IBERSOL • 2023 Integrated Management Report

CORPORATE GOVERNANCE REPORT 54. Description of the identification, assessment, monitoring, control and risk management process. The internal risk management process in the Ibersol Group is based on guidelines common to the main risk management frameworks, considering a cyclical approach consisting of five main stages: The phases of risk identification and treatment are typically more decentralised and associated to the different functional and business areas, while the analysis, assessment and ‘monitoring and revision’ phases are generally tackled by the latter in interaction with the Board. This operating model makes it possible to maintain a high level of awareness, accountability, and control in the approach to the different types of risks that affect the organisation. As a structured approach, Risk Management is integrated throughout the Group’s planning process. Its purpose is to identify, evaluate and manage the opportunities and threats that Ibersol’s businesses face in pursuit of their value creation goals. In the context of strategic planning, the risks of the business portfolio, as well the risks of development of new businesses and the implementation of the most important projects are identified and assessed, and strategies to manage those risks are defined. Functional /business areas Board /central managements 330