GOVERNANCE

FPT Governance is based on four corporate bodies:

• Shareholders' meetings

• Board of Directors

• Statutory Auditors

• External Audit

The principles and moral and social values followed by FPT have been collected in the Iveco Group Code of Conduct.

Following the entry into force of the Italian Decree 231/01 ("Rule that regulates the administrative responsibility of legal persons, Companies and Associations even without legal responsibility”) FPT has adopted the related Compliance Program, and appointed a Supervisory Board with the duty of supervising the functioning and observance of the Program itself.

Any violation or guidance on the “Compliance Program pursuant to the requirements of Italian Legislative Decree ex 231/2001” may be forwarded to:

In order to effectively pursue the goals and values, FPT Industrial S.p.A. recognises the need to establish and maintain a Quality Management System compliant with the requirements of ISO 9001and IATF 16949, which is consistent with the organisational context, attentive to stakeholder needs, and oriented at satisfying customer and cogent requirements, with the aim of improving the performance of the processes and the related effectiveness and flexibility.

FPT is committed to monitoring the implementation of the Quality System by the sites in Europe (central sites in Turin and Arbon, Turin, Foggia, Bourbon Lancy, Garchizy engines production plants and Turin Driveline and E-Powertrain), and identifying and managing the risks bearing on its effectiveness.

To report a vulnerability or cybersecurity incident involving a FPT product, please notify to e-mail address:
FPT-CyberVulnerability@ivecogroup.com

Submissions will be acknowledged once they have been received and reviewed by our team. Then FPT team will conduct a thorough investigation, and take the appropriate steps for resolution, if any.

• Email subject line: “Potential Vulnerability”

• Product, model, version, URL or IP address where applicable

• Description of the concern or vulnerability - include CVE where applicable

• Information to help our team replicate the issue (e.g. configuration details, a proof-of-concept or exploit code)

• Contact information