· of a quality evaluation program executed by independent evaluators from the institute of...

MESSAGE

SIGNIFICANT EVENTS IN 2015

SUMMARY OF PERFORMANCE INDICATORS

ACTIVITIES UNDERTAKEN IN 2015

INTERNAL AUDIT

WORK CONDUCTED IN ALL AREAS

INTERNAL QUALITY INDICATORS

SYSTEM OF INTERNAL CONTROL OVER FINANCIAL REPORTING (SCIRF)

COMPLIANCE

OTHER ACTIVITIES AND PROJECTS

HUMAN RESOURCES

NUMBER OF EMPLOYEES

VOCATIONAL TRAINING

OUTLOOK FOR 2016

INTERNAL AUDIT


COMPLIANCE

OTHER ACTIVITIES

09

15

21

27

27

29

29

31

32

37

38

45

45

46

46

index

INTERNAL AUDIT REPORT 2015

9

EDP · 2015 ACTIVITY REPORT OF THE INTERNAL AUDIT DIVISION

ENERGY WITH INTELLIGENCE

We would like to share the most relevant happenings of 2015 within the scope of the completion of the audit plan, projects and complementary activities, from the Internal Audit Division of EDP Group.

We begin by highlighting the renewal of the Quality Assessment Certification in Portugal, Spain, EDP Renewables and, for the first time, the Quality Assessment Certification in EDP Brazil. This certification was obtained as a result of a quality evaluation program executed by independent evaluators from the Institute of Internal Auditors in Spain and Brazil, applying the global methodology of the Institute of Internal Auditors of the United States (Global IIA).

We would like to highlight the Compliance project, which covers all geographies and activities, the objective of which is to define models that will allow the effective and efficient management of ever-increasing legal and regulatory requirements affected by ever-changing standards, regulation and diverse regulators.

The results of this project are the starting point for the development of the Compliance function and for the implementation of a Global Program in EDP Group.

Within the scope of the planned activities of IA, the annual plan for operational, financial, regulatory and IT audits, prepared based on requests from the Audit Committee (CMF/CAUD), Executive Board of Directors (CAE), Board of Directors (CA) Business Units (BUs) and Organizational Units (OUs), and also on proposals from the Internal Audit Department according to the business analysis processes and its perception of the most relevant risks, has been successfully completed, though it is still possible some additional projects may be completed.

The work inherent to the maintenance, monitoring and evaluation of the SCIRF took place according to the expected plan. The External Auditor (EA) issued independent reports without qualification or emphases for the Internal Control System on the consolidated financial report of the Group and its subsidiaries EDP Spain, EDP Renewables and EDP Brazil, with reference to the period ended December 31, 2015.

Regarding development and maintenance of the tools which support audit activities, continuous auditing programs were reinforced. The TeamMate migration project was also completed.

The “Tone at the Top” project, developed by the Office of the Ethics Ombudsman, through which the Office aims to reinforce the ethical behavior of the Group, was attended by some employees.

The “Parte de Nós” (Part of Us) program, under the Group’s Volunteering Program, attracted the attention of a large number of employees, who committed in a genuine, kind and solidary way to provide moments of joy and comfort to those in need.

We would like to thank our employees, supervisors, customers, service providers and all of our business partners for their collaboration, professionalism and availability in helping us perform our work.

01 MESSAGE

10



SIGNIFICANT EVENTS IN 2015

15

02. significant events in 2015


15

EDP · 2015 ACTIVITY REPORT OF THE

INTERNAL AUDIT DIVISION ENERGY WITH INTELLIGENCE

1. JANUARY

Approval of 2015 Audit Plan by the CMF/CAUD and CAE; Presentation of final conclusions of the 2014 SCIRF evaluation to OUs and BUs.

2. FEBRUARY

Presentation to the supervisors, CAE and CMF/CAUD of the 2014 SCIRF final conclusions report.

3. MARCH

Issue of the 2014 SCIRF independent evaluation reports, for the consolidated accounts and stand-alone accounts for EDP Spain, EDP Renewables and EDP Brazil;

Initial meetings for the 2015 SCIRF evaluation cycle with OUs and BUs; Approval and launch of the Compliance function project, with the collaboration and support of external

specialists.

4. APRIL

Nomination of the new CMF/CAUD and definition of the respective working model to develop with the Internal Audit Division.

5. MAY

Conclusion of the 2015 SCIRF scoping exercise; Kickoff of 2015 SCIRF evaluation by the EA; Kickoff of the Compliance project.

6. JUNE

Tone at the Top Workshop – collaboration with and participation in ÉTICAEDP;

Beginning of 2015 SCIRF cycle testing;

Creation of Compliance area on intranet.

7. JULY

Online survey about Compliance completed in Portugal, Spain and EDP Renewables.

02 SIGNIFICANT EVENTS IN 2015

16



8. SEPTEMBER

Beginning of the preparation of the 2016 Audit Plan; EDP Group’s Annual Internal Audit Conference, which took place in Évora, Portugal; Beginning of the Institute of Internal Auditors work, which was responsible for performing the Quality

Assessment of the Internal Audit function in EDP Group in Portugal, EDP Spain and EDP Renewables, with the objective of renewing the certification obtained in 2010.

9. OCTOBER

Beginning of the work by the Institute of Internal Auditors team that was responsible for performing the Quality Assessment for the Internal Audit function in EDP Brazil for the first time;

Kickoff of the Board Members Code of Conduct project; Launch of Self-Certification of 2015 SCIRF; Completion of workshops to analyze Compliance practices in all the main geographies/companies of EDP

Group.

10. NOVEMBER

Attainment of the Certification issued by the Institute of Internal Auditors which ensures the compliance of the Internal Audit Department of EDP Group with the international standards for the professional practice of Internal Audit, with the highest qualification given by the Institute.

11. DECEMBER

Participation in “Parte de Nós” (Part of Us) volunteering project; Conclusion of the 2016 Audit Plan; Completion of phases I and II of the Compliance function structuring project: Analysis of risks and Group

Compliance practices; Proposal of the definition for the organizational model of the function.

SUMMARY OF PERFORMANCE INDICATORS

21

03. summary of performance indicators


21



HUMAN RESOURCES

41 AVERAGE AGE

17 AVERAGE YEARS OF WORK EXPERIENCE

47 HOURS OF TRAINING PER AUDITOR

ACTIVITY

139 Nº OF AUDIT REPORTS COMPLETED (EXCEPT SCIRF)

106 % AUDITS COMPLETED VS PLANNED

691 Nº OF RECOMMENDATIONS (EXCEPT SCIRF)

4.240 Nº OF SCIRF CONTROLS

QUALITY/EFFICACY

4,6 DEGREE OF SATISFACTION (QUESTIONNAIRES)*

(*) Scale 1 (lowest) to 5 (highest).

03 SUMMARY OF PERFORMANCE INDICATORS

22



INTERNAL AUDIT

WORK CONDUCTED IN ALL AREAS

INTERNAL QUALITY INDICATORS


COMPLIANCE

OTHER ACTIVITIES AND PROJECTS

27

27

29

29

31

32

04. activities undertaken in 2015


27



4.1. INTERNAL AUDIT The most important activities undertaken during 2015 were:

Completion of the Quality Assessment of the Internal Audit function of EDP Group by the Institute of Internal Auditors between September and November of 2015, which resulted in the renewal of the certification obtained in 2010 in EDP Portugal, EDP Spain and EDP Renewables and, for the first time, the attainment of the certification in EDP Brazil. This certification demonstrates that the Group’s Internal Audit function complies with the International Standards for the Professional Practice of Internal Audit (the highest score given by the Institute was obtained), and that it performs its mission efficiently.

Completion, within Iberian geographies, of a project to analyze pending internal audit recommendations of a certain age, in order to identify and resolve, in collaboration with the business owners responsible for their implementation, the constraints that impede implementation. This analysis complemented the quarterly monitoring of the extent of implementation of audit recommendations as reported by business owners, and the audit of recommendations reported as completed in the quarterly follow-up (follow-up work);

Consolidation of the administration of the activities of audit teams in Oviedo (HC Energia) and Bilbao (Naturgás Energía), taking into consideration the careful integration of activities, processes and areas of both companies that constitute EDP Spain.

4.2. WORK CONDUCTED IN ALL AREAS The activities planned/carried out in 2015 are outlined in the following table:

TYPE OF WORK PLAN OUTSIDE OF PLAN

TOTAL ONGOING

Reliability of Financial Information 8 1 9 1

Operational Efficacy and Efficiency and

Compliance 59 14 73 12

Information Systems 7 3 10 1

Continuous Auditing 8 8 1

Follow Up 24 3 27 1

Code of Ethics Communication Channel 12 12 1

Total 106 33 139 17

ACTIVITIES UNDERTAKEN IN 2015 04

28



76% of the work was scheduled in

the plan

24% was non-programmed work

During 2015, 139 audit projects were completed, resulting in the issuance of 691 recommendations. These recommendations gave rise to implementation plans defined by the affected areas and are monitored quarterly by the DAI.

The classifications of the recommendations issued in 2015 are summarized in the table and graph below:

TYPE OF RECOMMENDATIONS 2015

Compliance with Internal Policies and Standards 100

Efficacy and Efficiency of Operations 487

Reliability and Integrity of Financial Information 49

Safety and Security 4

Compliance with Legislation and Legal Standards 24

Applications 13

Patrimony Integrity 7

Service Management 7

Total 691

76%

24%

2015

PLAN

OUTSIDE OF

PLAN

14%

71%

7%1%

3%

2%

1% 1%

Compliance with Internal Policies and Standards

Efficacy and Efficiency of Operations

Reliability and Integrity of Financial Information

Safety and Security

Compliance with Legislation and Legal Standards

Applications

Patrimony Integrity

Service Management

29



4.3. INTERNAL QUALITY INDICATORS As set out in the Group’s Internal Audit Manual, completed engagements underwent a quality assessment in the form of a survey filled in by the company or area audited. The results of the surveys for each audited area, available by the year’s end, are summarized in the graph below:

4.4. SYSTEM OF INTERNAL CONTROL OVER

FINANCIAL REPORTING (SCIRF)

The EDP Group management has integrated in its management the system of internal control over financial reporting (SCIRF), based on criteria established by the regulatory framework of internal control issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO 2013), as well as the business processes and entity level controls, and Control Objectives for Information and Related Technologies (COBIT) with respect to the General Information Technology Controls. The 2015 accounting year’s control structure was evaluated by the External Auditor, in all geographies where the Group has presence and that are in the scope model, and for which it was possible to guarantee, with a certain level of assurance, the mitigation of fraud risk, the reliability of financial information and the quality of preparation the financial statements. As a result of this evaluation, for the fourth consecutive year, the EA issued four independent reports: Consolidated EDP Group and Stand Alone for subsidiaries EDP Spain, EDP Renewables and EDP Brazil.

4,2

4,6

4,8

Reliability o

f

Fin

ancia

l

Info

rmation

Opera

tional

effic

acy a

nd

effic

iency a

nd

Com

pliance

Info

rmation

syste

ms

30



4.4.1. Presentation of the EDP Group 2015 SCIRF

According to the adopted methodology and the approved responsibility model, the activities inherent to the evolution, monitoring and maintenance of the system were performed during the year, within the scope of authority of the business owners who participate at the corporate level, the BUs and OUs.

Relative to the system evolution activities, the harmonization and uniformity, between the geographies, of a selected set of entity level controls, stands out, as well as the issuance, for the first time, of the entity level control certificates for the Corporative Center and for the Information Technology General Controls, strengthening the control environment and the corresponding accountability at different levels of the hierarchy.

In accordance with the approved work methodology, the following activities were completed:

Definition of the 2015 SCIRF scope based on the Financial Statements as of December 31st, 2015 (Consolidated and Stand Alone) and identification of the themes to be incorporated in the risk analysis, according to the Group’s defined model on materiality criteria;

Updated and validated the 2014 SCIRF evaluation results, in the supporting computer systems;

Documentation / revision of new controls and redesign of existing ones;

Support and accompaniment of the 2015 SCIRF evaluation cycle organized by the EA;

Launch and support of the 2015 SCIRF self-certification process, by which the CAE, represented by the CEO and the CFO, issue a responsibility report on the assurance level and reliability of the preparation and presentation of the Financial Statements;

Completion of the self-evaluation process whereby the CMF/CAUD issue an opinion on the conclusions of the self-assessment and performance of the Internal Audit department;

Completion of the quarterly report monitoring the degree of resolution of Non-Compliances, as well as preparation of monitoring and accompaniment reports, which are reported to the supervision entities CMF/CAUD, CAE and local SCIRF business owners;

Monitoring and accompaniment of ISAE 3402 report, concerning IT service providers.

31



4.4.2. Other activities arising from the SCIRF maintenance

work

Implementation of a set of best practices identified on the basis of the criteria established by the internal control framework issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO 2013);

Harmonization and uniformity of a selected set of entity level controls as the result of the COSO 2013 work performed;

Change of the global controls and IT general controls certification models.

4.5. COMPLIANCE With the primary objectives of assuring effective and efficient management of the legal and regulatory obligations in the countries and businesses of EDP Group, and strengthening corporate governance mechanisms with a global Compliance program lined up with the complexity and size of the group, the CAE considered the creation of a new compliance function at the end of 2014, to be integrated within the DAI.

Thus, after the selection of a specialized external consultant to collaborate with the DAI, the project was kicked off in May with the objective of establishing the function’s structure, by covering the following aspects:

Definition of the scope of the Compliance function;

Definition of the organizational model and governance models for the Compliance function;

Proposal of a global Compliance program;

Definition of an implementation roadmap for Compliance function.

2015 was marked by the realization of this project, through which, between June and October, 95 workshops were completed in Portugal, Spain, Brazil and EDP Renewables (Spain and the United States), with business owners in different BUs and corporate areas (involving more than 200 employees of the group). The project allowed identification and analysis of around 270 regulatory groups with respect to the company’s main obligations, the risks associated with any compliance failure situation, and current management practices in order to assure compliance.

The outcome of the project allowed, by the end of 2015, identification of the issues with the highest associated risk, as well as the definition of a possible model for the Compliance function. The business owners involved in the management of legal and regulatory obligations were involved in and gave input to the articulation of the model.

Simultaneously, awareness initiatives for Compliance matters were launched, such as the creation of the Compliance area on the intranet and the completion of an online survey in Portugal, Spain and United States.

On the other hand, the Compliance area, in collaboration with others, contributed to the development of initiatives that were already underway, namely those related to the “separation of activities” issue in Portugal and Spain, the anti-corruption legislation in Brazil (creation of the Compliance area in EDP Brazil) and the Criminal Liability of Legal Entities in EDP Spain.

Finally, the Compliance area monitored and supported the business units, via the realization of regulatory and environmental external audits (11 regulatory audits and 2 environmental audits), and was involved in follow-up on the implementation plans for recommendations that resulted from some of these audits (namely the Service Quality Regulation and Energy Provider Changing Processes, both of which were for EDP Distribuição).


INTERNAL AUDIT DIVISION ENERGY WITH INTELLIGENCE 32

4.6. OTHER ACTIVITIES AND PROJECTS

Continuation of collaboration, initiated in previous years, with the Group’s companies that are the subject of regulatory external audits (for instance, in the preparation of an audit’s tendering specifications, in the selection of the firms that will perform the audits, in the follow-up of audit results and in the development of any improvement implementation plans);

Collaboration, from a perspective of reinforcing internal controls, in the elaboration of the new OS 6/2015/CAE, which deals with the challenge-and-approval process of investment and disinvestment of projects;

Development of an application which allows auditors to visualize and extract data from EDP Applications in an easy but quite powerful way. This application allows access to SAP, Oracle and SQL Server Data Base and to perform Queries over data. Training was given to auditors in Portugal, EDP Spain and EDP Renewables;

Improvement of the Segregation of Duties incompatibilities selection process of the GACS tool to reduce the number of “false positives,” identifying only the cases in which a real risk exists;

Selection process of a new supporting tool for Internal Control and Compliance;

Collaboration in the process of migration to an updated version of TeamMate, the application which supports audit projects;

Documentation of audit developed applications;

Reformulation of some of the Continuous Monitoring indicators;

Participation in the CIBER PERSEU 2015 exercise, integrating the team that EDP established for this purpose;

Collaboration in the preparation and monitoring of the Tone at the Top workshop, integrated in the ÉTICAEDP program;

Collaboration in a working group to define a Code of Conduct for top management.


INTERNAL AUDIT DIVISION ENERGY WITH INTELLIGENCE 33

NUMBER OF EMPLOYEES

VOCATIONAL TRAINING

37

38

05. human resources


37



5.1. NUMBER OF EMPLOYEES The total number of employees from the several Internal Audit departments of EDP Group, reported as at December 31st, 2015, was 55.

Despite the fact that this number had not changed in the last year, the DAI’s structure underwent some changes, due to:

Internal mobility process of an employee from EDP Portugal to the EDP Renewables audit team;

Admission of two employees for EDP Portugal auditors team, one to replace the employee who went to EDP Renewables, and another to reinforce IT’s team;

In EDP Brazil the exit of three employees stands out, as well as the entry of one new employee.

During 2015, in Portugal, the entry of three new interns must be noted, to give support in the following areas: financial and operational audits, advisory and SCIRF. These interns will have the opportunity to make first contact with the business world, as well as to learn about EDP Group values and the DAI’s methodology.

5.1.1. Admissions

In the following table, the new admissions and their distribution by geography are presented.

GEOGRAPHY EMPLOYEE NAME

EDP Portugal Francisco Carvalho

Luís Torres

EDP Brazil Sérgio Martins

EDP Renewables Isabel Miranda (internal mobility)

5.1.2. Exits

In the following table, the exits and their distribution by geography are presented.

GEOGRAPHY EMPLYEE NAME

EDP Portugal Isabel Miranda (internal mobility)

EDP Brazil

Edneia Neves

Marcelo Santos

Marina Saito

05 HUMAN RESOURCES

38



5.2. VOCATIONAL TRAINING The following table presents a summary of the trainings attended by employees, by training area and subject for all geographies.

7 2 % I n t e r n a l T r a i n i n g

2 8 % E x t e r n a l T r a i n i n g

TRAINING AREA Nº Hours %

Subject

BEHAVIOURAL 188 7

Relationships and

Communication 70

Leadership 44

Ethics 34

Personal Productivity 16

Applied Creativity 24

MANAGEMENT 149 6

Finance 16

Management 40

MBA/Master’s/Post-Graduate

Courses 68

Time Management 16

Legal/Regulation 9

ORGANIZATIONAL 496 19

Executive Development Program 84

Energizing Development

Program 184

Customer EDP 365 8

Work-Life Balance 74

Amplify 69

Host Sessions 39

Interpersonal relations and communication

27

A meeting with … 6

Ethics 3

Environmental 2

TECHNICAL 1.731 68

Energy business 555

Languages 287

Internal Audit 182

Legal/Regulation 178

IPAI/IIA 106

SAP Viewer 87

Information Systems 59

Office 365 46

SIM-PT 30

CIA 27

Technical Business 20

Prevention and Safety 19

Presentation Techniques 16

Audit Sampling 15

Compliance 9

Risk Management 8

Others 88

TOTAL 2.563 100

72%

28%

39



During 2015, the total number of training hours was 2,563, which yields an average number of approximately 47 hours per trainee. Compared to 2014, there was a decrease of 11% in number of training hours, which is in line with the decrease of the Group’s budget for this type of activities.

The trainings completed correspond to the trainings available in the Group’s training solutions catalog, specific trainings provided by external entities and, whenever possible, internal training offerings, which explains the increase observed in the percentage of internal training (72% in 2015, as compared to 66% in 2014).

The Internal Audit department continues to encourage the acquisition of external certifications by its employees, such as the CIA – Certified Internal Auditor (ten employees have obtained their certifications and nine are still in the process of obtaining the certification) and the CISA – Certified Information Systems Auditor (one employee has obtained the certification), as well as complementary academic trainings, such as an MBA - Master Business Administration (six employees have obtained their degree and one employee’s studies are ongoing) and Specializations/Post-graduate studies/Master’s degrees.

40



INTERNAL AUDIT


COMPLIANCE

OTHER ACTIVITIES

45

45

46

46

06. outlook for 2016


45



6.1. INTERNAL AUDIT In addition to work performed regularly, we highlight the following themes from planned 2016 activities:

Identification of external and internal assurance activities completed in the different areas and businesses of the Group, with the objective of deepening Internal Audit’s knowledge of the existing internal control environment, which is key to prioritizing internal audit work;

Review of the contents of the financial reporting risk map, using SCIRF as a supporting tool and prioritizing financial internal audit work;

Increase in the effectiveness and efficiency of DAI’s focus on issuance of those recommendations perceived as being higher priority, and follow-up of those recommendations, distinguishing the most relevant aspects within reports. These recommendations’ resolution will be properly monitored. Other recommendations of lesser importance will be analyzed, and their resolution will be submitted for the consideration of the responsible areas;

Development of a more graphic internal audit report model to facilitate the understanding of the audit results by all recipients, introducing more cohesive messages, supplemented with additional information when necessary.

6.2. SYSTEM OF INTERNAL CONTROL OVER

FINANCIAL REPORTING The contract with the External Auditor, KPMG, remains in effect for 2016, and a methodology similar to that of previous cycles will be used, beginning in May 2016 and concluding in March 2017.

Per planned activities for 2016, we highlight the following themes:

2016 SCIRF cycle management

Definition of the 2016 SCIRF scope based on the Financial Statements as of December 31st, 2015 (Group and Stand Alone) and identification of the themes to incorporate in the Bottom Up risk analysis;

06 OUTLOOK FOR 2016

46



Identification/Redesign of new controls/existing controls, resulting from the scope and/or from procedures, structural and regulatory changes;

Evaluation of 2016 SCIRF cycle by the EA;

Completion of the self-certification process for the 2016 SCIRF cycle;

Quarterly non-compliance resolution monitoring report;

Monitoring of the ISAE 3402 reports issuing process, related to certification of service organizations.

Organization, methods, processes, methodology and supporting tools

Regarding non-recurring activities, it is expected that the year will be marked by the selection, parameterization and implementation of a Governance Risk and Compliance (GRC) tool to support SCIRF and Compliance;

Review of the responsibility model;

Harmonization/unification of EDP Brazil entity level controls.

6.3. COMPLIANCE In the first quarter of 2016 the structuring project will be completed, with the creation and approval of a roadmap which will define the schedule of implementation of the critical activities to fully implement the Compliance function, including:

Definition and implementation of the structural elements for the Compliance Global Program (e.g., policies, standards and procedures);

Promotion of Compliance programs specific for different areas or legal/regulatory themes identified as critical as the result of a risk analysis and current Compliance practices, as per the defined and approved roadmap and scheduling;

Completion of awareness-raising actions in the EDP Group Compliance system (for example, Compliance policies, standards and governance model).

Also in 2016, the Compliance area will continue to provide support to the different business units for regulatory external audits and for the follow-up of audit recommendation implementation plans.

It will also continue to fulfill the role of "internal advisor" for Compliance topics, whether general (methodology, tools, procedures), or specific, namely associated with risk analysis and control documentation.

6.4. OTHER ACTIVITIES In addition to the above activities, the following is also worthy of mention:

Continued tracking of professional internships for graduates as part of the Group's participation in the social responsibility program.

47



48



· of a quality evaluation program executed by independent evaluators from the institute of...

Documents