RADL3 Controls: COSO Stack, Suspended Market-Risk Policy
Internal-control FRE pages are easy to skim as boilerplate. Raia Drogasil (RADL3) is interesting because the filing pairs a full COSO / Three Lines narrative with an explicit note that the Market Risk Policy is suspended — and few quantitative control-test metrics.
This page summarizes an internal-controls analysis from the 2025 FRE. apicvm returns the filings.
The research question
> How does management describe the control environment, and what limitations are disclosed?
Control environment (as described)
| Element | Disclosure |
|---|---|
| Ledger / ERP | SAP for financial recording/integration; daily finance monitoring; Controllership review |
| Close process | Quarterly statements with internal review; Audit Committee + Board approval |
| Frameworks | COSO Internal Control — Integrated Framework 2013; IIA Three Lines |
| Risk methodology | ISO 31000, COSO ERM, IBGC; impact/probability in four levels; higher risks reassessed more often |
| Risk Policy | Board-approved originally 2017, updated 17 May 2024 |
| Internal Audit | Independent evaluations to Audit Committee |
| External audit (2024) | Management cites no significant internal-control deficiencies identified |
Culture/compliance actions cited: training, workshops, Integrity Program under continuous update.
Attention points in the same FRE
- Market Risk Policy — published on the website but explicitly suspended and not applied as an active management instrument at the time of the filing.
- Thin quantitative efficacy metrics — limited disclosure of control-test pass rates, defect counts, or remediation aging that would let an outsider score operational effectiveness numerically.
Research takeaway
“Clean auditor language” plus a suspended market-risk policy is a research signal, not a contradiction to ignore. Pull name=Controles (and risk-policy sections) when agents score control maturity.
Replicate with apicvm
export APICVM_KEY='apicvm_...'
export APICVM_URL='https://apicvm.dev'
curl -H "Authorization: Bearer $APICVM_KEY" \
"$APICVM_URL/v1/companies/resolve?query=RADL3&by=ticker"
curl -H "Authorization: Bearer $APICVM_KEY" \
"$APICVM_URL/v1/documents?ticker=RADL3&type=FRE&year=2025&name=Controles"
curl -X POST -H "Authorization: Bearer $APICVM_KEY" \
-H "Content-Type: application/json" \
-d '{"callback_url":"https://your-server/callback","document":{"id":"<id>"}}' \
"$APICVM_URL/v1/document-text-extractions"Methodology note
Findings above come from a completed Hold analysis of the company's public 2025 FRE. This is a research illustration, not investment, legal, or tax advice. Verify numbers against the original filing before trading, modeling, or publishing reports.
Limitations
- apicvm returns filings and extracted text — it does not classify risks or compute coverage ratios.
- Figures are as of the FRE filing date; later ITRs or facts relevantes can update them.
- Corpus coverage depends on ingestion lag.
Next steps
Ready to integrate?
Get an API key and start querying Brazilian CVM filings programmatically.