Financial Information and Risk Management

Under article 199 of the Turkish Commercial Code (Statute 6102), which went into force on 1 July 2012, the Board of Directors of Aksigorta A.Ş. is required, within three months of the end of its fiscal year, to draw up a report about any dealings the Company had with its controlling shareholder or with any affiliates of its controlling shareholder during the fiscal year just ended and to include the conclusions of that report in its annual report. The required statements about Aksigorta A.Ş.’s related-party transactions are presented in footnote 45 to the financial statements.

The conclusion reached in the report dated February 20, 2023 prepared by the Board of Directors of Aksigorta A.Ş. is, to the best of the Board’s knowledge of the circumstances and conditions at the time that a transaction took place or a measure was taken or refrained from, in each and every transaction which Aksigorta A.Ş. entered into with its controlling shareholder or with any of the affiliates of its controlling shareholder during 2022, that an appropriate mutual performance was achieved, that there were no measures taken or refrained from which might have caused the company to suffer a loss, and that there were no such transactions or measures whose consequences need to be offset.

In 2022, Aksigorta earned TL 1,533,681 thousand in net investment income in addition to the earnings generated by its insurance business activities. The Company’s investment income during the most recent two years is shown below.

Based on all of these technical and financial results, Aksigorta booked loss before tax of TL -121 million. The Company’s shareholders’ equity amounted to TL 1,949 million at end-2022. The breakdown of shareholders’ equity items during the most recent two years is shown below:

At end-2022, Aksigorta’s principal investments amounted to TL 3,407 million in value.

Developments in the Company’s investments during the most recent two years are shown below:

Aksigorta does not have affiliates as of the end of 2022.

Quality Policy

As a strong, reputable and trustworthy company together with our agents, employees and suppliers, we are committed to provide quality service and continuous improvement of our services by prioritizing customer satisfaction in line with our vision, mission and values and in conformance with national and international laws, regulations and standards regarding insurance business.

Quality Management System

Aksigorta is committed to providing quality service to all its customers, business partners, stakeholders and employees.

According to this principle, Aksigorta established the quality assurance system and obtained the BS EN ISO 9001:1994 Quality Standard Certificate from BVQI (Bureau Veritas Quality International) in 1998. Quality Assurance System standard has been revised regarding the customer needs and current conditions, and ISO 9001: 2015 Quality Management System has been published in 2015. Aksigorta has aligned its current systems with the up-to-date version.

Aksigorta established ISO 10002: 2015 Customer Complaints Management System and upgraded customer relationship management to international standards’ line which based on customer-oriented service approach.

Risk Management Framework

The Company’s risk management framework includes the strategies, policy models, processes, and reporting procedures required to identify, measure, manage, monitor and report the risks to which the Company is or may be exposed.

It is the responsibility of the Board of Directors to identify the risk management principles and standards to be applied throughout the company, to update the risk policies depending on the changes in the operating conditions, and to establish and operate effective risk management systems and processes. The Board is also ultimately responsible for monitoring the risk level of the Company, controlling the situation against these limits by establishing risk limits, and putting the necessary measures into practice.

The tools required for determining, measuring, managing, monitoring, and reporting of risks vary according to the type of the risk. There are five risk classes: such as Insurance risks, Financial risks, Compliance risks, Operational risks, and Strategic risks.

Aksigorta is exposed to business risk in relation to its operations in the non-life insurance sector. Likewise, the Company also faces financial risks related to its operations, such as loan, market, and liquidity risks. Operational risk arises as a result of human, process, and system errors during the management of other related risks. Strategic risks are associated with changes in strategic planning, sector, competitive environment and technological changes. Sustainability risks are also assessed as strategic risks.

Emerging risks are the result of new trends that may pose a threat or risk to the company. These trends are ambiguous by nature, making it challenging to measure them and perform an impact analysis. The emerging risks inventory is regularly reviewed in light of global and local researches in the insurance industry.

Information on Risk Management Policies by Risk Type

Risk Management Framework Policy

Aksigorta’s risk management strategy, implemented risk management system, and risk governance approach across the Company, as well as the roles and responsibilities for risk management are established in the Risk Management Framework Policy and approved by the Board of Directors.

The basic objectives of this policy are determining the basic principles and standards of the risk management systems and processes, implementing such systems and processes, and complying with the determined risk limits. The Company’s Risk Management Framework Policy defines the risk management roles and responsibilities of the Board of Directors, the Early Detection of Risk Committee under the Board of Directors, and the General Manager. The said policy also explains the role of each level in the triple line of defense model and the functioning of the delegation of authority in Aksigorta.

The activities covered by the Risk Management Framework Policy are carried out within the framework defined by the insurance legislation and the other relevant legislation to which the Company is subject.

Insurance Risk

In any insurance contract, the risk is that one party (the insurer) accepts a significant insurance risk from the other party (the insured) by agreeing to indemnify the insured if a specific uncertain future event (the insured event) negatively affects the insured.

The company has adopted a central risk assessment policy. This policy is carried out within the framework of predetermined activities and limits. In general, the probability of damage occurring is determined during risk assessment by methods of past damage experiences, comparison of similar risks, and process risks within the production process. Location, geographical region, field of activity, and fire and theft measures are the primary criteria considered in risk assessment.

Insurance risks are managed by the company through a policy production strategy, reassurance agreements, and effective liquidation and payment transactions. The policy generation strategy of the Company is based on the most effective risk assessment during policy production, as well as the most accurate distribution of assumed risks based on their types, sizes, industries, and geographical regions.

The Company enters into reassurance contracts for excess of loss, quota share, surplus, and catastrophic guarantees to manage insurance risk. The company has no surplus agreements in the branches of fire, transportation, engineering, and general accidents. Annual quota share contracts with a certain proportional turnover rate are included in the motor, professional liability, electronic devices, machinery breakdown, mandatory bus passenger, cyber risks, credit, political violence, health, and individual accident branches. Also, there are Risk & CAT, Transportation and Optional Financial Liability Non-Proportional Reassurance contracts that protect the net risks our company holds.

Market Risk

The company is generally exposed to interest rate risks as a result of its financial investments, as well as credit risks as a result of insurance receivables.

Changes in market interest rates cause fluctuations in the costs of financial instruments, forcing the company to deal with interest rate risk. The primary risk to which the company’s portfolio’s available-for-sale financial assets are exposed is the damage that will result from a decrease in the actual values of financial assets due to changes in market interest rates.

The Company is exposed to currency risks, which arise from foreign exchange rate changes caused by the conversion of its foreign exchange and foreign exchange indexed assets and liabilities into Turkish Lira.

Market risk components the Company faces, like the interest risk and currency risk, are periodically measured and reported via stress and scenario tests.

Liquidity Risk

Liquidity risk is the likelihood of the company failing to meet its net funding liabilities. Liquidity risk is caused by events that reduce funding resources, such as market disruptions or credit score reductions.

In the event that the Company’s financial resources are insufficient, there is a risk of ceasing current operations or reducing the scope of operations.

The company’s investment strategy approved by the Board of Directors has been established considering the liquidity conditions of the Company and the band widths (lower and upper limits) movable during the management of assets for investment and asset management and especially taking into account the potential liquidity profile of the liabilities. The liquidity risk management contains an approved limit structure and a series of triggering arrangements which provide that management is informed about potential problems.

Credit Risk

Credit risk arises from the counterparty failing to meet its obligations under the contracts to which the company is a party. Limits and guarantees are determined by evaluating criteria such as financial strength and business capabilities of related parties. The Company’s credit risk is arises from insurance activities such as: the investment activities in banks and finance corporations, bond market investments, and receivables from agencies, insured customers, and reinsurance companies. Credit risk is managed with the credit risk rating and limit framework defined for the Company and organizations involved in the transactions made as counterparty.

Capital Management

The primary goal of Capital Management is optimizing the company’s capital structure, composition, and distribution, as well as protecting its financial capacity and productivity. The Capital Management Policy has been established and approved by the Board of Directors to define the roles and responsibilities, capital risk appetite, and reporting requirements in order to achieve the goals set.

Operational Risk

Operational risk is the loss that may arise due to uncontrolled business processes, human or system errors or external factors. It is essential to evaluate the probability of the operational risks and the level of impact they will create, and take the necessary measures accordingly. In the first line of defense, it is aimed to manage operational risk by effective follow-up and monitoring of the processes. Efficiency and adequacy of controls and implementation of action plans are primarily the responsibility of the first line of defense and are monitored and reported by the Internal Control, Risk Management and Compliance Directorate. Aksigorta’s target is to keep the operational risk at the lowest level that is commercially reasonable.

Information on Risk Management and Internal Control System

As per the Law on Insurance No 5684, Article 4 and the Regulation on Internal Systems in Insurance and Private Pension Industries, insurance companies must set up an effective internal control system to ensure that the company’s assets are protected; that its activities are conducted in accordance with the requirements of the Law and related other legislation, with in-company policies and with established insurance industry practices; and in such a way as to be both effective and productive; and that the accounting and financial reporting system as well as all systems used in the provision of the main services are secure, coherent, and capable of providing timely access to information.

Risk management is the Company’s main means of avoiding undesirable outcomes in the pursuit of its targets and ensuring the continuity of its activities. The Risk Management Department’s functions are to identify, measure and monitor the risks to which the Company is exposed, to ensure that actions are taken to keep the risks within the limits determined as per the risk appetite and report such actions. Within this scope, it ensures that the business decisions are taken in a risk-based approach and the resources are used efficiently so that the expectations of the entire Company and its business partners, including customers and shareholders, are met at the highest level.

The general risk level to be assumed for each type of risk, as well as the maximum risk limits allocated to management and their implementation procedures are specified in the policies which have been approved by the Board of Directors.

In order to monitor incurred risks and to provide control, the Company established and operates a structure of internal systems complying to the scope of its activities as specified by the legislation. In this approach, dubbed “the triple defense line,” the division of authority and responsibility is as follows:

Line of Defense Officials, Authorities and Duties

1. Line of Defense: Company Management

Identifying, assessing, managing and reporting risks in an effective and risk-oriented manner, and ensuring compliance with company policies. Establishing and maintaining an effective internal control system

2. Line of Defense: Risk Management, Internal Control and Compliance Directorate

Supporting the Company management in identifying, assessing, managing and reporting risks, overseeing compliance with Company policies and correcting any noncompliance; in short, assisting in the functioning of Aksigorta’s Risk Management Framework. Providing an acceptable assurance regarding the following subjects: Company assets are protected with internal control structure; its activities are carried out effectively, efficiently and in compliance with laws and other relevant legislation, in-house policies and rules of the Company, insurance business customs; the accounting and financial reporting systems are functioning reliably; the integrity of all systems used in the provision of services, and timely irretrievability of the information.

3. Line of Defense: Internal Audit Directorate

Assuring the Board of Directors about the effectiveness of the Company’s risk management and internal control mechanism from an impartial and independent viewpoint.

Risk Management, Internal Control and Compliance Directorate

The Risk Management, Internal Control and Compliance Directorate activities are carried out as per the “Regulation on Internal Systems in Insurance and Private Pension Industries.” According to the regulation, as of April 2022, Aksigorta and AgeSA’s Risk Management, Internal Control and Actuarial Supervision activities are carried out jointly.

It is aimed to provide assurance to the Board of Directors through risk management and internal control activities on:

• Ensuring compliance with legal obligations and the Company’s risk management policies and risk appetite limits,
• Establishment and effective operation of a control framework in order to identify all structural risks exposed and to ensure that risks are managed within specified tolerance limits,
• Designing and implementing actions to take risks within tolerance limits and reporting these risks transparently.

The reports which include the risk monitoring, assessment, management activities, and internal control activities are submitted to the Board of Directors and the Early Detection of Risk Committee regularly.

Internal Control and Risk Management Group Directorate

Internal control activities are primarily the responsibility of the business units that perform them. A Internal Control Unit has been commissioned for supporting business units in the design of the processes carried out or controls used by these units, evaluating the adequacy, effectiveness and compliance of said processes and controls together with these units, and monitoring the internal control functionality of the company.

The Risk Management unit ensures that potential risks are defined, assessed, and managed in a timely manner. The activities of the Internal Control and Risk Management units include managing all risks associated with the Company, affiliates subject to consolidation, as well as service providers and agencies.

The Internal Control and Risk Management Group Directorate targets to make contributions under the following categories through its operations:

• Implementation of the risk management framework and risk management policies determined by the Board of Directors,
• Establishing a robust and reliable control framework by creating strong and effective internal control awareness,
• Supporting business units in the design of the controls used in processes carried out by these units, evaluating the adequacy, effectiveness and compliance of said processes and controls together with these units, and controlling whether the internal control function determined in the related regulation have been fulfilled,

The control activities performed by the business units have been supervised within the annual plan, as have activities to improve the company’s existing internal control processes.

As the second line of defense, the determinations made as a result of the supervision of the company’s risk management and internal control activities were regularly reported to the Early Detection of Risk Committee (EDOR) (CRO Report, Internal Control Report, etc.)

The regulation on Internal Systems of Insurance and Private Pension Sectors was published in the Official Gazette dated 25 November 2021 and numbered 31670, to enter into force on the published day. A communique on the application of certain articles of the regulation, in addition to the regulation, was issued on 30.05.2022. Analysis, compliance, and reporting studies were initiated within the scope of the regulation, which includes radical changes in the organizational, managerial and administrative responsibilities of the Internal Systems, which also includes the Internal Control and Risk Management units. The necessary actions have been determined and are being monitored in order to provide full compliance with the regulation.

The first phase of the “Integrated Risk Management Project,” which aims a digital and cultural transformation in Risk Management and Internal Control operations was completed on 18.08.2021. The Project aims to increase risk management competencies and create risk intelligence by combining best industry practices and GRC (Governance, Risk, Compliance) technology. The Company’s risk and control catalog was transferred to the GRC application (IRM) as part of the related project, control ownerships were determined, and the results of regular control activities were reported via IRM.

The second phase of the project is scheduled to be completed in 2023 and will include the “Archer GRC Application Improvement” project’s Operational Risk Management methodology.

Actuarial Supervision Unit

Actuarial Supervision Unit The Actuarial Supervision Unit targets to make contributions under the following categories through its operations:

• The sufficiency of the data used in the estimation of technical provisions and pricing, the computational suitability of their quality, the suitability of the assumptions used, and the monitoring of estimation realization,
• Portfolio analysis, particularly loss ratios and tariff profitability,
• Reporting on Company underwriting and pricing policies, capital sufficiency, and reassurance agreement sufficiency to senior management and the Early Detection of Risk Committee.

Business Continuity

Aims to provide the continuity of Aksigorta operations, to effectively and seamlessly maintain value-creating critical products, services, and service activities, to reduce negative impacts, to predetermine risks for the continuity of processes providing value to customers and stakeholders, and to be prepared in times of crisis by developing measures. Human life and health are the top priority in business continuity efforts.

A Business Continuity Plan is created in order to protect business processes and valuable assets and to maintain the ability to do business after crises and events, and the effectiveness of the process is ensured through tests and exercises.

The structure of business continuity is developed based on the results of business impact analysis and risk assessment studies, and targets and performance criteria are identified based on data included in analysis activities, so that the organizational structure, business unit requirements, location, and system infrastructure are in harmony, and required development necessities are identified.

Audit and control activities, management reviews and corrective actions required for the continuous improvement of the business continuity management structure, and the necessary actions to identify risks and opportunities are provided by the management and the teams that the management assigns the responsibility for business continuity.

Within the framework of these principles, the following activities were completed during the year:

• Digital disaster scenarios for long-term business interruptions and, in the event of a crisis, Aksigorta’s existing business continuity management and development areas are evaluated in collaboration with key stakeholders and the Senior Management team.
• An independent company developed a time-based crisis simulation exercise with the interactive participation of the company’s crisis management team members in order to assess the company’s readiness for crisis management.
• The company and the Internal Control Unit developed the crisis exercise scenario prior to the simulation, and at the end of the simulation, it was discovered that the Company’s crisis management team was aware of and prepared for crisis response. Also, additional areas for development were determined regarding the crisis management fundamentals.
• In order to ensure that business continuity activities are in line with business goals and become an integral part of the corporate culture, training and awareness activities are carried out for all employees. All company employees as well as critical information technologies outsourcers are included into the corporate business continuity training on the Aksigorta E-Academy Platform.
• A study was conducted in the Integrated Risk Management - IRM application as a result of the Emergency Center - ODM tests managed by Information Technologies in order to create institutional memory for incident resolution and areas for development.
• With the involvement of information technologies, internal audit, internal control, and process-owning business units, Information Security Risk Assessment activities have been carried out at critical service suppliers with high dependency with the goals of performing due diligence for third parties/ suppliers, resolving conditions impacting business continuity due to system faults and business discontinuity, and clarifying and improving their maturity level.

Law, Legislation and Compliance

All changes in legislation that are significant and related to our company’s activity area have been closely monitored and reviewed, and all actions have been taken to comply with legislation.

Within the scope of MASAK compliance, the project designed has been completed, and related processes have been transferred to a digital environment with effective software applications in order to effectively monitor sanction decisions, institutions, and persons subject to sanctions.

The Claims and Law department has filed 50,484 new case files and closed 39,389 files in 2022. Settlements were made in traffic bodily harm files, and 2234 case files were resolved amicably until the end of November 2022.

Information Technologies and Information Security Risks Management

Aksigorta’s vision includes an elementary insurance approach based on cutting-edge technology. At the same time, by focusing on technology, Aksigorta Information Technologies Department has adopted the elementary insurance approach using cutting-edge technology. The Information Technologies department works in parallel to Aksigorta’s strategy. A strong and flexible system, value-added and next-generation technologies, cyber security solution implementation, and IT talent management are strategic priorities in the new normal order.

Within this context, the Agile Management Methodology, which has recently emerged as a global trend, has been adopted. Information Technologies is where the first agile transformation has begun as of 2019. The IT organization has undergone change as part of this transformation, which was initiated with the goal of most productively and quickly addressing market dynamics and providing competitive advantage. The transformation from project to product management, as well as from department structure to inter-functional squad structure, has been completed, and Aksigorta’s entire project portfolio is now managed with Agility. The senior management, product owner, and domain owners regularly monitor the Squads’ target key results (OKR) through quarterly Big Room meetings.

Information Technologies has adopted the company’s risk management methodology for its own risk management. The IT Risk Management committee meets quarterly to assess IT risks.

Information systems risks and checkpoints have been defined. As part of the COBIT 2019 compliance program, control targets are reviewed and necessary updates are performed at checkpoints.

The data governance structure has been designed and disposal, exploration, data classification activities have been performed. Process controls have been defined, and data governance has been systematized with appropriate support tools.

B. IMPORTANT REGULATION CHANGES OF THE YEAR 2022

1. Regulation on Amendment to Commercial Advertisement and Unfair Commercial Practices

The Regulation on Amendment to Commercial Advertisement and Unfair Commercial Practices was published in the Official Gazette dated 01.02.2022 and no. 31737. This amendment introduced a regulation for analyzing the purchasing behaviors and other personal data of the consumer regarding any goods and services and specified that the offered price is a personalized price, and it should be included in the same space as the current price. Where discounted price is included, the obligation of stating the price before the discount has been introduced. It has been determined that the lowest price applied within 30 days before the discount is applied in the determination of the sales price before the discount. In advertisements where it is stated that a good or service is offered for sale with a tied loan, it is stated that the maturity of the loan, the interest rate, the monthly and annual percentage value of the total cost to the consumer and the repayment conditions should be included on the media where the advertisement is published.

In the event that a product or service offered for sale on the internet is sorted by comparing price, quality and similar aspects, it is regulated that the information on which criteria the ranking was created will be in the same field or in a way that can be easily seen on the pop-up screen where consumers can be directed with a link or warning sign. An obligation to include the phrase ‘advertisement’ in the ranking results displayed based on advertisements or sponsorships and similar agreements has been introduced.

C. KEY DEVELOPMENTS AND DECISIONS UNDER THE LAW ON THE PROTECTION OF PERSONAL DATA

Public announcement on COVID-19 PCR test result and vaccination information:

On 28 September 2021, the Agency posted a public announcement regarding the processing of vaccination information and PCR test result. The Agency referred to the letter of the Ministry of Interior, which requires the provision of a PCR test and/ or vaccination information for collective participation of people in group activities, and the letter of the Ministry of Labor and Social Security which require a PCR test to be requested once a week from non-vaccinated employees, and stated that the data of vaccination and PCR test results processed within the scope of preventive and protective activities constitute an exception to the Law No. 6698 on the Protection of Personal Data (the “Law”). In this respect, the data processing activities of public institutions and private organizations based on and being limited with the letters of the Ministry of Internal Affairs and the Ministry of Labor and Social Security will not be considered within the scope of the Law, while any processing activities that exceed the scope of the relevant articles will be subject to the provisions of the Law.

Guidelines to be Considered in the Processing of Biometric Data under the Law on the Protection of Personal Data: On 17 September 2021, the Personal Data Protection Authority (“Authority”) published the Guidelines to be Considered in the Processing of Biometric Data (“Guidelines”). The guidelines defines biometric data and includes processing conditions and principles in accordance with the Law on the Protection of the Personal Data.

The biometrical data include significant information about the data subjects due to their attributes. With the introduced Guidelines, the Authority introduces new responsibilities for the data controllers regarding the processing of the biometrical data with the goal of ensuring data protection and security in the processing of the biometrical data. The data controllers who are to process biometrical data should realize their activities in conformity with the principles and measures listed in the Guidelines.

Decision – Decision on sanction regarding the application of instant messaging:

The Personal Data Protection Authority (the “Authority”) identified that an instant messaging application (the “Application”) updated the service requirements and the principle of confidentiality as a prerequisite for the offered service. The authority started an ex officio inspection mainly on (i) transferring data abroad, (ii) binding the service to the requirement of explicit consent, and (iii) conformity to general principles. With the resolution dated 3 September 2021 and no. 2021/891, the Authority concluded as follows: y obtaining a single express consent for the processing and transfer of personal data abroad through the terms of service contract damages the “free will disclosure” element of the express consent; y the terms of service and the statements in the policy of confidentiality are presented in a non-negotiable nature, and the use of the application is tied to the condition of transfer, which is in violation of the principle of “compliance with the law and good faith” in Article 4 of the Law; y a conduct was performed against the principles of “processing for evident, clear and legitimate purposes” and the principles of “being related, limited and aligned with the objective of processing” in article 4 of the Law, y as long as the servers of the data controller are not located in Turkey, any processing activity regarding the personal data obtained from the persons in Turkey means the transfer of personal data abroad and the said transfer is not made in accordance with Article 9 of the Law; and y not obtaining explicit consent from the related individuals regarding the cookies used for profiling is not in accordance with the law. In this direction, the Authority ruled that (i) an administrative fine of TL 1,950,000 should be imposed on the data controller for not taking the necessary technical and administrative measures, (ii) the data controller should ensure conformity of their service requirements and policy of confidentiality text to the Law in 3 months, and (iii) the data controller should provide a clarification in accordance with the provisions of Article 10 of the Law and the Communiqué on the Procedures and Principles to be Complied with in Fulfilling the Clarification Obligation.

Other Resolutions:

In a decision regarding the data breach notification of an insurance company, the Authority decided to impose an administrative fine of TL 30,000 on the grounds that the data controller did not comply with the Personal Data Security Guidelines and did not take the required technical and administrative measures to ensure data security. The penalty amount was maintained law considering the economic condition of the data controller and that the error which caused to the violation was an exceptional case.

In a decision regarding the data breach notification of an insurance company, the Authority concluded that no action was required to be taken, considering that although there were health data among the affected data, 1 person was affected by the breach and the data controller informed the Authority as soon as possible.

In a decision regarding a bank’s data breach notification, the Authority considered that the data controller (i) did not limit the KKB queries of the personnel before the breach, (ii) did not carry out adequate inspection and supervision, (iii) imposed an administrative fine of TL 200,000 based on failure to take the required technical and administrative measures to ensure data security considering that the training on the Law for the Protection of Personal Data was not adequate.

In the decision regarding the data breach notification of an insurance company, the Authority determined that the data controller did not take the required technical measures to ensure data security, and imposed an administrative fine of TL 90,000. The decision no. 2020/357 dated 7 May 2020 is accessible here.

In a decision regarding the data breach notification of a bank, the Authority emphasized that (i) the control mechanism of the data controller was not at a sufficient level, (ii) the said errors should have been detected during the testing phase and the changes should have been corrected before they are released live, and imposed an administrative fine of TL 75,000 further to article 12/1 of the Law due to failure to take administrative measures.

Internal Audit Activities

The internal audit system of Aksigorta was structured in accordance with the Communiqué on the Internal Systems of Insurance and Private Pension Sectors issued in the Official Gazette dated November 25, 2021, and numbered 31670. As per Article 6 of the Communiqué no. 16/2022 Concerning Enforcement of Some Articles of the Regulation on the Internal Systems of Insurance and Private Pension Sectors, it is possible to jointly use an audit committee, internal control, risk management, actuarial and internal audit unit of any of the insurance, reassurance and pension companies under the Insurance group, without the need to form another such separate unit in other companies, too. Therefore, the AgeSA Emeklilik ve Hayat A.Ş. Internal Audit team has been restructured accordingly so that it can serve both Aksigorta A.Ş. and AgeSA Hayat ve Emeklilik A.Ş. companies Pursuant to the Board of Directors resolution dated October 31, 2007, and numbered 2007/31, and in accordance with applicable laws, rules, regulations and practices, an Audit Committee was set up to help protect the interests of the Company’s stakeholders. As stipulated by the Board of Directors resolution dated October 17, 2014, and numbered 2014/62, the aforementioned Committee was restructured and replaced by the current Audit Committee to ensure compliance with Capital Markets Board Corporate Governance Principles. The Audit Committee consists of two members, namely Hüseyin Gürer and Yeşim Uçtum, both Independent Members of the Board of Directors. According to the organizational chart, the Internal Audit department reports directly to the Board of Directors and operates independently. The Company aims to manage the internal control system within the maximum risk limits which determine risk factors which may prevent reaching strategic and operational goals. The Risk Management and Internal Audit Departments are responsible for ensuring operational productivity and efficiency, issuing financial and managerial results in a timely, accurate and reliable manner, overseeing compliance with applicable laws and regulations, protecting shareholder investments and Company assets, and managing risks effectively and efficiently. The scope of internal audit activities includes analysis and assessment of the efficiency and capability of internal control, risk management and administrative processes in order to yield reliable, independent and impartial opinion on these processes, and to present proposals for improvement and development.

As part of the annual audit plan for 2022, auditing of 13 processes was completed, and the associated reports were submitted to the Audit Committee. The actions taken by the Company executives in connection with the internal control deficiencies observed within the framework of Audit Reports were subsequently followed up and the adequacy of the actions were questioned by monitoring their effect on the risk level and the results were reported to the Audit Committee.

The Internal Audit team consists of 1 Chairman, 3 Managers, 7 Auditors and 1 Audit Data Analyst, who possess the qualifications specified in the Regulation on Internal Systems of Insurance, Reinsurance and Pension Companies. The internal audit personnel were provided with the necessary training courses to support their professional development and improve their knowledge. The Internal Audit department staff members have no responsibility, authority or influence on the audited operations of the Company, and their full independence is ensured.

AGENDA

Determination of allocation of annual profit of 2022, dividend pay-out rate and terms of dividend payment

RESOLUTION

It has been understood that there is a “Net Period Loss” of TL 121,148,616 in the Financial Statements for the period of 01.01.2022-31.12.2022, prepared in accordance with Capital Market Board’s Accounting Standards and Generally Accepted Accounting Principles and audited by PwC Bağımsız Denetim ve Serbest Muhasebeci Mali Müşavirlik A.Ş. (PwC), accordingly it has been decided to inform the shareholders that there will be no dividend distribution for the 2022 accounting period according to the Capital Market Board regulation on dividend distribution and to present this issue for approval of our shareholders at the Ordinary General Assembly Meeting of 2022 which will take place on 21 March 2023.