IBERSOL • 2023 Integrated Management Report

INTEGRATED MANAGEMENT REPORT 2023 At operational level, the risks of each business are identified and assessed and actions are planned to manage those risks. These actions are included and monitored within the scope of business plans and functional units. As regards the risks to the security of tangible assets and persons, policies and standards have been established and are monitored to ensure compliance. All units are subject to external audits and preventive and corrective measures are taken in respect of the risks that have been identified. The probability and impact indices of the “risk groups” are obtained through the average of the probability and impact indices of the respective risk components, being essentially qualitative in nature. To ensure compliance with the established procedures, the Group’s main internal control systems are evaluated periodically. 55. Main elements of the internal control systems and riskmanagement implemented by the company regarding the financial disclosure process. The Company does not have any internal audit services reporting directly to the Audit Board (given the classic model adopted), the necessary compliance services being overseen by the individual departments of the company. Considering that, organically and functionally, the different Directions of the Group direct the “compliance” services in articulation with the Board of Directors and the Audit Board and being the respective heads of these different Directions duly identified in the Company’s organization chart, it is important to restate that they act in interaction with the Audit Board and with the Board of Directors, regardless of the hierarchical relationship that these Departments maintain with the Executive Management of the Company. The External Audit assesses and reports the risks of reliability and integrity of the accounting and financial information, thus validating the internal control system established in the Group and which is materialized in the clear separation between those who prepare and their users and in the performance of various procedures of validation throughout the process of preparing and disclosing financial information. 331