The Risk Control and Management Policy, approved by the Board of Directors, establishes the general framework for the control and management of risks of various kinds that the management team may encounter in the pursuit of business objectives, as well as the acceptable risk and the level of tolerance per risk factor. The Board establishes and periodically reviews the risk appetite.

EFFECTIVE RISK MANAGEMENT. FERROVIAL RISK MANAGEMENT

The company has a risk identification and assessment process, called Ferrovial Risk Management (FRM), managed by the Compliance and Risk Department, promoted by the Management Committee and implemented in all the company’s business units, under the periodic supervision of the Audit and Control Committee of the Board of Directors.

Through the application of common metrics, the process allows to identify risk events in advance and assess them in terms of their probability of occurrence and their potential impact on business objectives, including corporate reputation. In this way, Ferrovial can take the most appropriate mitigation measures according to the nature of the risk.

For each risk event identified, two assessments are made: an inherent assessment prior to the specific control measures implemented to mitigate the risk, and a residual assessment, after specific control measures have been implemented.