ORG ANISATION, MANAGEMENT AND
CONTROL MODEL

— Indice

DEFINITIONS

2GENERAL SECTION
1. ENTITIES’ CRIMINAL LIABILITY

5

1.1. Legislative Decree 231/2001
1.2. The Recipients of the Decree
1.3. Predicate Offences
1.4. The prerequisites of liability		
1.4.1 Objective requirements		
1.4.2 Subjective Requirements
1.5. Sanctions		
1.5.1 Fines
		
1.5.2 Disqualification measure		
1.5.3 Publication of the sanctioning decision		
1.5.4 Confiscation of the price or profit of the offence		
1.5.5 Precautionary measures

2. ORGANISATION MODEL PURSUANT
TO LEGISLATIVE DECREE 231/2001

12

2.1. Function and legal effects of the organisation model
2.2. The content of the organisation model
2.3. Tools for drafting the Organisation Model
2.4. The features of an effective Organisation Model
2.5. Organisation Model and Code of Ethic
2.6. Organisation Model and Groups of Companies

3. THE ORGANISATION,
MANAGEMENT AND CONTROLMODEL OF PRADA S.P.A

16

3.1. Description of the corporate structure of Prada S.p.A
3.2. The Prada S.p.A. Organisation Model
3.3. Recipients of the Model
3.4. Structure of the Model
3.5. Obligations to update the Model

4. THE SUPERVISORY BOARD

21

4.1. The Supervisory Board of Prada S.p.A
4.2. Functions and powers of the Supervisory Board
4.3. Reporting obligations of the Supervisory Board

5. INFORMATION FLOWS TO THE SB
5.1. Information flows of the Board of Directors and		

23

corporate departments

5.2. Whistleblowing

6. DISSEMINATION OF THE MODEL
AND PERSONNEL TRAINING

26

7. THE DISCIPLINARY SYSTEM

27

— Definitions

Company Officers: directors, supervisory bodies,liquidators and managers of Prada S.p.A.
Group: Prada S.p.A. and its subsidiaries.

The following definitions refer to the terminology usedin this Model. They are supplemented by any further
definitions contained in the Special Sections of theModel or in the individual documents attached thereto.
Senior Executives: individuals holding representative,administrative or management offices in the Company
with financial and functional autonomy, as well as
individuals exercising, also de facto, management orcontrol over the Company;
Activities at risk or sensitive activities: activities
carried out by the Company in the scope of which thecommission of predicate offences could abstractly takeplace.
Independent Contractors: all independent contractors
considered as a whole, i.e. Consultants, Suppliers,
Partners, persons acting in the name and/or on behalfof Prada S.p.A. by virtue of a mandate contract or
any other contractual relationship of professional
collaboration, including atypical contracts.
CCNL: the National Collective Bargaining Agreements
applied by the Company
Code of Ethics: the code of ethics adopted by theCompany and approved by the Board of Directors of
Prada S.p.A., as well as the relevant updates.
Legislative Decree 231/2001 or the Decree: theLegislative Decree of 8 June 2001, which came into
force on 4 July 2001, as amended and supplemented.
Recipients: Company Officers, Employees ofevery order and grade of the Company, as well as
Consultants, Suppliers and, in general, all persons
with whom the Company has entered into any formof collaboration agreement that takes place within thescope of the activities at risk under the Decree.
Employees: persons having an employment
relationship with the Company, who, as such, aresubject to the management and control of others.
Entity(ies): entities with legal personality, companies or
associations, including those without legal personality.

ORGANISATION, MANAGEMENT AND CONTROL MODEL

HSE: Prada's Health & Safety and Environmental
Protection department, which oversee legislationand case law on health, safety and environmental
issues, with tasks of coordination, support, monitoringand preventive control of health, safety at work andenvironmental activities.
Persons in charge of a public service: Article 358 of
the Italian Criminal Code provides that “...persons incharge of a public service are those who, for whateverreason, perform a public service. Public service must
be understood as an activity regulated in the sameforms as the public function, but characterised by thelack of the powers typical of the latter, and with theexclusion of the carrying out of simple organisationaltasks and the provision of purely practical work...”.
The legislator defines “public service” making reference
to two criteria, one positive and one negative.
According to the first criterion, the “service”, in order
to be defined as public, must be regulated by rulesof public law; the second criterion specifies that the
public service, in order to be defined as such, must
be devoid of the powers of a certifying, authorisingand deliberative nature that are typical of the “public
function”. The legislator also provides that theperformance of “mere tidy tasks” or the “performanceof purely material work” can never constitute “public
service”.
With reference to activities that are carried out byprivate entities on the basis of a concession relationshipby a public entity, it shall be held that, for the purposesof classifying the entire activity carried out within theframework of that relationship as a “public service”,
it is necessary to ascertain whether the individual
activities are subject to public law provisions, not being
the existence of an authoritative act engaging theindividual sufficient.
In order to facilitate the identification of a public entity,case law has developed certain “revealing indices”,
mainly applied in relation to cases concerning statecontrolled joint stock companies. Among the most
relevant indices are:2

— a - the subjection (of the Company) to theState’s or other public bodies’ supervision anddirection for social purposes, as well as thepower to appoint and dismiss directors;— b - agreements and/or concessions with the
public administration;— c - financial contribution by the State;— d - the public interest within the economic
activity.

On the basis of the foregoing, in order to determine
whether or not a person has the status of “person in
charge of a public service” one must have regard to
the legal nature of the entity, but also to the functions
actually performed by the person, which must consist
in the care of public interests or the satisfaction ofneeds in the general interest.
Organisation Model or Model: the organisation,
management and control model adopted by Prada
S.p.A. pursuant to the Decree
Corporate Bodies: the Board of Directors, the Board of
Statutory Auditors and their members.
231 Supervisory Board or SB: A board, granted withautonomous powers of initiative and control, with thetask of supervising the functioning, observance andupdating of the 231 Organisation Model, pursuant to
Article 6, paragraph 1 lett. b, of the Decree.
Special Section: a section of the Model in which,following to the risk assessment activities, the typesof offences from which the Entity may abstractly
incur liability are identified, the activities at risk andthe main persons and departments involved in these
activities are identified, the principles of conduct andcompany procedures to be followed by all Recipientsare indicated, as well as the control measures put inplace by the Company in order to prevent and avoid
the commission of the predicate offences.
Prada or the Company: Prada S.p.A.
Control Measures: the set of rules and procedures
prepared by the Company for the prevention ofpredicate offences.

ORGANISATION, MANAGEMENT AND CONTROL MODEL

Public Administration: any legal entity that is
responsible for public interests and that carries out
legislative, judicial or administrative activities underpublic law and authoritative measures.
It should be noted that the Italian Criminal Codedoes not provide any provision defining public
administration; however, the Ministerial Report on the
Italian Criminal Code, doctrine and case law, leaning
towards a substantive approach, consider all thoseentities that carry out “the activities of the Stateand other public entities” to be part of the “Public
Administration”.
Trying to provide a definition - albeit partial - of thelegal entities belonging to this category, Legislative
Decree 165/2001, which regulates the employment
relationship with public administrations, defined allstate administrations as public administrations in
Article 1(2).
It should be noted, however, that not all natural
persons acting within and in relation to theaforementioned entities can be considered to hold thesubjective qualifications required for offences against
the Public Administration. To this end, “Public Officials”(Article 357 of the Italian Criminal Code), “Persons in
Charge of a Public Service” (Article 358 of the Italian
Criminal Code) and “Persons performing a service of
public utility” (Article 359 of the Italian Criminal Code)are to be taken into account.
Public Official: pursuant to Article 357(1) of the Italian
Criminal Code, a public official “for the purposes ofcriminal law” is a person who exercises “a legislative,
judicial or administrative public function”. The second
paragraph also makes it clear that “...the administrative
function governed by public law and authorisinglaws and characterised by the shaping and carryingout of the will of the public administration or by its
performance by means of authoritative or certifying
powers shall be deemed as public... “.
The aforementioned regulatory definition limits theadministrative function “externally”, by using a formal
criterion, which refers to the nature of the discipline,
specifying that the administrative function is public if itis provided for by “public law”, i.e. by those rules aimed
at the pursuit of a public purpose and the protection ofa public interest, which, as such, are contrasted withthe rules of private law.
3

The second paragraph of Article 357 of the Italian
Criminal Code, on the other hand, provides for someof the main criteria identified by case law and doctrine
to differentiate the notion of “public function” fromthat of “public service”. In particular, following asubstantive approach, “public functions” are definedas all those administrative activities that respectively
and alternatively constitute the exercise of (a) decision
powers; (b) authoritative powers; (c) certifying powers.
On the other hand, the legislature has not carriedout a similar defining activity to specify the notion of“regulatory function” and “judicial function”.
Predicate Offences or Offences: a list of the offences
provided for in the Decree, the commission of which by
Senior Executives or Employees could give rise to theliability of the Company.
Risk Assessment: an activity carried out by external
professionals appointed by the Company, aimed at
identifying and “mapping” the sensitive activities andcorporate functions that could theoretically be exposed

ORGANISATION, MANAGEMENT AND CONTROL MODEL

to the risk of one of the Predicate Offences beingcommitted. This activity is carried out by studying
company procedures and further documentation
provided by the Company, conducting interviews witheach of the various corporate functions concerned,
analysing with them the most relevant profiles linked
to the performance of the relevant sensitive activities,
and identifying and/or implementing the safeguards
to be adopted to prevent the risks of offences beingcommitted.
Whistleblowing: a tool enabling employees,
consultants, independent contractors and any otherperson working with the Company to report any
irregularities they may have become aware of in thecourse of their work or in any other circumstance andto submit, in order to protect the entity's integrity,
reasoned reports of unlawful conduct relevant under
Legislative Decree 231/01 or of violations of theCompany's Model, of which he/she has become aware
by reason of his duties.

4

General Section— 1. Entities’ criminal
liability
1.1. Legislative Decree 231/2001
Legislative Decree No. 231 of 8 June 2001, whichcame into force on 4 July of the same year, introduced
into the Italian legal system the “Regulations governing
the administrative liability of legal entities, companies
and associations, including those without legal
personality”, thus implementing Articles 11 and 14 ofDelegated Law No. 300 of 29 September 2000, bymeans of which the Government had been entrustedwith the task of fulfilling the obligations, assumed atinternational level, of adapting to the conventions
signed on the subject of the liability of entities foroffences and, in particular:— the Brussels Convention of 26 July 1995 on

the protection of the European Communities'
financial interests;— to the Brussels Convention of 26 May 1997

on the fight against corruption involving EU
officials or officials of EU countries;— the OECD Convention of 17 December 1997

Combating Bribery of Foreign Public Officials inInternational Business Transactions.

Such Decree, by not applying the old principle “societas
delinquere non potest”, has introduced a formal
administrative liability for entities (which is, however,similar in substance to criminal liability, as to theproceedings and sanctioning) for offences committed
in the interest or to the advantage of the entity bypersons functionally connected to the latter.
In particular, the rationale of the regulations was toplace alongside the criminal liability of the natural
person, who materially committed the offence, also
a form of liability for the entity that, culpably or evenintentionally, made the offence possible.
Therefore, it is not a question - as is the case inother legal systems - of a form of absolute liability(responsabilità oggettiva) automatically ascribable to
ORGANISATION, MANAGEMENT AND CONTROL MODEL

the company every time an offence is committed in its
interest or to its advantage, as set out in the catalogueof predicate offences, but, on the contrary, it is rather
a liability that stems from a reprimand linked to anorganisational and control deficit within the entity
itself, which has in some way favoured, if not actuallyencouraged, the commission of the predicate offencesby the natural persons functionally connected to it.

1.2. The Recipients of the Decree
Article 1 of the Decree provides for the persons the
Decree shall apply to, by identifying the recipientsof the regulation as “entities endowed with legal
personality” (e.g., incorporated associations andfoundations endowed with legal personality, as wellas corporations, which have perfect patrimonialautonomy under our legal system) and “companies andassociations also without legal personality” (such as
unincorporated associations, committees, etc.).
By express provision of Article 1(3), however, theDecree does not apply to the State, public territorial
bodies (regions, provinces, municipalities, etc.), othernon-economic public bodies, and bodies that performfunctions of constitutional importance (such as, forexample, trade unions and political parties).

1.3. Predicate Offences
The entity's liability, if any, must be considered limited
exclusively to the offences referred to in Articles 24 etseq. of the Decree, i.e. the “Predicate Offences”.
The original version of the Decree limited itself to
identifying, as predicate offences, certain cases aimed
at protecting the public administration and its assets.
Over the years, however, the legislator, also in order tocomply with the various international law regulations
that have been adopted at the same time, hasenhanced the number and type of offences from which
the liability of the entity may arise.
A detailed list of Predicate Offences provided for by the
Decree can be found in Annex B of the Model, which isconstantly updated by the Company to incorporate thelatest news and/or regulatory changes.

— Inchoate offences (Article 26)

Pursuant to Article 26 of the Decree, the entity's
5

administrative liability for criminal offences also
exists when the predicate offences are committed
in the form of an inchoate offence (Article 56 of
the Italian Criminal Code), i.e. when the natural
person has merely carried out “...acts that aresuitable, unambiguously directed towards thecommission of a crime...” included among those
provided for in the Decree.
In these cases, the Decree provides that the amountof the pecuniary sanctions and the duration of thedisqualification measures, provided for in such cases,
are reduced by between one third and one half andthat, where the agent”...voluntarily prevents the action
from being carried out or the event from taking place”,
no sanctions are imposed.
This is nothing more than a particular hypothesis of
the “active withdrawal” provided for in Article 56(4)of the Italian Criminal Code, in which the exclusion of
sanctions is justified by virtue of the interruption of any
relationship of identification between the entity andthe persons who assume to act in its name and on its
behalf.

— Offences committed abroad and cross-borderoffences
Pursuant to Article 4 of the Decree, it is provided
that “in the cases and under the conditions laid
down in Articles 7, 8, 9 and 10 of the Italian
Criminal Code” (i.e. for all those cases in which
the Italian criminal law recognises the State's
jurisdiction over offences committed abroad by
natural persons1), entities having their head officein Italy are also liable for offences committed
abroad, provided, however, that the State of theplace where the offence was committed does notprosecute the offence.

Law No. 146 of 16 March 2006, which ratified theUnited Nations Convention against Transnational
Organized Crime, adopted by the General Assemblyon 15 November 2000 and 31 May 2001 respectively,

also provided, in Article 10, that entities are subject
to liability under the Decree in relation to certain
crimes of association2 if these are characterised bytransnationality.
In particular, under Article 3 of the latter law, anoffence is to be considered “transnational” when an
organised criminal group is involved in its commission
and when it is punishable by imprisonment of noless than a maximum of four years, as well as when,alternatively: 1) it is committed in more than one State;2) it is committed in one State, but a substantial partof its preparation, planning, direction or control takes
place in another State; 3) it is committed in one State,
but an organised criminal group engaged in criminal
activities in more than one State is involved; 4) it iscommitted in one State but has substantial effects inanother State.

— Offences committed in Italy by foreigncompanies
A particularly topical issue, on which the ItalianSupreme Court has recently issued several
judgments, is the jurisdiction of the Italian
courts, for the purposes of the liability of the
body pursuant to the Decree, in the hypothesisof the predicate offence committed in Italy bycompanies having their registered office andexercising their organisational and management
activities in foreign countries.

With regard to these hypotheses (unlike Article 4,concerning offences committed abroad by companies
having their head office in Italy), the Decree did notprovide for specific rules, which had initially led tothe assumption that, in this respect, the Italian courts
would not have jurisdiction over any criminal liability
attributable to the entity.
However, in its recent judgment No. 32899 of 8
January 2021, the Italian Supreme Court, concerning
the criminal liability of entities, held that if the

1
These are, in particular, offences against the personality of the Italian State, offences of counterfeiting the seal of the Italian State, offencesof counterfeiting currency which is legal tender in the territory of the State, offences committed by public officials in the service of the State(Article 7 of the Italian Criminal Code), as well as other political offences not provided for in Article 7 of the Italian Criminal Code (Article 8 of
the Italian Criminal Code), offences committed abroad by an Italian citizen for which the Italian law provides for a penalty of life imprisonment
or imprisonment of no less than three years (Article 9 of the Italian Criminal Code), and of offences committed by a foreigner abroad, punishable
by life imprisonment or imprisonment of no less than a minimum of one year, and provided that the foreigner is on State territory (Article 10 of
the Italian Criminal Code).
2 These include, in particular, the offences of criminal conspiracy, mafia-type offences, conspiracy to smuggle foreign processed tobacco,conspiracy for trafficking of narcotics or psychotropic substances and migrants trafficking.	  
ORGANISATION, MANAGEMENT AND CONTROL MODEL6

predicate offence has been committed on Italian
territory, the Italian courts have jurisdiction on theadministrative offence of the legal person even in theevent that the legal person has its head office abroad,because the place where the offence is committed,
which determines the jurisdiction, is the place where
the predicate offence is committed.

1.4. I presupposti della responsabilità
The requirements for entities’ criminal liability, inline with the government report accompanying the
Decree, are commonly distinguished into objective andsubjective.
1.4.1. Objective requirements
The commission of a predicate offence
In accordance with the principle of legality, Article 2 of
the Decree provides that an entity cannot be held liable
for an act constituting an offence if its administrative
liability in relation to that offence, as well as therelevant sanctions, have not been expressly provided
for by a law that came into force before the act wascommitted.

—

Therefore, the first objective requirement necessary
for the entity to be held liable for an offence is that
one of the predicate offences, whether committed
or attempted, as set out by Articles 24 et seq. of theDecree, must have been provided for by a law thatcame into force before the act was committed.

— The perpetrator of the predicate offence

For the purposes of liability to be ascertained, it is also
necessary that the offences under the Decree werecommitted by persons having a qualified relationshipwith the entity.
Pursuant to Article 5 of the Decree, in fact, the entity is
liable exclusively for predicate offences committed in
its interest or to its advantage by:— 1. persons performing representative,administrative or management functions in theentity or one of its organisational units having
financial or functional autonomy(“Senior Executives”);— 2. persons who exercise, even de facto, themanagement and control of the entity (“De Facto
Senior Executives”);— 3. persons subject to the management or

supervision of one of the aforementioned persons(“Employees” or “Subordinates”).

As regards the identification of Senior Executives, anobjective-functional criterion based not on the formal
qualification but on the activity concretely performed
shall be applied, thus including not only those persons
who commonly represent the top of the corporate
structure (such as, for instance, the sole director or
the board of directors as a whole), but, in compliancewith the principles of personal nature of criminal
liability and effectiveness, also all those persons who
express the will of the entity and define the company's
management policies.
With regard to persons subject to the management or
supervision of the Senior Executives, this category too
has been interpreted over time in an extensive sense,
since it cannot be limited to employees alone, but mustalso include all those persons who are self-employedor even independent contractors (such as, for example,
agents, consultants, suppliers and other persons
having contractual relations with the company), who,in the performance of an assignment and under the
management and control of senior executives, havecommitted a predicate offence in the interest and to
the advantage of the entity3.
In relation to the predicate offences committed by
employees, it should also be noted that Article 7 of theDecree provides that the entity may be held liable forsuch conduct only if the commission of the offence wasmade possible by the failure of persons withmanagement powers to comply with their management
and supervisory obligations (Article 7, Legislative
Decree no. 231/2001).

— Autonomy of the entity's liability

By virtue of the principle of “autonomy of the liability ofthe entity”, provided for by Article 8 of the Decree,

3 The forerunner of this extensive thesis was a well-known order issued by the Court of Milan, Judge for Preliminary Investigations Office, on
27 April 2004, which ordered against a well-known multinational company - subject to proceedings for administrative liability under the Decree
for having committed the crime of bribery - the disqualifying measure, in the form of a precautionary measure, of the prohibition to contract
with the Public Administration for one year; on that occasion, the Court had assessed the indicative evidence of the unlawfulness of the conduct
of not only two of its employees, but also of an external consultant to whom the company had turned, without the latter's extraneousness to thecompany's organisational chart being in any way valid for the purposes of excluding the company's liability.
ORGANISATION, MANAGEMENT AND CONTROL MODEL

7

the liability of the entity is autonomous with respect toparticular subjective conditions of the natural
person perpetrator of the offence and to particular
procedural events concerning the predicate offence.
In particular, Article 8 provides that the entity cannot
benefit either from the non-punishability of the natural
person who materially committed the predicate
offence or from the failure to identify the latter, orfrom classifying the predicate offence as no longer
punishable (“estinzione del reato”) other than amnesty.

The former provision expressly provides that the entity
must in any case not be held liable if it is proved thatthe senior executives or subordinates who materiallycommitted the predicate offence acted solely in theirown interest or in the interest of third parties(Article 5, para. 2).

— Interest or advantage

Case law has clarified that this exemption from liability
also applies where the offence has produced an actual
advantage for the entity: the fact that the perpetratorsof the offence acted solely in their own interest or in
the interest of third parties, in fact, determines thelack of organic identification between the subject
and the entity and the offence committed, while
granting an advantage to the entity, can no longer beconsidered to be related to the entity’s own doing, butmust be considered to be a fortuitous advantage, notattributable to the will of the legal entity6.

In this regard, it is worth noting that in case law, thesetwo criteria have been understood as distinct fromeach other and ascertainable from two different
perspectives.

If, on the other hand, the perpetrator has committed
the offence in his own predominant (but not exclusive)interest or in the interest of third parties, and the entity
has not gained an advantage or has gained a minimal
advantage, the administrative sanction shall be reduced
pursuant to Article 12(1)(a) of the Decree.

A further objective requirement, necessary for theentity to be held liable, is set out in the aforementioned
Article 5 of the Decree, which expressly requiresthat the predicate offence committed by the Senior
Executives or Employees must be committed in theinterest or to the advantage of the entity.

On the one hand, in fact, the criterion of interest
expresses a teleological assessment of the offence,
to be ascertained “ex ante”, i.e. at the time of thecommission of the offence and according to a
subjective assessment; therefore, this requirement
represents the perpetrator's intention to bring a benefit
to the entity through the commission of the offence,
being it irrelevant that this benefit is then actuallyachieved4 .
On the other hand, the advantage shall be deemed as
an objective criterion, to be as “ex post”, on the basis of
the effects concretely deriving from the commission of
the offence5.
The special cases of exclusion of liability and attenuatedliability provided for by the Decree in Articles 5(2) and12(1)(a) respectively are closely linked to the objective
requirements of the entity's interest and advantage set
out above.

1.4.2. Subjective Requirements
Meeting all the objective requirements set out in theabove paragraphs is a necessary but not sufficientcondition for the entity to be held liable. For the
purposes of liability, in fact, the Decree also requires
the fulfilment of further subjective requirements,
aimed at ascertaining an autonomous guilt of the entity,
which is given by a deficiency in the organisation or
activity, compared to a model of diligence required by
the company as a whole.
More precisely, the Decree diversifies the methods forascertaining the liability of the entity depending on theperpetrator of the predicate offence.
The commission of a predicate offence by one of the
Senior Executives usually is a sufficient condition for
the entity to be held liable, unless the latter, on whicha precise burden of proof exists, provides evidence of

4 See Italian Supreme Court, Criminal Joint Divisions, judgement of 24 April 2014, no. 38343; more recently, ex multis, Italian Supreme Court,
Criminal Division, IV Division, judgment of 3 March 2021, no. 22256.
5	  Ibidem.
6 See, ex multis, Italian Supreme Court, I Criminal Section, judgement of 26 June 2015, no. 43689; Italian Supreme Court, II Criminal
Section, judgement of 23 December 2020, no. 37381.

ORGANISATION, MANAGEMENT AND CONTROL MODEL

8

the exempting conditions set out in Article 6(1) of theDecree, namely:— a - the adoption and effective implementation,prior to the commission of the offence, oforganisational and management models capableof preventing offences of the kind committed
and meeting given complex requirements set
out in paragraph 2 of the aforementioned
Article 6;— b - entrusting an internal body, endowed withautonomous powers of initiative and control,with the task of supervising the functioning,observance and updating of the aforementioned
models;— c - the fact that the commission of the offence

was made possible because the perpetrators
fraudulently circumvented the organisation andmanagement models;— d - there was no omission or insufficient

supervision by the body referred to in letter b).

In other words, therefore, in order for the entity to be
exempted from liability, it is necessary to draw up andimplement preventive organisation plans, endowedwith the utmost efficacy; plans that are, however,circumvented by the Senior Executive committing theoffence.
There is a rebuttable presumption (or iuris tantum,
which admits, therefore, proof to the contrary) thatthe offence belongs to the organisation and to thecompany's policy itself, with a real reversing of theburden of proof which, contrary to the general rules ofcriminal proceedings, falls on the entity subject to theproceedings.
The perspective is diametrically reversed, however,when the perpetrator of the predicate offence isa person subject to the others’ management. In
this case, Article 7 of the Decree provides that theliability of the entity exists only if the commission of
the offence was due to the failure to comply with the
management and control obligations that the entity
should have ensured; this circumstance, in line withthe general principles governing the distribution of
the burden of proof in criminal proceedings, must be
proved in court by the public prosecution, without any
ORGANISATION, MANAGEMENT AND CONTROL MODEL

presumption that the offence was attributable to theentity.
By express provision of Article 7, in the event thatthe predicate offence is committed by an employee,
liability is in any case ruled out if the entity, before theoffence is committed, has adopted and effectively
implemented an organisation, management andcontrol model capable of preventing offences of thesame kind as the one that has occurred.

1.5. Sanctions
The assessment of liability under the Decree exposes
the entity to various types of sanctions, which, basedon the principle of legality set out in Article 2 of theDecree, are expressly identified by the Legislator.
Article 9 of the Decree provides that the following
sanctions are applicable to the entity:— a - fines;— b - disqualification measures;— c - publication of the sanctioning decision;— d - confiscation.
Ascertaining that an offence has been committed
always leads to the application of a fine to theentity, to the extent specified by law, as well as tothe confiscation of the price or profit of the offence,
including for equivalent amounts.
In addition to the fine, the Decree also provides for the
possibility of imposing disqualification measures on theentity - which may also be applied as a precautionary
measure, where the conditions set out in Article 45 of
the Decree are met - as well as the publication of the
sanctioning decision.
1.5.1. Fines
The quantification of the fines applicable under the
Decree is based on a system of determination by“quotas”: for each offence, in fact, the law abstractly
provides for a minimum number and a maximum
number of quotas that can be imposed, similarly to thestatutory framework that traditionally characterise thepenalty system relating to natural persons.
Article 10 of the Decree provides that, in general,the number of fee “quotas” can never be less than
9

one hundred and more than one thousand and thatthe amount of the individual fees must be between
a minimum amount of EUR 258.00 and a maximum
amount of EUR 1,549.00.

offences of the kind that have occurred has been
adopted and implemented;— 3. one-half to two-thirds, if both these
conditions of Article 12(2) are fulfilled.

the entity has been established, the judge determines
the fine applicable in the specific case, following thecriteria indicated in Article 11, namely:――

for the purposes of determining the numberof quotas, take into account the seriousnessof the offence, the degree of the entity's
liability, any activity carried out to eliminate
or mitigate the consequences of the offence
and/or to prevent the commission of further
offences;for the purposes of determining the amountof the individual quota, the economic
and asset conditions of the entity aretaken into account, so that the principle
of proportionality - provided for by in
the Italian Constitution - is complied withand the effectiveness of the sanction is
guaranteed.

Article 12 of the Decree, then, provides that the fine which cannot, however, exceed EUR 103,291.00 - isreduced:— 1. by half if:

a - the perpetrator committed the offence
primarily in his/her own interest or in the interestof third parties and the entity obtained no or
minimal benefit from it;b - the financial harm caused is particularly slight;

1.5.2. Disqualification measures
In the cases provided for by law, the criminal court may
apply the following disqualifications measures to theentity, identified by the Decree in Article 9(2):―disqualification from the exercise of businessactivity;―suspension or revocation of theauthorisations, licenses and concessions
involved in the commission of the offence;―prohibition of entering into contracts with
Government Entities;―

exclusion from benefits, loans, grants or
subsidies and the possible revocation of
those already granted;―

prohibition of advertising goods or services.

Similarly to fines, the criminal court may impose
disqualification sanctions on the entity only where
there is an express statutory provision providing forthem in relation to the predicate offence actuallycommitted. Unlike fines, however, disqualification
measures apply only when at least one of the following
conditions laid down in Article 13 is met:―

— 2. from one third to one half if, before thedeclaration of first instance trial opening(para. 2), one of the following conditions occurs:a - the entity paid full compensation for theharm and eliminated the harmful or dangerous
consequences of the crime or has effectively
taken steps in that regard;b - an organisation model suitable for preventing―

a - the entity has obtained a significant profit
as a result of the offence and the Offence
was committed by Senior Executives
or Subordinates and the commission of
the offence was facilitated by seriousorganisational deficiencies;b - in cases of repeated offence.

In any case, the disqualification measure, pursuant
to the last paragraph of Article 13, without prejudice
to the particular cases provided for in Article 25(5)7,of the Decree, has a duration of no less than three

7 This rule, together with the subsequent paragraph 5 bis, provides for an exceptional regulatory framework for the application ofdisqualification measures with regard to certain offences committed against the Public Administration, and was recently amended by Law No. 3
of 9 January 2019 (the so-called “Spazzacorrotti” Law).	  

ORGANISATION, MANAGEMENT AND CONTROL MODEL

10

months in the minimum and no more than two years in
the maximum.
Given the high interference of this type of sanctions,they must be targeted and punctual in theirapplication: indeed, they must refer specificallyto the sector of activity of the entity in which theoffence was committed (Article 14) and must be
adapted in accordance with the principles of adequacy,
proportionality and subsidiarity 8.
Pursuant to Article 14(3) and (4) of the Decree,disqualification measures may also be applied jointly,
but the - more serious - disqualification from theexercise of business activity must only be applied if theimposition of other disqualification measures proves
inadequate.
Where the prerequisites exist for the application of adisqualification sanction leading to the interruptionof the entity's activity, the court, instead of applying
the measures, may order, under certain conditions,the continuation of the activity, appointing a courtappointed receiver (Article 15).
Article 16 of the Decree then provides for the
possibility of imposing definitive disqualification
measures, such as:――permanent disqualification from the exerciseof business activity, if the entity has derived
a significant profit from the offence anda judgement has already been issued, atleast three times in the last seven years,
imposing a temporary disqualification, or
if the entity (or one of its organisational
units) is permanently used for the soleor predominant purpose of enabling or
facilitating the commission of offences forwhich it is held liable under the Decree;
the prohibition of entering into contracts
with Government Entities or the prohibition
to advertise goods or services, when theentity has already been sentenced to thesame sanction at least three times in the last

seven years.
Finally, Article 17 of the Decree provides for the
exclusion of the application of disqualification
measures where, prior to the declaration of the
opening of the first instance hearing, the following
conditions are met:―a - the entity paid full compensation forthe harm and eliminated the harmful or
dangerous consequences of the offence or
has effectively taken steps in that regard;―b - the entity has eliminated theorganisational deficiencies that led to theoffence by adopting and implementing
organisation models capable of preventing
offences of the same kind as the one thathas occurred;―c - the entity made the profit obtained
available for confiscation.

1.5.3. Publication of the sanctioning decision.
Pursuant to Article 18 of the Decree, the court may
also order, when imposing a disqualification sanction
on the entity, the publication of the sanctioning
decision.
The publication of the sanctioning decision, whether an
excerpt or in full, is carried out in the manner and in
the places defined in Article 36 of the Code9, as well as
by posting in the municipality where the entity has its
head office.
1.5.4. Confiscation of the price or profit of the offence
Pursuant to Article 19 of Decree, sentences imposedon the entity “shall always be accompanied by theconfiscation, also for equivalent value, of the price or
profit of the offence, except for the part that can be
returned to the injured party and without prejudice tothe rights acquired by third parties in good faith”.
Where it is not possible to perform confiscation of theassets that constituted the price or profit of the offence,such confiscation may concern sums of money, assets
or other benefits of equivalent value (confiscation “forequity”).

8 Italian Supreme Court, VI Criminal Division, Judgment No. 20560, of 2010.
  
9 Pursuant to Article 36 of the Italian Criminal Code, the sanctioning decision “shall be published by posting in the municipality where it wasissued, in the municipality where the crime was committed and in the municipality of the last residence of the convicted person”, as well as “onthe website of the Ministry of Justice”.	  

ORGANISATION, MANAGEMENT AND CONTROL MODEL

111.5.5. Precautionary measures
Article 45 of the Decree provides for the possibility ofapplying the disqualifications sanctions laid down in
Article 9(2) as a precautionary measure, if the following
conditions are met:―

serious indices that the entity is liable for an
administrative offence;―

there is founded and specific evidence that
there is a concrete danger that crimes of thesame type as that involved in the case will becommitted.

In this case, disqualification measures are applied tothe entity by the court, at the request of the publicprosecutor.
As a precautionary measure, preventive seizure may
also be ordered, pursuant to Article 53, of things
which, constituting the price or profit of the offenceor their monetary equivalent, are liable to confiscation
pursuant to Article 19 of the Decree. In order toimpose the preventive seizure, the court must assess
the merits of the charge and find serious indications ofliability of the entity10.
Finally, pursuant to Article 54 of the Decree, the judge
may apply the preventive seizure against the entity
if there is “well-founded reason to believe that theguarantees for the payment of the fine, the costs of theproceedings and any other sum due to the Treasury arelacking or are in danger of being lost”.

As already set out in the previous chapter, its adoption
and effective implementation is of particular relevance,
as it may constitute a cause of exemption of the entity
from liability.
This exemption from liability operates differently
depending on whether the perpetrator of the offence
is a senior executive in the entity's structure or asubordinate.
In fact, if the offence has been committed by the latter,the mere adoption of a Model constitutes a (rebuttable)
presumption that the entity is not liable: this meansthat the burden of proof that the organisation model
adopted is not effective lies with the Public Prosecutor(Article 7).
On the contrary, if the predicate offence wascommitted by a top management of the entity, theadoption of the organisation model constitutes only oneof the elements that must exist and of which the entity
must provide proof in order for its liability to be ruled
out: that is, the entity must prove that the offence wascommitted despite the adoption by the entity of aneffective organisational and management model, andthat the commission of the criminal offence was theresult of evasive behaviour on the part of the Senior
Executive (Article 6).

2.2. The content of the Organisation
Model
The Decree itself provides for the indispensable
requirements and contents for the Model to be said tohave been effectively adopted, requiring, in Article 6(2),that it must:— 2. Organisation Model — a - “identify the activities in the context ofwhich the Offences may be committed;
pursuant to Legislative— b - provide specific protocols to plan training
and implementation of the entity’s decisions
Decree 231/2001
regarding the crimes to be prevented;

2.1. Function and legal effects of theOrganisation Model
The Organisation, Management and Control Model
has a preventive-precautionary function with respect
to the potential commission, by persons functionallylinked to the company, of the various types of offences
to which the liability of the entity under the Decree
extends.

— c - determine ways of managing financial
resources suitable for preventing thecommission of offences;— d - impose obligations to inform the bodycharged with overseeing the functioning of andcompliance with the models;

10 Italian Supreme Court, VI Criminal Division, Judgment No. 34505 of 2012.   
ORGANISATION, MANAGEMENT AND CONTROL MODEL12

— e - introduce a disciplinary system suitable forsanctioning non-compliance with the measuresindicated in the model”..

The risk mapping phase represents the first and mostcritical step in the drafting of an effective Model andconsists in identifying the sensitive activities carried out
by the company within the scope of which the risk of
the abstract commission of criminal offences is rooted,
as well as the operating methods through which thecommission of such offences is conceivable.
This first phase is followed by the activity of drawing
up an effective prevention and control system, inwhich safeguards and operational rules are defined
to guarantee the correct formation of the entity's
decisions, as well as their faithful application in thecontext of the activities considered sensitive under the
Decree.
The entity must identify, in a precise manner, thepersons vested with decision-making powers as well as
the criteria that must be applied in taking decisions; itmust also define the authorisation powers, consistently
with the responsibilities assigned and must, finally,outline a clear separation of duties and functions
within the Company.
Particular emphasis is also placed by the Decree on
the specific activity of managing financial resources,
imposing its full regulation within the Model: therationale for this legislative choice is rooted in thefact that, as a rule, the unlawful use of funds by
the company is achieved by concealing their actual
management.
In order to prevent such distortions, it is essential toprovide, within the Model, rules of conduct aimed at
guaranteeing the traceability of decision-making andfinancial flows, which make it possible, if necessary,to quickly ascertain “ex post” the path taken by themoney, as well as the reasons that led the agent tocarry out a given transaction.
Article 6, let. d, provides that, once the body appointed
to supervise the observance and functioning of theModel has been identified - in compliance with theprinciples of autonomy and independence - it shallprovide for timely and regular information, in order toensure the effectiveness of the control and to make itpossible, where necessary, to intervene promptly.
ORGANISATION, MANAGEMENT AND CONTROL MODEL

In addition, Article 6, letter e, in order to effectively
implement the Model, requires an adequate
disciplinary system to act as deterrent mean in order toensure compliance with the provisions and procedures
contained in the Model.
Paragraph 2 bis below, completing what was provided
for in the previous paragraph with regard to the typicalcontent of a Model, requires that information channels
be provided and adequately publicised - at least oneof which must be computer-based - which allow
the persons indicated in Article 5 to submit, for theprotection of the entity, accurate reports of unlawful
conduct relevant under the Decree of which they havebecome aware in the performance of their duties(“whistleblowing”).
Finally, with regard to culpable offences in the fieldof health and safety at work, Article 6 of the Decreerecalls what is laid down in Article 30 of Legislative
Decree 81/2008 (Consolidated Labour Law), where
it is required that the Model provide for “a company
system for the fulfilment of all legal obligations
relating thereto:―a - compliance with the technical andstructural standards of the law relating toequipment, plants, workplaces and chemical,
physical and biological agents;―b - risk assessment activities and the
preparation of the consequent prevention
and protection measures;―c - activities of an organisational nature,such as emergencies, first aid, contract
management, periodic safety meetings,
consultations with workers’ safety
representatives;―d - health surveillance activities;―e - information and training activities forworkers;―f - supervisory activities with reference toworkers’ compliance with procedures andinstructions for safe work;―g - the acquisition of documents andcertifications required by law;13―h - periodic checks on the application andeffectiveness of the adopted procedures.

The Organisation, Management and Control Modelmust, therefore, interact with the other risk prevention
and management systems present in the company
organisation, which, if well-structured and integrated
with each other, determine a maximisation of theprevention purpose and a substantial fungibility ofcontents.

2.3. Tools for drafting theOrganisation Model
Article 6, paragraph 3, of the Decree provides for the
possibility of drafting organisation models on the basisof codes of conduct drawn up by the trade associations
representing the entities, through an approval
procedure involving, inter alia, the Ministry of Justice.
It should be noted, however, that compliance with thesecodes of conduct, which serve as guidelines for thedefinition of the Model, does not automatically exempt
the entity that adopts them from liability: indeed,
these documents consist of mere general provisions,
aimed at fostering a uniform approach and a particularawareness of certain specific issues, and are therefore
in themselves incapable of ensuring the effectivenessof the Model.
Each entity, in fact, has the obligation to draw up andadopt a Model that takes into account its organisationaland management peculiarities, the size and natureof the undertaking, and the type of business activity
carried out.
Among these codes of conduct, in the scope of
Italian legal system, the following guidelines shallbe mentioned: “Confindustria Guidelines to draft
organisation, management and control models”,
recently amended and approved by the Ministryof Justice on 8 June 2021, which aim at “offering
undertakings that have chosen to adopt anorganisation and management model a series ofhints and measures, essentially drawn from company
practice, considered in abstract to be suitable torespond to the requirements outlined in Decree231”11.

2.4. The features of an effective
Organisation Model
In light of the above, an organisation model can be said
to be effective if it is:— specific, i.e. drawn up considering the type, size,
activity and history of the entity;— up-to-date, i.e. constantly updated to meet thechanging needs of the organisation and new and/or changing regulations;— dynamic, i.e. if it ensures continuous control ofthe prevention system, by researching, updating
and identifying new risks and carrying out
periodic checks on the activities or areas ofsensitive business activities;— effective, i.e. effectively implemented within theentity, by means, on the one hand, of compliancewith communication and information obligations
vis-à-vis personnel as well as of differentiatedtraining of the same, distinguishing between
training addressed to employees in general andmore specialised training with reference to those
who work in specific risk areas, to the supervisoryboard and to those in charge of internal control,
and, on the other hand, by means of the provisionof an adequate disciplinary system.

2.5. Organisation Model and Code of
EthicsFinally, it is worth noting that, although not provided
for in Legislative Decree 231/2001, the Code of Ethics
represents a fundamental tool in order to draft a Modelcapable of preventing the predicate offences indicatedtherein, as a document aimed at affirming a principle ofself-regulation for the purpose of preventing offences
and affirming a culture of legality.
The Code of Ethics, in fact, provides for the values
and prescriptions that underpin the entity's corporate
policy and is intended to inform the individual conductof employees and regular partners.

11 Guidelines to draft Organisational, Management and Control Models Pursuant to Legislative Decree No. 231 of 8 June 2001, Introduction,
Confindustria, June 2021.

ORGANISATION, MANAGEMENT AND CONTROL MODEL

14

2.6. Organisation Model and Groups ofCompanies
The Decree does not address the issue of therelationship between administrative liability foroffences and corporate groups; however, thephenomenon of corporate groups represents awidespread organisational solution in the Italianeconomic framework, which is why the subject has
been widely discussed both in doctrine and case law
and by the trade associations representing entities.
In particular, the issue was dealt with by theConfindustria guidelines, which focused on I) the
possibility of holding a group liable under the Decree- excluding it II) the possibility of holding a parent
company liable for the offence committed within thesubsidiaries, and III) the safeguards that the parent
company and the subsidiaries can equip themselveswith to avoid incurring a liability charge under the
Decree.
With regard to the group liability, it is first of allnecessary to emphasise that the Italian legal system,
which recognises the phenomenon of companies
organised in the form of a group - regulating “control”,“connection” and “management and coordination”
between companies - does not however understand it
as an entity, but rather as an aggregation of companies,
lacking autonomous capacity and legal personality, inwhich the companies are linked to each other by the
management power of a single economic entity, but
remain distinct and autonomous from a legal andfinancial point of view.
It follows that, since it is not itself an entity, the “group”
cannot be included among the persons indicated in
Article 1 of the Decree as recipients of the regulatory
provisions: it is therefore not possible to speak of aliability of the group, in and of itself; if anything, it ispossible to speak of a liability in the group.
Since the beginning of the legislation on theadministrative liability of entities, case law has
recognised the possibility that, in groups of companies,
the parent company may be held liable for acts that
occurred within a subsidiary.
Earlier rulings based the parent company's liabilityon the concept of the “group interest”: if the groupis the bearer of a unitary interest for which theparent company’s participation in the definition of

ORGANISATION, MANAGEMENT AND CONTROL MODEL

certain business policy choices of its subsidiaries are
permissible, then the same group interest may also
represent the criterion for holding the parent company
liable in the event that one of the relevant offences iscommitted in a group company.
This, however, could give rise to the automatic
attribution of (strict) liability to the parent company inthe case of an offence committed within a subsidiary.
In its subsequent rulings, the Italian Supreme Court has
therefore come to state that in order hold the holding
company liable, it is necessary for it to have pursued
a concrete interest or derived an actual advantage,
since the criterion of group interest cannot be applied
automatically (Italian Supreme Court, Criminal Division,
judgment no. 24583 of 2011).
Moreover, the Court stated that the person acting
on its behalf must have actually participated in thecommission of the of the predicate offence with theperpetrator, since a generic reference to the role ofparent company, and therefore to the management andcoordination functions exercised, is not sufficient toprove the company's liability.
Belonging to a group cannot, therefore, automatically
imply the liability of the parent company for offences
committed by its subsidiaries.
Similarly, it was stated in Judgment No. 52316 of 2016that “as regards criminal liability of entities, where thepredicate offence has been committed by a company
that is part of a group or business combination,
liability may extend to associated companies only on
condition that:― the interest or advantage of one company
is also accompanied by the interest or
advantage of another company;―

the natural person perpetrator of thepredicate offence is in possession of thesubjective qualification required, pursuant
to Article 5 of Legislative Decree No.
231, for the purposes of the charge ofthe administrative offence due to thecommission of a criminal offence”.

In conclusion, therefore, the holding company/parent
company may be held liable for the offence committed

15

in the activity of the subsidiary if: I) a predicate offence
has been committed in the direct interest or advantage
not only of the subsidiary but also of the parent
company; II) natural persons functionally connectedto the subsidiary have participated in the commissionof the predicate offence by making a causally relevant
contribution in terms of complicity in the offence,
proven in a concrete and specific manner.
The following safeguards are those most commonly
identified as effective so that, within the context ofgroups of companies, charges under the Decree
against the parent company can be ruled out for facts
occurring within the subsidiaries.
First, the carrying out by each subsidiary of an
independent assessment and management of therelevant risks under the Decree and the consequent
drafting and updating of its own organisation model.
The adoption by each group company of its own modelhas two important consequences:―it allows the development of a model that
effectively reflects the organisational realityof the individual company, with a precise
assessment and management of the specificrisks of offences;―it proves an effective autonomy of theindividual group company, reducing thepossibility of an upward shift of liability tothe parent company.

Secondly, the appointment by each group company of
its own, autonomous Supervisory Board, in compliancewith the provisions of Article 6(1)( B) of the Decree.
This does not exclude a power on the part of the parent
company to provide guidelines with respect to theimplementation methods of the organisation models, a
code of conduct structure, common principles of thedisciplinary system and implementation protocols (etc.);
however, this information coming from the parent
company must be implemented by the individual groupcompanies in the scope of their organisational system.

— 3. The organisation,
management and control
model of Prada S.p.A.
3.1. Description of the corporate
structure of Prada S.p.A.
Prada S.p.A. is the holding company of the PradaGroup, which consists of a plurality of companies andcarries out the design, production and distribution ofleather goods, clothing, footwear and accessories andranks among the world leaders in the luxury sector.
The Group owns some of the most prestigious brands
in the luxury sector, Prada, Miu Miu, Church's, Car
Shoe, Luna Rossa and Marchesi 1824, with which itoffers its products worldwide, distributing in morethan seventy countries through a distribution network
consisting of multiple mono-brand shops, a direct
e-commerce channel as well as selected e-tailers
and department stores around the world. It also has
twenty-three production plants of its own - twenty ofwhich are in Italy, one in Great Britain, one in France
and one in Romania - and a total of around thirteen
thousand employees.
The Parent Company Prada S.p.A., with registeredoffice in Milan, Via Antonio Fogazzaro, 28 (IT), is
the Group's operating company and, as such, has amanagement and coordination role with respect to theother subsidiaries.
As of 20 June 2011, the Company placed 20% of its
shares on the Main Board of the Stock Exchange ofHong Kong Limited (“the Stock Exchange of HongKong”) and is, therefore, currently subject, in addition
to the Italian regulations dictated by the Italian Civil
Code, to application of the Code on Corporate
Governance Practices and, more specifically, to therules governing the listing of financial instrumentson the Stock Exchange of Hong Kong (“the Rules
Governing the Listing of Securities on the Stock
Exchange of Hong Kong Limited”).
The Company's Board of Directors, vested with all
powers of ordinary and extraordinary administrationand composed to date of eleven directors - including a
Chairperson, two Managing Directors, two Executive
Directors, one Non-Executive Director and fiveindependent Non-Executive Directors - is entrusted

ORGANISATION, MANAGEMENT AND CONTROL MODEL

16

with the role of governance and coordination of theCompany's business activities, which is also carried out
through specific proxies assigned to the operational
members in their respective areas of responsibility.
In particular, with regard to the Executive Directors, theresponsibilities are divided as follows:— the Chairperson is responsible for the direct

coordination of the Institutional Area (to which
the Corporate Affairs, Investor Relations,Internal Auditing and Risk Management,
Shareholdings and Data Protection Officer
Departments report);— the Managing Directors, to the extent

competent, are responsible for coordinating theStyle, Communication, Industrial, Commercial
and Corporate areas (which include theManagement and Finance, Information
Technology, Management Control, General
Services and Human Resources Departments;— the Chief Financial Officer is in charge of

coordinating the Management and Finance
Department, which includes the Prada S.p.A.
Management, Europe Management and Finance,
Corporate Management Control, Taxation,
Financial Project Stores Corporate Finance,
Consolidated Financial Statements, Project
Finance and Tax Risk Management functions,and the Investor Relations Department.

Pursuant to Article 21.8 of the Articles of Association,
the Board of Directors of Prada S.p.A. appointed
the Internal Control Committee, the Remuneration
Committee, the Appointments Committee and theInside Information Disclosure Committee, whose
regulations were also adopted in compliance with theprovisions of the rules governing the listing of financial
instruments on the Stock Exchange of Hong Kong
Limited.
The Internal Control Committee, comprised of three
independent non-executive directors, is responsible forproviding the Board of Directors with an independent
opinion on the effectiveness of the Company's
financial reporting process, its internal control and risk
management system, and overseeing both the external
and internal audit process, also coordinating the

ORGANISATION, MANAGEMENT AND CONTROL MODEL

activities of the Internal Auditing and Risk Management
Department.
As for the main internal divisions, the Company is
structured as follows:— the Style Area, which defines the underlying

theme of each collection for all the Group's
brands and product lines, designs the sketches
for garments, footwear and accessories, andsets and approves all products to be presented
to the market;— the Marketing and Communication Department,
which is responsible for the development ofstrategic lines in relation to brands, productcategories and target markets;— the individual brand Departments, which

are responsible for the implementation of
the commercial development strategies ofthe brands and the achievement of businessobjectives through the coordination of thevarious corporate departments involved;— the Industrial and Logistics Departments, which

are responsible for the acquisition of raw
materials, industrialisation, implementationand management of production as well as thecoordination of the various stages of storage,
shipment and distribution of the finishedproduct, including aspects relating to theorganisation of transport and customs practices;— the Engineering Department, which is

responsible for the design, implementation andmanagement of investment projects for theretail network, industrial buildings and offices;— the Administration and Finance, Management

Control, Internal Auditing and Risk Management,
and Human Resources Departments, whichguarantee the supervision of all corporate
activities;— the Information Technology Department, whichacts under the direction of the Managing
Directors;17

— the Legal and Corporate Affairs Department,

which deals with the proper management oflegal affairs and, more generally, the Company's
compliance, in civil, criminal and administrative
matters, and reports to the Group GeneralCounsel;— the Real Estate Department, which is incharge of the Group's real estate development
activities.

3.2. The Prada S.p.A. Organisation ModelIn accordance with the regulatory requirements
described above and in order to prevent and avert
liability hypotheses pursuant to the Decree, Prada
S.p.A. has decided to adopt a Model equipped withall the features identified by Article 6, paragraph 2, ofLegislative Decree 231/2001, introduced by resolutionof the Board of Directors on 18 December 2007 andlastly updated by resolution of 3 May 2022.
This initiative was taken in the belief that the adoptionof the Model - notwithstanding the provisions of
the Decree, which indicate it as an optional and not
mandatory element - can be an effective tool to protect
the Company and to raise the awareness of all those
who work in the name and on behalf of Prada, sothat they have, in the performance of their activities,
correct and straightforward behaviours, such as to
avoid the risk of committing the offences indicated by
the Decree.
The Model, in particular, aims at setting up a structured
and organic system, in which, with reference to theactivities considered sensitive under the Decree, theprinciples of conduct and the control activities to becomplied with are provided for in order to prevent thecommission of the diverse types of offence relevant
under Legislative Decree 231/01. In this regard, dueconsideration was given, among other things, tothe guidelines drawn up on the subject by tradeassociations as well as the fact that Prada S.p.A. acts
as the Parent Company of the Group Companies.
To this end, the Company considered it appropriate:―

to identify all the activities within the scopeof which there is an abstract possibility of

ORGANISATION, MANAGEMENT AND CONTROL MODEL

committing the offences indicated in the
Decree;―to adopt specific procedures regulating theprocess of formation and implementation of
the Company's decisions in relation to theoffences to be prevented;―

to define the principles that must guide theRecipients of the Model in the performanceof business activities considered sensitive;―

with specific reference to the managementof financial resources, to provide forrules of conduct and methods for tracing
transactions, including by reference toexisting company procedures;―to implement the principle of separation of
powers, roles and company departments;―

to ensure the identification of authorisation
powers consistent with the responsibilities
assigned;―

to outline a control system aimed at verifying
compliance by the Recipients of the Modelwith the rules of conduct defined therein (inaddition to those described in the abovementioned company procedures);―to raise awareness and disseminate, at alllevels of the company, the rules of conduct
and the relevant safeguards provided for by
the Model and company procedures;―to adopt a specific and suitable disciplinary
system to prosecute and sanction noncompliance with the organisational measuresprovided for;―to assign to the Supervisory Board specifictasks to supervise the effective and correct
implementation of the Model.

Once again, in order to protect the Company from therisks of challenge under the Decree, the Model intends to:―ensure, by monitoring the activities
considered sensitive and the system of18

safeguards and controls relating to them,timely intervention by the Company aimed
at preventing and combating the commissionof predicate offences;―reiterate that such forms of unlawful
conduct are strongly condemned by Prada,
since they are contrary not only to theprovisions of the law, but also to the ethicalsocial principles that the Company promotes
and ensures;―transmit to all the Recipients of thisModel the awareness that they may
incur, in the event of violation of theprescriptions described therein and in thecompany procedures referred to therein,in the commission of an offence, withconsequences that, in addition to affecting
them personally, also affect the Company
pursuant to the Decree;

Finally, it is worth noting that the Company has
adopted a Code of Ethics. Such document, as
mentioned above, although it does not constitute a
structural element of the Model, is to be understood
as fully referred to (see Annex sub A), since all theprinciples and conduct guidelines by which the
Prada Group is inspired and which it requires all the
Recipients of the Model to faithfully comply with are
therein referred to.
Similarly, it shall be noted - being it is emblematicof the compliance and effectiveness of the systemof safeguards adopted by the Company - that Prada,in November 2020, approved - with the Italian Tax
Authority - the “Tax Control Framework” with which,following a joint identification of the tax risks potentiallyreferable to the Company and an assessment of theadequacy of the management system currently in place,a collaborative agreement was entered into by andbetween Prada S.p.a and the Italian Tax Authority.

3.3. Recipients of the Model
The provisions contained in this Model must be
considered binding for all Company Officers,
Employees of all ranks of the Company, as well as
consultants, suppliers and, in general, all persons
with whom the Company has entered into any form

ORGANISATION, MANAGEMENT AND CONTROL MODELof collaboration agreement that takes place within thescope of the activities at risk under the Decree.
In particular, with regard to persons who have enteredinto a contractual relationship with Prada S.p.A., they
are required to sign a specific contractual clause,
undertaking to comply with the principles of conduct
provided for by the Model or, in any case, principles
that are consistent with the rules of conduct on which
the Company's business are based.

3.4. Structure of the Model
In order to draft an adequate and effective Model withrespect to its own corporate structure, Prada S.p.A.
has organised an ad hoc internal work team for the
purpose of drafting and updating the organisation
model pursuant to the Decree, assisted by external
consultants with expertise in corporate compliance andresponsibilities pursuant to the Decree.
Following a prior phase of analysis and study of theCompany's structure, corporate documentation andthe various existing procedures, a mapping of sensitive
activities pursuant to the Decree was carried out,
consisting of planning and conducting interviews withall the Company's departments, which made it possible
to identify the risks of abstract commission of offences,
the functions involved and the relevant hypotheticalmethods of implementation.
Having identified the sensitive activities and therelevant risk profiles, an analysis and an assessmentof the safeguards already adopted by the Company toprevent the aforementioned risks were carried out, as
well as their update, implementation and adaption to
the issues that the Risk Assessment showed and theregulatory updates that, at the same time, affected theDecree.
The entire activity described above has led to theadoption of a Model which, taking into account thetype, size and business activities carried out by theCompany, the internal system of separation of powers
and the existing system of controls to prevent risk, isstructured and articulated according to the following
scheme:— a General Section, outlining the main featuresand structure of the Model;

19

— a Special Section, in which the results of the risk

assessment carried out, the risks considered
relevant in principle and the main rules ofconduct aimed at preventing them are explained,
also by means of recalling corporate procedures
and other corporate compliance documents.

It should be noted that Prada, in order to ensure amore effective prevention of tax-related risks relevant
for the purposes of the Decree, has decided torefer to (or in any case to draw inspiration from) the
corporate document “Tax Control Framework” (“TCF”),
drafted within the framework of the “collaborativecompliance” set forth in Article 3 of Legislative Decree
128/2015 and containing the set of rules, procedures,organisational structures and controls aimed atenabling the detection, measurement, management
and control of tax risk, understood as the risk of
incurring violations of tax regulations or in violation of
the principles and purposes of the legal system (abuseof law).
In fact, within the aforementioned context, theGroup Tax Department, assisted by the Managementin specific areas, carries out planning, analysis andcontrol activities on tax profiles pertaining to the Group,
coordinating with the other Functions/Departments,
responsible for the related governance/management
choices of the Group. In this context, many of the
TCF's safeguards and procedures - albeit adopted froma different perspective than those of the Decree - arereferred to in certain Special Sections of the Model for
their deemed suitability to counter the risks (tax andotherwise) that emerged during the Risk assessment.
It should also be noted that, in order to ensure both
brevity and completeness of the Special Sections of
the Model, the technique of referring to the contentsof the Risk Assessment forms has often been adopted
for what concerns the identification of the risk
areas and the abstractly ways in which offences may
be committed, leaving to the Special Sections thedescription of the rules of conduct aimed at preventing
the risk of their commission or the reference tocorporate compliance procedures already in placethat are deemed suitable to prevent the specific risk ofcommission of the offences taken into consideration.

— General Section

pursuant to the Decree, with a description of therecipients of the regulations, the objective andsubjective prerequisites of the Company's liability(considered both individually and as part of the PradaGroup) as well as the relevant sanctions, the main
characteristics of an efficient and effective organisation
model pursuant to the Decree and, as such, suitable toact as a condition for exempting the company from its
liability were verified.
Following this first abstract description of the contentsof the regulations, the document takes a closer
look at the description of Prada S.p.A.'s corporate
context, indicating the main features of its structure,
as well as the composition and competences of its
top management bodies and the several Departments
forming it.
Such a description of the Company was functional tothe definition of an organisation, management andcontrol model peculiar and specific to Prada S.p.A.'s
reality, capable of complying with the basic principles
and objectives set forth in the Decree and in the
Guidelines issued by the trade associations. The tasks
and functions of the body responsible for supervising
the effective adoption and functioning of the Model(“Supervisory Board”) have also been defined, as wellas the information flows directed to the latter.
Last but not least, the identification of the proceduresby which the Company undertakes to make thecontents of Prada S.p.A.'s organisation model available
to its Employees, Consultants, as well as to all those
who have entered into any form of contractually
regulated collaboration with the Company, informing
them of the need for its effective implementation andinforming them that, in the event of breach, specificconsequences have been identified and provided
for within the Disciplinary System adopted by theCompany.

— SpecialSection

The Special Section of the Model is structured by“crime category” and is divided into eighteen sections,each referring to a specific category of crimes among
those mentioned in the catalogue of alleged crimes,
provided for by in Articles 24 et seq. of the Decree,which could abstractly be committed, in the interest
or to the advantage of the entity, either by senior
executives or by subordinates.

In the General Section of the Model, after defining
and outlining the administrative liability for offences

ORGANISATION, MANAGEMENT AND CONTROL MODEL

20

Each part of the special section, after indicating anddefining the offences forming part of the categoryof offences in particular considered, identifies theactivities which, following to the risk assessment, havebeen deemed as sensitive with respect to the abstract
commission of such offences and describes (alsoby means of the technique of reference to the risk
assessment forms, mentioned above) the principles ofconduct that the Recipients of the Model are required
to adopt in the performance of their duties, as well as
the measures that the Company has taken to monitor
the effective compliance therewith.

— 4. The Supervisory
Board
4.1. The Supervisory Board of Prada S.p.A.

— Annexes

As has already been clarified, Article 6 of Legislative
Decree 231/2001 states that, in order for the entity
to be exempt from liability, it must, inter alia, haveidentified a Supervisory Board (SB) that is independentand vested with autonomous powers of initiativeand control, and which is entrusted with the task ofsupervising the effective and adequate functioning of
the Model and ensuring that it is regularly updated.
In accordance with the aforementioned regulatory
provisions, Prada S.p.a. has its own Supervisory Board,
appointed by resolution of the Board of Directors andvested with powers, duties and functions identified in
specific rules.

3.5. Obligations to update the Model

In order for the Supervisory Board to adequately
perform the function it is entrusted with and toguarantee, therefore, the effectiveness of the systemof safeguards put in place by the Company to preventthe commission of the Predicate Offences, Prada
S.p.A. shall ensure that the Supervisory Board and its
members meet the following requirements:

A detailed list of the offences constituting grounds forthe liability of entities, contemplated in the Decree, iscontained in the document “List of Predicate Offences”,
annexed sub B to this Model.

Annex A - Code of Ethics
Annex B - List of predicate offences
Annex C - List of company framework procedures
Annex D - Health and Safety at Work Organisation andManagement Model

The management body is responsible for the draftingof the organisation model, in compliance with theprovisions of Article 6, paragraph 1, lett. a, of theDecree; thus, subsequent amendments and additionsof a substantial nature are exclusively delegated to theBoard of Directors of Prada S.p.A., which adopts themby means of a specific resolution.
The Company undertakes to ensure a regular andtimely adaptation of the Model to the regulatory,
operational and/or organisational changes that may
occur within Prada S.p.A..
In this regard, the task of the Supervisory Board,as better specified below, is to constantly monitor
that the Model is up-to-date and promptly reportto the Company's Board of Directors the need foramendments and additions.

ORGANISATION, MANAGEMENT AND CONTROL MODEL— a - autonomy and independence;— b - competence and professionalism;— c - impartiality and integrity;— d - effectiveness;— e - continuity of action;— f - appropriate compositiona - Autonomy and independence
The requirements of autonomy and independence
concern both the composition of the Supervisory Boardand its place in the organisation chart of the entity.
In fact, the Supervisory Board must not be in any way
directly or indirectly involved in the company processes
and management activities that are the subject of its
control. Moreover, the Supervisory Board has thehighest possible hierarchical position, answering for its
actions exclusively to the Board of Directors, which has
the power to dismiss it or change its composition onlyin certain, strictly provided for cases.
21

b - Competence and professionalism
The members of Prada S.p.A.'s Supervisory Board must
be in possession of specific technical and professional
skills in the field of corporate compliance and criminal
liability of legal persons, as well as in relation to thespecific activity carried out by the Entity.
c - Impartiality and integrity
This requirement is ensured by the provision of two
specific causes of ineligibility or disqualification,
namely:— a - the existence of a conflict of interest, of any

nature whatsoever, with the supervisory function;— b - having been definitively convicted of any of

the offences provided for in the Decree, as well
as of any other intentional offence whose nature
is such as to render the person unfit to hold theoffice of member of the Supervisory Board.

4.2. Functions and powers of theSupervisory Board
The Supervisory Board of Prada S.p.A., in accordancewith the provisions of the Decree, is entrusted with thefollowing duties:―

supervise the compliance with the provisionsof the Model by directors, representatives,
employees, independent contractors, and ingeneral by all those who work in the nameand on behalf of the Company;―

verify the constant adequacy and updatingof the Model.

These duties consist of a number of specific tasks
briefly summarised below:―

providing for the criteria for reporting in its
own favour for the purpose of identifying
and regularly monitoring “risk areas” and“sensitive processes”;―

verifying the drafting, regular maintenanceand effectiveness of the required
documentation;―

conducting checks of the company's
business activities by triggering the control
procedures, with the support of the relevant
operational management in charge of thefunction;―carrying out periodic checks on specifictransactions or acts concluded within the“activity areas at risk”;

Taking into account the peculiar nature of its powers,
as well as the specific professional content required,
the Supervisory Board, in the performance of its
duties, is assisted, from time to time, by the heads ofthe involved departments, as well as, if necessary, byprofessionals from outside the Company identified on
the basis of their specific skills.

―

promoting the dissemination andunderstanding of the Model, throughtraining and education activities;―

identifying, collecting, processing andstoring all information relevant tocompliance with the Model;

As indicated above, the SB is vested with all the powers
necessary to perform its activities, including thefreedom of initiative and control within the entity, as
well as the autonomous use of the expenditure budget
allocated to it.

―

defining with the Board of Directors thetools for implementing the Model andperiodically check its adequacy;―

conducting internal audit as regards
violations of the Model;

d - Effectiveness
The Supervisory Board shall effectively exercise thepowers conferred upon it by the Board of Directors: forthis purpose, the Supervisory Board keeps track of allcontrol activities carried out internally by filing them in
network folders and/or e-mail boxes.
e - Continuity of action
The Supervisory Board shall:――

ensure the continuity of the supervision of
the Model, with the necessary powers ofinvestigation, intervention and expenditure;ensure that the Model is implemented andregularly updated;

ORGANISATION, MANAGEMENT AND CONTROL MODEL

22

―

submitting requests for the imposition of
sanctions against those responsible for any
violations of the Model.

It is also the task of the Supervisory Board:―

periodically verify - with the support of theother responsible company departments the delegation of powers system in force,
recommending changes if the management
authority and/or qualification is not includedin the authority granted;―

carry out periodic verification activities ofthe Model, aimed at assessing its functioning
and updating;―take care of the creation of a database (hardcopy or electronic) concerning the controls
carried out, training and information
activities, and relevant documentation
pursuant to the Decree.

The Supervisory Board is therefore vested with thefollowing powers and entrusted with the following
duties:— 4. provide for a system of confidential reporting.

Supervisory Board shall collect, process andstore all relevant information in order to ascertain
the effectiveness and adequacy of the Model;— 5. verify and update the Model.

The Supervisory Board shall carry out checks
on the functionality and up-to-datedness of theModel, assessing, periodically or when the needarises, the need to update it.

4.3. Reporting obligations of theSupervisory Board
In order to guarantee its full autonomy andindependence in performing its functions, theSupervisory Board communicates directly with theCompany's Board of Directors and the Board of
Statutory Auditors.
In particular, the Supervisory Board reports to theBoard of Directors and the Board of Statutory Auditorson the implementation of the Model, the results of thesupervisory activity carried out and any appropriate
action to implement the Model:―

on a regular basis to the Board of Directors
and, at least twice a year, by means of awritten report;―

periodically to the Board of Auditors, or at
its request;―

occasionally to the Board of Statutory
Auditors, in cases of alleged violations by
top management or Board of Directors
members, being able to receive requests for
information or clarifications from the Boardof Statutory Auditors.

— 1. know the Model and assess its suitability toprevent the offences indicated in the Decree.
Upon taking office, the members of theSupervisory Board must carry out an analysisof the Model, providing for an opinion on its
suitability to prevent the commission of theoffences indicated in the Decree. However, themere change in the structure and/or compositionof the Supervisory Board, in the absence of a
specific need to adapt or update the Model, does
not require renewed approval of the latter;— 2. disseminate knowledge of the Model.

The Supervisory Board promotes all the initiatives
necessary for the dissemination and effective
knowledge of the Model by the Addressees;— 3. monitor risk areas.

The Supervisory Board must carry out targeted
periodic checks on specific operations or acts
performed within the areas at risk;

ORGANISATION, MANAGEMENT AND CONTROL MODEL— 5. Information flows
to the SB
Article 6(2)(d) of the Decree, in identifying theconditions for the entity to be exempt from liability,
also provides for “obligations to provide information to
the body responsible for supervising the operation ofand compliance with the models”.
23The provision of such information flows, whichenable the Supervisory Board to be regularly andcontinuously updated on the Company's management
and operations, constitutes an essential element for theSupervisory Board to adequately perform its task ofmonitoring the effective implementation of the Model.
To this end, the Company has provided that, in addition
to the documentation expressly indicated in eachSpecial Section, in accordance with the procedurescontemplated therein, any other information pertaining
to the implementation of the Model and to any
violations of the prescriptions therein must be brought
to the attention of the Supervisory Board.
In particular, among the information flows provided
for towards the Supervisory Board, reference shall bemade to:――those of the Board of Directors and thevarious Company departments, which may
be periodical or event-driven and provide
the Supervisory Board with an update on,for instance, the activities carried out by
the various departments with a view toimplementing the Model, the safeguards
implemented to protect against relevantrisks pursuant to the Decree, changes tothe existing system of delegated and proxy
powers, and any violations detected;
those which, on the other hand, may
originate from any Senior Executives and/or Subordinates of the Company (to beunderstood in the widest sense, as describedin the above paragraphs) and concern thereporting of unlawful conduct relevant
under the Decree or any other violation of
the Model, integrated by the Recipients of
the latter.

5.1. Information flows of the Board of
Directors and corporate departments
The Board of Directors and all company departments,
according to their competences, are required topromptly inform the Supervisory Board of any
circumstance or information relevant to the Decree andto the effective implementation of the Model.
In particular, they must always communicate to theSupervisory Board all information concerning:
ORGANISATION, MANAGEMENT AND CONTROL MODEL―

any decisions relating to the application for,disbursement and use of public funds;―

measures and/or news concerning theexistence of criminal proceedings, evenagainst unknown persons, for facts
potentially involving the Company's businessactivities;―

measures and/or news concerning theexistence of significant administrative
proceedings or civil disputes relating torequests or initiatives by independent
authorities, the financial administration,
local administrations, Public Administration,
concerning contracts, requests for and/or
management of public financing;―

requests for legal assistance forwarded
to the Company by Senior Executives
or Employees in the event of thecommencement of criminal or civil
proceedings against them;―

the findings of enquiry commissions,inspections, audits or other internal reports
from which hypotheses of liability for thecommission of offences falling within the
catalogue of predicate offences identified by
the Decree emerge;―

information on the effective implementation,at all company levels, of the Model;―

information about disciplinary proceedings
and sanctions imposed or orders to closesuch proceedings and the rationale for thesame.

The above persons must also transmit to theSupervisory Board all documents, regularly updated,concerning the system of proxies and powers of
attorney in force at Prada S.p.A..
To this end, the Company has provided for information
flows, on a periodic basis, from the Board of Directors
and the corporate functions to the Supervisory Board,as well as event-driven information flows in the eventthat any of the aforementioned persons should findviolations of the Model.

245.2 Whistleblowing
Article 6(2bis), (2b) and (2c) of the Decree provides
that the organisation, management and control models
require channels enabling employees, consultants,
independent contractors and any other person
coming into contact with the Company to report any
irregularities they may have become aware of in thecourse of their duties.

―

that the whistle-blower’s retaliatory or
discriminatory dismissal be null and void,as is a change in his/her job duties under
Article 2103 of the Italian Civil Code, as wellas any other retaliatory or discriminatory
measure taken against the whistle-blower(Article 6(2-quater)).

―one or more channels enabling the persons
indicated in Article 5, letters a) and b) tosubmit, for the protection of the entity's
integrity, circumstantiated reports of
unlawful conduct relevant under the Decreeand based on precise and concordant
factual elements, or of violations of theModel, of which they have become aware
through the functions performed. Thesechannels must guarantee the confidentialityof the reports made, to protect both thereporter and the reported person;

On the other hand, in order to ensure the proper useof the protection tool made available by the Company,
the Decree has also provided for a form of liability, of
a disciplinary nature, for the whistle-blower reporting
violations that turn out to be unfounded, if there isevidence that they were made by the whistle-blower
with intent or gross negligence (Article 6(2bis)(d)).
In accordance with Article 6 of the Decree and in order
to allow the Supervisory Board to effectively performthe duties entrusted to it, Prada S.p.A. has adopted asystem that allows all the Recipients of the Model andany third parties to report to the Supervisory Board
any violation, anomaly or suspicious activity, in relation
to the commission or risk of commission of one of thePredicate Offences, of which they have become aware
for any reason whatsoever.

―at least one alternative reporting channel
suitable for ensuring the confidentiality of
the identity of the whistle-blower using IT
methods;

The company has, in fact, set up the following
communication/reporting channels, which areconfidential and managed by the Supervisory Boardonly:

In particular, Article 6(2a) stipulates that the Model
must provide for the establishment of:

At the same time, the Decree also outlined theminimum system of safeguards to be put in place toprotect the reporting party, stating:―the prohibition of retaliation or
discriminatory, direct or indirect, acts
against the whistle-blower for reasons,directly or indirectly, related to the report(Article 6(2-bis)(c));―

that the disciplinary system must provide
for sanctions against those who breach thewhistle-blower protection measures (Article
6(2-bis)(d));―

the power of the trade union organisation
indicated by the whistle-blower to report the
adoption of discriminatory measures against
the whistle-blower to the National Labour
Inspectorate (Ispettorato Nazionale delLavoro) (Article 6(2-ter));

ORGANISATION, MANAGEMENT AND CONTROL MODEL— an external platform, called Whispli, accessible

via the web from any device, using the following
link: https://pradagroup.whispli.com.
It ensures the confidentiality of the whistleblower's identity and the content of the reportby means of secure protocols and encryption
tools that protect the personal data andinformation provided. Reports can also be
submitted anonymously by selecting theappropriate option within the software;— an e-mail address (organismo.vigilanza@prada.
com), also accessible on the company intranet,at the exclusive disposal of the Supervisory
Board, through which each person may at any
time communicate with the Supervisory Board,in the knowledge that this communication
channel guarantees the confidentialityof the identity of the reporter and of thecommunication transmitted.

25

Ascertaining whether the report is well-founded is
entrusted to the Supervisory Board, the sole recipientof the reports, which is required to carry out a prompt
and accurate investigation, in compliance with theprinciples of impartiality, fairness and confidentiality, in
respect of all the persons involved.
The Supervisory Board guarantees whistle-blowers
against any form of retaliation, discrimination or
penalisation, also ensuring the confidentiality of theiridentity (without prejudice to duties under applicablelaw), as well as acting to ensure the confidentiality ofthe person involved in the report.
In carrying out its checks, the Supervisory Board may
avail itself of corporate departments concerned fromtime to time and, where it deems it appropriate, of
external consultants specialised in the field of thereport received.
The person involved in the report must always be
granted the opportunity to be heard and to provide anynecessary clarification of the facts alleged against him/her.
If the verification activity carried out establishes thatthe report is well-founded, the Supervisory Board
drafts a report summarising the investigations carriedout and the evidence that has been found, and sharesit with the corporate departments involved on the basisof the subject of the report, in order to define any
intervention plans and actions to be taken to protect
the Company and the Group.
If, on the other hand, the outcome of the checks
reveals the absence of well-founded elements or, in
any case, the unfounded nature of the facts referred
to in the report, the latter must be filed, together withthe relevant reasons, and any subsequent initiatives/
measures to be taken must be assessed.
The Supervisory Board periodically reports on thetypes of reports received and the outcome of its
investigations to the Board of Directors, the Internal
Control Committee and the Board of Auditors.
The Company has endeavoured to inform all the
Recipients of the Model of the existence of thecommunication channels described above and to
explain how they can be used, as well as the forms ofprotection and liability provided for both the reporterand the person involved in the report. To this end,
ORGANISATION, MANAGEMENT AND CONTROL MODEL

special corporate information has been preparedand disseminated and ad hoc operating instructions
have been drawn up, which are available and can be
consulted on the corporate intranet.

— 6. Disseminationof the model andpersonnel training
In accordance with the Decree, Prada S.p.A. has
defined a communication and training plan aimed
at ensuring the correct dissemination of the Modeland the rules of conduct contained therein, towards
employees already present in the company and thoseto be hired, with different degrees of in-depth analysis
depending on the different level of involvement of thesame in activities at risk.
The information and training system is supervised andintegrated by the Supervisory Board, in cooperation
with the Human Resources Department and theheads of the Company Departments involved in theapplication of the Model from time to time.
In relation to the communication of the Model,
Prada organised specific training meetings with Top
Management, during which the Decree and the Model
adopted were illustrated, and prepared a specific online
training intended for all personnel with employee,
middle management or executive status. Furthermore,
the Model and the Code of Ethics have been publishedon the company Intranet, so as to ensure theirdissemination to all Recipients.
However, different training activities to raiseawareness of the regulations referred to in the Decree
shall be provided, in terms of content and delivery
methods, according to the Recipients’ position within
the Company, the level of risk of the area in which
they operate and whether or not the Recipients are
Company Representatives.
Initial communication and periodic training activities
for company personnel are documented by theSupervisory Board and the Human Resources
Department.

26

By means of a specific contractual clause, Pradarequires suppliers, consultants and other persons withwhom it has entered an agreement, to comply with its
Model or, in any case, to observe rules of conduct andcorporate compliance procedures that are consistent
with those adopted by the Company, undertaking to
make this Model available to the latter at the time ofthe execution of the agreement.

— 7. The disciplinary
systemArticle 6(2) of the Decree also includes, among theessential elements for the effectiveness of the Model,
the adoption by the entity of a disciplinary systemcapable of sanctioning the violations of the measuresand prescriptions contained therein.
As already stated several times, the principles
contained in the Model and the rules/procedures ofconduct that refer to it form, in fact, a set of rules
which all members of the corporate bodies, employeesof the Company, as well as external consultants and all
those who have contractual relationships with Prada
S.p.A., must observe.
In order to ensure the effectiveness of these provisions,the Company provides that any violations of the Modelshall be sanctioned in accordance with the following
procedures and principles.
First of all, it shall be clarified that the disciplinary
system will be applicable in the event that violations of
the Model are ascertained, regardless of the initiationor outcome of any criminal proceedings.
The seriousness of the breach will be assessed
according to:— 1. the intentional nature of the conduct
or degree of negligence, imprudence
or inexperience, with regard also to theforeseeability of the event;—2 . the overall conduct of the perpetrator, alsowith reference to previous infringements;— 3. the tasks performed and the functional
position held by the perpetrator.

ORGANISATION, MANAGEMENT AND CONTROL MODEL

By way of example, but not limited to, each of thefollowing conducts constitutes a violation:— 1. non-compliance, including through omissive

conduct and in possible concurrence withothers, with the general rules of conduct andprocedures set out in the Code of Ethics and theModel;— 2. failure to submit and/or irregular drafting of

the documentation required by the proceduresand protocols;— 3. violation or avoidance of the control systems
provided for by the Model, carried out inany way, including the removal, destructionor alteration of documentation relating toprocedures, as well as obstruction of controls
and any other hindrance to the persons andbodies in charge of control functions;— 4. failure of hierarchical superiors to supervise
the conduct of their subordinates with regard
to the correct and effective application of theprinciples contained in the Model;— 5. any other conduct, commission or omission,

which harms or endangers Prada's interest in
the effective and correct implementation of theModel.

Pursuant to Article 6, para. 2-bis, lett. d) (recently
introduced by Law of 30/11/2017 no. 291), violationsof the measures aimed at protecting the person
reporting unlawful conduct or violations of theModel (whistleblowing), i.e. abuses of the reporting
procedures, carried out by those who, with intent or
gross negligence, make allegations that turn out to becompletely unfounded following the prescribed checks,
are also punishable.
The Supervisory Board shall be informed bothof violations and of any sanctions applied as aconsequence thereof.
The exercise of disciplinary power against Prada
S.p.A. employees - which shall be carried out incompliance with Article 7 of Law 300/1970 and theapplicable collective bargaining agreements - shallbe the responsibility of the bodies and/or internal
departments of the Company that have, or have been
vested with, the exercise of such power.
27

Recipients of Prada's disciplinary system are all
employees of the Company, as identified by articles
2094 et seq. of the Italian Civil Code, including workers
belonging to the management.
In particular, new organisational measures may be
adopted against managers pursuant to Article 2103
of the Civil Code, as well as, where appropriate,
termination of the employment relationship pursuant
to Articles 2118 and 2119 of the Civil Code. In any case,the imposition of sanctions must take into accountthe applicable provisions of the national collective
bargaining agreements (CCNL) of the relevant category
and may not conflict with the general principles
referred to therein as well as with the legal provisions
dictated by the Workers' Statute as well as with otherregulations in force in the industry.
With regard to independent contractors pursuant to
Article 2222 of the Italian Civil Code (self-employedworkers) or pursuant to Article 409 of the Italian Civil
Code (quasi-subordinate workers), who provide theirservices in favour of the Company and, in general, withregard to external consultants, as well as to all those
who have contractual relationships with Prada,
ascertained violations of the Model may even lead tothe termination of the contract.
The disciplinary sanctions that can be imposed are set
out in more detail below:— Disciplinary sanctions imposed on employees

The violation of the law, of the provisions of
the Code of Ethics of Prada S.p.A. and of
the provisions of this Model, committed by
employees of the Company, as well as, in general,
behaviours likely to expose Prada S.p.A. to theapplication of administrative sanctions provided
for by the Decree, may result in the application
against such persons, on the basis of the criteria
set out above - in compliance with the limits
set forth in Article 2106 of the Civil Code andArticles 7 and 18 of Law 300/1970 - of dismissal
or sanctions other than dismissal provided
for by Articles 62 (Disciplinary measures), 63(Procedure for the imposition of disciplinary
measures) and 64 (Dismissal) of the National
Collective Bargaining Agreement for Leather andSubstitutes (CCNL Pelli e succedanei).

— Executives

In light of the trust that characterizes the

ORGANISATION, MANAGEMENT AND CONTROL MODEL

employment relationship with executives, theviolation of the provisions of the law, of theprovisions of the Code of Ethics and of theprovisions set forth in this Model committed by
Prada S.p.A.'s executives as well as, in general,
conducts that may result in the Company to be
subject to the application of the administrative
sanctions provided for by the Decree, may leadto the application - in compliance with articles
2118 and 2119 of the Italian Civil Code as well aswith Article 7 of Law 300/1970 - of the measures
set forth in the collective bargaining agreement
for the category (CCNL-DAI), against such
persons. Ascertainment of any violations, as wellas inadequate supervision and failure to provide
timely information to the Supervisory Board,
may also result in the precautionary suspension
from work for employees with managerial
status, without prejudice to the manager's rightto remuneration, as well as the assignment todifferent tasks in compliance with Article 2103 of
the Italian Civil Code.

— Self-employed workers, external consultants

and partners
Contracts that the Prada S.p.A. enters into with
self-employed workers, external consultants andpartners must contain a specific representationthat they are aware of the existence of theCode of Ethics and the Model and an obligation
to comply with the latter, or, if the party isforeign or does business abroad, to comply withinternational and local laws on preventing risks
that could cause Prada to be liable as the resultof the commission of crimes. Contracts with theabove persons must contain a specific withdrawal
and/or termination clause associated with
noncompliance with such obligations, with theCompany retaining the right to compensation fordamages incurred as the result of such conduct,
including damages caused by the application of
the sanctions provided for in the Decree.

— Directors

Given the responsibility of the Directors, in theevent of violations of the provisions of the Modelby one of them, the Supervisory Board shallinform the Board of Directors and the Board of
Statutory Auditors. It will then be up to the Boardof Directors to assess the violation and take themeasures deemed appropriate, in compliancewith the regulations in force.
28