Navigation Map Download our best practices
- strategy (insurance, health, investments, finances);
- sustainable development (sales, employees, social responsibility, natural environment and ethics).
The above-mentioned areas were additionally supplemented with related GRI indicators, within each selected issue.
In the CHAPTER
GRI
- 102-7 Scale of the reporting organization
- 103-2 Approach to management and its elements
- 103-3 Evaluation of the approach to management
- 201-1 Direct economic value generated and distributed
- 102-13 Membership in associations and organizations
- 102-40 List of stakeholder groups engaged by the reporting organization
- 102-42 Basis for identification and selection of stakeholders engaged by the organization
- 102-43 Approach do engaging stakeholders, including the frequency of engagement by stakeholder type and group
- 102-44 Key issues and concerns raised by stakeholders and the organization’s response, also by reporting them
In the CHAPTER
GRI
- 102-8 Data pertaining to employees and other persons working for the organization
- 103-2 Approach to management and its elements
- 103-3 Evaluation of the approach to management
- 404-1 Average number of hours of training per year per employee
- 404-2 Managerial skill development and continuing education programs supporting continuity of employment of employees and facilitating the retirement process
- 404-3 Percentage of employees subject to regular assessments of work quality and professional development reviews, by gender and employment category
- G4-FS16 Initiatives to enhance financial literacy by type of beneficiary
In the CHAPTER
In the CHAPTER
GRI
- 103-3 Evaluation of the approach to management
- 307-1 Cash value of penalties and total number of non-financial sanctions for non-compliance with the law and/or regulations on environmental protection
- 301-1 Raw materials/materials used by weight and volume
- 302-1 Energy consumption by the organization, taking into account the types of raw materials
- 302-4 Reduction of consumption of energy
In the CHAPTER
GRI
- 102-9 Description of the supply chain
- 102-11 Explanation of whether and how the precautionary principle is addressed by the organization
- 102-15 Description of key impacts, opportunities and risks
- 102-16 Organization’s values, code of ethics, principles and norms of behavior
- 102-17 Internal and external mechanisms making it possible to obtain advice regarding the behaviors in ethical and legal issues and issues associated with the organization’s integrity
- 103-2 Approach to management and its elements
- 103-3 Evaluation of the approach to management
- 102-5 Organization’s form of ownership and legal form
- 102-18 Organization’s supervisory structure along with the commissions that report to the highest supervisory body
- 205-1 Actions assessed in terms of threats associated with corruption
- 205-2 Communication and training on anti-corruption policies and procedures in the organization
- 206-1 Legal steps taken against the organization for cases of violating the principles of free competition and monopolistic practices
- 405-1 Composition of supervisory bodies and employees broken down into employee groups by gender, age and other diversity factors
- 406-1 Total number of discrimination cases and corrective measures taken in this regard
- 419-1 Non-compliance with the law and socio- economic regulations
In the CHAPTER
GRI
- 103-2 Approach to management and its elements
- G4-FS13 Access points to sparsely populated areas that are less economically developed
- G4-FS14 Initiatives undertaken to improve access to financial services for disfavored persons
- G4-FS15 Policies for the fair design and sale of financial products and services
- 417-1 Internal requirements concerning the labeling of products and services and information regarding them
- 417-2 Incidents of non-compliance with regulations and voluntary codes concerning the labeling of products and services and information regarding them
- 417-3 Incidents of non-compliance with regulations and voluntary codes concerning marketing communications
Read more:
- Client at the center of attention
- Innovations
- Responsible sales
- Insurance
- Banking and strategic partnerships
- Working conditions
- Employee development
- Knowledge sharing
- Enhancing safety
- Health
- Improvement of living conditions in local communities
- Our impact on the natural environment
- Practical challenges in managing direct impact
- Products and adaptation to climate change
Business model
Employee
CSR
Environment
- Ethical foundations of business operations
- Preventing corruption and conflict of interests
- Diversity and respecting human rights
- Whistleblowing system
- Transaction security
- Risk management, taking into account non-financial risk
- Risk appetite
- PZU Group’s risk profile
- Reinsurance operations
- Polish and Baltic States insurance sector compared to Europe
- Regulations pertaining to the insurance market and the financial markets in Poland
- Non-life insurance (PZU, LINK4 and TUW PZUW)
- Life insurance (PZU Życie)
- International operations
- Contribution made by the market segments to the consolidated result
Risk and ethics
Market
Business
Financial results
Read more:
- Client at the center of attention
- Employee development
- Health
- Cultural patronage
- Practical challenges in managing direct impact
- Ethical foundations of business operations
- Diversity and respecting human rights
- Whistleblowing system
- Transaction security
- Risk appetite
- PZU Group’s risk profile
- Risk vulnerability
- Capital management
Business model
Employee
CSR
Environment
Risk and ethics
Read more:
- New approach to sales
- Working conditions
- Employee development
- Diversity and respecting human rights
Business model
Employee
Risk and ethics
Read more:
- Client at the center of attention
- Medical services (Health)
- Working conditions
- Enhancing safety
- Health
Business model
Employee
CSR
- Our impact on the natural environment
- Practical challenges in managing direct impact
- Diversity and respecting human rights
- Medical services (Health)
Environment
Risk and ethics
Business
Issues relating to information security are treated in the PZU Group with great diligence and attention. A multiple-layer system to protect against cybersecurity threats functions across the company and is being developed.
In 2018 a special training platform called GoPhish was launched. It explains in an easy to understand way the threats following from messages, among others, containing malicious elements and prompting people to open suspicious pages. In addition, two campaigns were organized in which the Security Department’s training film was shown to employees who by oversight opened a link to pre-prepared messages containing information on how to avoid those threats in the future.
In 2018 a contract was executed to buy Infoblox technology concerning the ability to monitor and protect the DNS (Domain Name System) channel. The WAF (Web Application Firewalls) system was also expanded. It is used to protect web applications and the PIM system (Priviledged Identity Management) used to manage priviledged accounts and monitor the actions of priviledged users and external suppliers in information systems to provide for the squaring of accounts on access to systems, in particular with the utilization of shared accounts.
Procedures to manage the security of information processes were implemented in PZU, Pekao Group companies and in several foreign companies. A package of regulations pertaining to personal data processing, including security policies containing requirements pertaining to IT processes was implemented in PZU Zdrowie and its subsidiaries. In turn, PTE PZU introduced the guidelines issued by the Polish FSA concerning the management of areas involving information technology and ICT environment security in universal pension fund management companies.
1,296 incidents of providing data without an entity’s consent in the PZU Group companies were registered in 2018. 771 of these cases occurred in the Pekao Group, 457 in Link4, 19 in the Alior Group, 41 in the foreign companies and eight in the other Group companies, including PZU, PZU Życie and PZU Zdrowie and its subsidiaries. These incidents concerned the disclosure of personal data and data subject to banking or insurance secrecy to unauthorized persons. They were related to sending e-mail correspondence to an improper address to unauthorized persons and in most cases they resulted from human errors.
Three grievances were lodged by external entities in 2018 with PZU and PZU Życie. The grievances were for the provision of data without an entity’s consent and were recognized by the organization.
All the incidents were analyzed to improve processes.
Cybersecurity in 2018:
Combating new forms of internet attacks calls for constantly refreshing knowledge. That is why the employees responsible for PZU’s information security are honing their skills the entire time. PZU experts participated in 11 training courses, 10 conferences and two workshops in 2018. The following certifications were obtained: Certified Ethical Hacker, Continuous Monitoring Certification (GMON), Cisco CCNA Cyber Ops.
Tests of IT systems
Rolling out and selling products and customizing the offer to evolving client needs is an enormous challenge for the Group’s information systems. For these changes to proceed smoothly and not to disrupt client service, the organization has crafted a recurring information procedure embracing the widest possible set of tests and checks. This procedure guarantees early detection of threats and possible problems and supports the appropriate management thereof.
