IBERSOL | Integrated Management Report | 2025

INTEGRATED MANAGEMENT REPORT 2025 Recommendation / Content Degree of compliance Governance Report VII.4. The internal control system, comprising the risk management, compliance and in- ternal audit functions, is structured in terms that are adequate to the size of the company and the complexity of the risks inherent to its activity, whereby the su- pervisory body shall assess it and, within the ambit of its duty to monitor the effec- tiveness of this system, propose any adjustments that may be deemed necessary. adopted 38, 50, 51, 52, 54 and 55 VII.5. The company establishes procedures for the supervision, periodic assessment and adjustment of the internal control system, including an annual assessment of the degree of internal compliance and performance of such system, as well as the prospects for changing the previously defined risk framework. adopted 24, 38 and 50 to 55. VII.6.(1) Based on its risk policy, the company sets up a risk management function, identify- ing (i) the main risks to which it is subject in the operation of its business, adopted 24, 38 and 50 to 55. VII.6.(2) (ii) the probability of their occurrence and respective impact, adopted 24, 38 and 50 to 55. VII.6.(3) (iii) the instruments and measures to be adopted in order to mitigate such risks and adopted 24, 38 and 50 to 55. VII.6.(4) (iv) the monitoring procedures, aimed at following them up. adopted 24, 38 and 50 to 55. VII.7. The company establishes processes to collect and process data related to the environmental and social sustainability in order to alert the management body to risks that the company may be incurring and propose strategies for their mitiga- tion. adopted 29 and 50 to 55. 323