IBERSOL | Integrated Management Report - 2024

CORPORATE GOVERNANCE REPORT The phases of risk identification and treatment are typically more decentralised and associated to the different functional and business areas, while the analysis, assessment and monitoring and revision phases are generally articulated by the latter in interaction with the Board. This operating model makes it possible to maintain a high level of awareness, accountability, and control in the approach to the different types of risks that affect the organisation. As a structured approach, Risk Management is integrated throughout the Group’s planning process. Its purpose is to identify, evaluate and manage the opportunities and threats that Ibersol’s businesses face in pursuit of their value creation goals. In the context of strategic planning, the risks of the business portfolio, as well the risks of development of new businesses and the implementation of the most important projects are identified and assessed, and strategies to manage those risks are defined. At operational level, the risks of each business are identified and assessed and actions are planned tomanage those risks. These actions are included and monitored within the scope of business plans and functional units. As regards the risks to the security of tangible assets and persons, policies and standards have been established and are monitored to ensure compliance. All units are subject to external audits and preventive and corrective measures are taken in respect of the risks that have been identified. The probability and impact indices of the “risk groups” are obtained through the average of the probability and impact indices of the Functional/business areas Board/central management 292