Under the Swedish Companies Act and the Code, the Board of Directors is required to ensure that the Company has adequate internal controls, stay informed of the Company’s internal control system and assess how well the system works. Episurf’s internal control can be divided into the control environment, risk assessment, control activities, information and communication, and monitoring.

Episurf Medical’s internal investigations are run by the Board, CEO and CFO, which is considered to meet the requirements placed on the company given its size. The Board evaluates annually the need to establish an internal audit function.