IBERSOL | Integrated Management Report 2022

CORPORATE GOVERNANCE REPORT 54. Description of the identification, assessment, monitoring, control and risk management process. The internal risk management process in the Ibersol Group is based on guide- lines common to the main risk management frameworks, considering a cycli- cal approach consisting of five main stages: The phases of risk identi- fication and treatment are typically more decentral- ised and associated to the different functional and business areas, while the analysis, assessment and ‘monitoring and revision’ phases are generally tack- led by the latter in interac- tion with the Board. This operating model makes it possible to maintain a high level of awareness, accountability, and control in the approach to the different types of risks that affect the organisation. The follow- ing scheme is a representation of the main groups of risks considered relevant in terms of their probability of occurrence and level of potential impact. As a structured approach, Risk Management is integrated throughout the Group’s planning process. Its purpose is to identify, evaluate and manage the opportunities and threats that Ibersol’s businesses face in pursuit of their value creation goals. In the context of strategic planning, the risks of the business portfolio, as well the risks of development of new businesses and the implementation of the most important projects are identified and assessed, and strate- gies to manage those risks are defined. At operational level, the risks of each business are identified and as- sessed and actions are planned to manage those risks. These actions are included and monitored within the scope of business plans and func- tional units. As regards the risks to the security of tangible assets and persons, poli- cies and standards have been established and are monitored to ensure compliance. All units are subject to external audits and preventive and corrective measures are taken in respect of the risks that have been identified. 322