Company.The General Shareholders’ Meeting held in May 2025 elected the following members to the Review Committee:
Lusine Agabekyan, Deputy Head of Group Financial Control and Management Reporting at PhosAgro;
Ekaterina Viktorova, Deputy Head of Treasury at PhosAgro;
Olga Lizunova, head of unit (functional in other areas), budgeting office, Economics Department at Apatit.
The Review Committee’s goals, objectives and powers are outlined in the Regulations on the Review Committee of PhosAgro as approved by the General Meeting of Shareholders on 12 May 2011.
The Committee endorsed PhosAgro’s financial statements for 2025, with its report dated 10 March 2026 included in the materials for the shareholders to prepare for the Annual General Meeting of Shareholders.
For the full text of PhosAgro’s Regulations on Review Committee, please visit our website
The executive bodies establish and maintain an efficient risk management and internal control framework. To this effect, they have set up a Risk Commission that monitors the status and effectiveness of risk management initiatives. The monitoring results serve as a basis for the relevant proposals issued by the Commission to executive bodies and the Board of Directors.
Following the audits, the Internal Audit Department provides the Board of Directors and executive bodies with recommendations and reports, including, among other things, the assessment of the current status, reliability and effectiveness of the corporate governance, risk management and internal control framework.
The Risk Management and Internal Control Department is charged with the general supervision of risk management, including related activities, and consolidated reporting to the executive bodies and the Board of Directors.
As part of their duties, heads of other organisational units are responsible for building, documenting, implementing, monitoring and developing the risk management and internal control framework in their respective functional areas. The framework requires the Company’s employees to identify and assess relevant risks and efficiently implement the controls and risk management initiatives.
For the full text of PhosAgro’s Regulations on Review Committee, please visit our website
Risk management
In 2025, PhosAgro’s risk management and internal control framework performed strongly thanks to timely identification and assessment of risks, as well as development and implementation of risk management measures. On a quarterly basis, the Board of Directors reviewed reports on the management of PhosAgro’s key risks. PhosAgro’s executives paid special attention to managing these key risks. The Risk Commission continuously monitored the status of risk management activities and, when necessary, initiated changes to improve those related to key risks.
Development of the risk management and internal control framework in 2025
The Company is making a consistent effort to develop its risk management and internal control framework.
The reporting year saw both the production sites and PhosAgro Group as a whole complete a full‑year cycle of risk management and internal control, including:
ongoing risk monitoring;
analysis of key risk indicators;
development of corrective actions;
follow‑up control and review.
In 2025, the Company sustained its focus on addressing risks across certain business areas, including the continuity of procurement, logistics, and software and IT infrastructure operation, in response to geopolitical developments. Particular attention was given to securing uninterrupted raw material supplies in the face of supplier disruptions caused by external threats.
Work to automate the risk management and internal control framework also progressed, with further advances in AI‑driven initiatives and the roll‑out of a risk‑based approach across individual functions and business units.
Assessment of the risk management and internal control framework
In April 2026, the Board of Directors reviewed the results of the framework’s assessment, which showed that it was on par with those adopted by the industry’s leading companies, including:
compliance with applicable regulatory requirements;
adoption of most of the leading risk management practices such as alignment with the Company’s development strategy, risk appetite, key risk indicators, automation and robotisation in risk management, as well as integration into the Company’s incentive system and governance framework.
PhosAgro Group looks to maintain and further develop the existing elements of its risk management framework based on best practices, while also taking into account the changing external and internal factors.
PhosAgro’s Internal Audit Department assists the Company’s governance bodies in improving the management of business processes and enhancing the risk management and internal control framework. In doing this, it uses a risk‑oriented approach and works closely with the Risk Management, Internal Control and Economic Security Departments, and the Company management.
Internal audit goals, objectives and powers are outlined in the Internal Audit Policy as approved by the Board of Directors on 18 May 2021 (for the full text of the document, please visit our website
The Company’s internal audit procedure is defined by the Internal Audit Department’s management.
Audits
Audit of business processes
The audit plan for the calendar year is subject to review, discussion and approval by the Audit Committee and the Board of Directors. Audits are performed at the Company level, as well as at specific subsidiaries and their standalone business units. In addition, the Internal Audit Department monitors the effectiveness and efficiency of corrective actions taken by the management following the audit, and reports to the Audit Committee on a quarterly basis and to the Board of Directors annually.
In 2025, the Internal Audit Department fully completed its annual action plan. Audits of PhosAgro Group’s business processes were conducted in areas including production capacity expansion, repairs, and corporate governance. An IT audit of the automatic control system was also carried out. Based on the audit findings, recommendations were made to improve the efficiency of control procedures and enhance approaches to managing investments, repairs, and IT. The management developed and approved corrective action plans, with the progress monitored by the Internal Audit Department.
The 2026 audit plan includes reviews of procurement processes for goods, materials, and equipment, as well as an analysis of repairs efficiency.
Team development
In order to achieve the strategic goals in internal audit, we continue working to develop and diversify the competencies of our team by holding regular training sessions, which focus on sourcing data from information systems and further processing and visualising it. Training initiatives addressing this focus area are scheduled for 2026.
The team’s professionalism has been recognised through invitations to join the expert council of the Auditor of the Year national competition and to assist in drafting the Preliminary National Standard on Internal Audit, which took effect in March 2026.
Self‑assessment and external assessment
The internal audit quality is assured through regular external independent assessments and self‑assessments. The Board of Directors and the Company’s management gave a positive assessment of the Internal Audit Department’s performance in 2025.
External audit
For the full text of the External Auditor Selection and Cooperation Policy of PhosAgro, please visit our website
For more information on the auditors, their selection procedure and independence evaluation, see the Company’s semi‑annual reports, as well as the respective sections of this Report that discusses the Audit Committee’s activities and the Remuneration Report
A key element of the Audit Committee’s operations is ongoing interaction with external auditors and development of recommendations for the Board of Directors regarding the choice and approval of auditors. When selecting an auditor, we evaluate the following factors in addition to the cost of their services:
composition of the audit team (in terms of experience and qualifications), which should ensure that the statements are audited within acceptable deadlines and with adequate quality;
the auditor’s independence evaluated based on a variety of factors, including assessment of the scope of non‑audit services provided to us by the candidate company during the relevant periods. Each offer from the current auditor for non‑audit services requires confirmation by the audit partner to make sure there is no risk to independence and is submitted to the Company’s Audit Committee for consideration and approval. The Committee consents to the contract only if the scope of the non‑audit services does not call into question the ability to perform the audit service independently and impartially. The Committee’s assessment of the auditor’s independence is also significantly influenced by the auditor’s internal procedures for controlling the impartiality and professional ethics of the auditor’s staff, including requirements for periodic rotation of the audit partner, training arranged in this area and the use of specialised software to perform the respective audits;
balance between the benefits of long‑term cooperation with the auditor and the need for a fresh look at the Company’s financial statements and preparation procedures;
the auditor’s performance over the previous period. The Committee may form its opinion on the quality of the external auditor’s work during in‑person Committee meetings, where the external auditor’s mandatory participants are a manager and a partner, as well as during meetings between the audit team and the Chairman of the Audit Committee held prior to the Committee meetings.
PhosAgro’s auditors perform an independent audit the Company’s financial and business operations in compliance with Russian laws and the agreements signed with the Company. The audit of PhosAgro’s 2025 consolidated financial statements under IFRS was conducted by Technologies of Trust – Audit (14/3 Krzhizhanovsky Street, bldg. 5/1, Moscow, Russia). The audit of PhosAgro’s 2025 financial statements under RAS was conducted by Unicon (8 Preobrazhenskaya Ploshchad, Preo 8 Business Centre, Moscow, Russia). The auditor for the financial statements under RAS is approved annually by the General Meeting of Shareholders.
The approach to assessing the independence and effectiveness of the external audit process, as well as the appointment or reappointment of the external auditor, is comprehensively described in PhosAgro’s External Auditor Selection and Cooperation Policy approved by a resolution of PhosAgro’s Board of Directors of 30 August 2023.
For the reporting year, the Audit Committee of the Board of Directors rated highly both the audit of the Company’s financial statements under RAS, conducted by Unicon, and the audit of the Company’s consolidated financial statements under IFRS, conducted by Technologies of Trust – Audit.
For the full text of the External Auditor Selection and Cooperation Policy of PhosAgro, please visit our website
For more information on the auditors, their selection procedure and independence evaluation, see the Company’s semi‑annual reports, as well as the respective sections of this Report that discusses the Audit Committee’s activities and the Remuneration Report
Insider information
For the full text of the Insider Information Regulations, please visit our website
The list of insider information is available on our website
PhosAgro has adopted an Insider Information Regulations compliant with the Russian laws and the EU Market Abuse Regulation (MAR).
In accordance with its provisions, the Corporate Secretary’s office keeps a list of insiders, persons discharging managerial responsibilities (PDMR) and persons closely associated with them (PCA). The Regulations define the scope of responsibilities for each insider group, of which the Corporate Secretary Office notifies them upon inclusion in the lists and subsequently on an annual basis.
First and foremost, these include the limitations on the use of insider information and trading in the Company’s securities. Depending on the group, an insider may be prohibited from such transactions or obliged to notify the Company or obtain its consent for such transactions. Every quarter, the Corporate Secretary Office checks the list of shareholders to identify transactions that may have been executed in breach of such limitations.
In 2025, PhosAgro implemented the Moscow Exchange’s Insider Transaction Control solution to enhance insider transaction oversight and reduce human error. This tool provides the Company with data on exchange‑traded transactions carried out by individuals on the insider lists it submits.
For the full text of the Insider Information Regulations, please visit our website
The list of insider information is available on our website
Information security
For the full text of the Information Security Policy, please our
website
GRI 3‑3
The Information Security Policy is the Company’s fundamental document defining the general provisions and principles for ensuring information security. Its adoption ensues from the risks and hazards faced by the Group companies in their operations and the respective need to respond to the hazards and minimise the risks.
For the full text of the Information Security Policy, please our website
The Policy states high priority of information security activities and sets up its key principles. They cover the target setting and planning of information security activities, as well as their implementation, quality management and process improvement. The above principles define the contents of the lower‑level documents such as the Information Security Framework and other internal documents covering respective issues. This set of documents reflects modern solutions and best practices in information security.
Information security issues are submitted for consideration by the Board of Directors every six months.
2025 results
Around 3.1 million events recorded, over 900 security incidents prevented.
16 technical security controls monitored and maintained.
Employee awareness boosted through workforce meetings and around 100 articles published in corporate print and electronic media.
Around 16,000 employees trained and tested via the corporate platform; 22 security information materials developed.
Processes enhanced to ensure alignment with legal requirements: 257 internal regulations and executive documents issued or updated and compliance measures implemented.
Automated process control system security improved via drills for personnel in charge of system operation and maintenance and procurement of information security solutions for new and upgraded facilities.
Information security event and incident management processes enhanced, with the number of threat detection rules increased 2.4‑fold based on current threat intelligence.
Security testing of the Group’s information resources conducted, with action plans to enhance security safeguards put in place.
65 fraudulent IT resources offering fake commercial offers or attempting other malicious actions on behalf of the Group identified and blocked.
Drills on rapid response to critical information security incidents in the IT infrastructure carried out.
All employees of the Economic Security Department receive training in terrorism prevention and the main goals and principles of PhosAgro Group Code of Ethics.
Stakeholder engagement in information security
Ensuring information security is the responsibility of each employee. To this end, the Group regularly holds events to raise employee awareness of information security issues and develop practical skills to deal with modern threats.
In 2025, drills on responding to computer incidents were conducted for production staff, employees in charge of the automated process control system, and corporate network IT personnel. These drills covered the full response cycle: forming incident response teams, logging and recording incidents, investigating and responding, analysing and enriching incident data, closing incidents, and implementing additional measures. Assessment scales were developed for the drills, with each drill receiving a score and a recorded list of violations.
The counterparties of the Group companies that are engaged in an electronic information exchange and whose employees have access to the Group’s internal information resources contribute to information security. Dedicated regulations apply to interactions with external parties, and contracts contain provisions on personal data processing, confidential information, and penalties in case of violations. Counterparty employees take part in training, testing and drills in information security.
Today information protection goes beyond workplaces. The Group pays special attention to creating a stable social environment in the cities of operations, and works with local residents to enhance information security and cyber hygiene. To that effect, we conduct regular classes and interactive events for school students of various ages and their parents, organise lectures for regional administrations, teachers and non‑governmental organisations, and publish articles in corporate and local media.
Thanks to these efforts, combined with the use of modern information security tools and well‑coordinated work of the department, the Group avoided any information security incidents in 2025, as in previous years, including any breaches involving the leakage of confidential data or personal information that could have caused tangible financial or reputational damage.
Personal data protection
PhosAgro Group places particular emphasis on protecting personal data, including that of consumers and suppliers. The Company has implemented layered, comprehensive protection using modern intrusion detection and prevention technologies, as well as systems for identifying suspicious and malicious activity. A data leak prevention system for confidential information and personal data has been deployed, along with other technical measures. Internal regulations are in place, and information security processes have been formalised. Security levels are regularly tested.
Employee awareness and training are ensured, including on the content of the Company’s local regulations and Russian laws. Heads of business units are assigned responsibility for ensuring that employees comply with these requirements. Training materials on personal data protection have been developed, and on‑site training is provided.
The Company runs 24/7 information security incident monitoring.
In 2025, no incidents involving the leakage of confidential data, including personal data, were identified.
In 2024–2025, a full inventory of personal data processing activities was carried out, with updates made to the categories and volumes of data processed. The Company’s internal regulations were updated, including the Policy on Personal Data Processing of and Implemented Personal Data Protection Requirements, and the Regulations on Personal Data Processing and Security. А notification of changes to the Personal Data Operator Register was prepared and submitted to the Federal Service for Supervision of Communications, Information Technology, and Mass Media in a timely manner.