As part of its Risk Management activities, the Group uses non-speculative hedging contracts to limit exchange rate risk and interest rate risk.

• Liquidity risk - represents the risk that financial resources available to the company will be insufficient to cover financial and trade commitments in accordance with the agreed terms and deadlines.
  The procurement of financial resources has been centralised in order to optimise their use. In particular, centralised management of cash flows in Iren makes it possible to allocate the funds available at the Group level according to the needs that from time to time arise among the individual companies. 

• Exchange rate risk - except as indicated in the section on energy risk, Iren Group is not significantly exposed to exchange rate risk.

• Interest rate risk - Iren Group is exposed to fluctuations in interest rates, especially with regard to financial expenses related to debt. Iren Group’s strategy is to limit exposure to the risk of interest rate volatility, maintaining at the same time a low cost of funding, diversifying sources of funding.
  Compliance with the limits imposed by the Policy are verified during the Financial Risk Commission meetings with regard to the main metrics, together with analysis of the market situation, interest rate trends, the value of hedges and confirmation that the conditions established in covenants have been met.

Compliance with the limits imposed by the Policy are verified during the Financial Risk Commission meetings with regard to the main metrics, together with analysis of the market situation, interest rate trends, the value of hedges and confirmation that the conditions established in covenants have been met.

The Group’s credit risk is mainly related to trade receivables deriving from the sale of electricity, district heating, gas and the provision of energy, water and waste management services. The receivables are spread across a large number of counterparties, belonging to non-uniform customer categories (retail and business customers and public bodies); some exposures are of a high amount and are constantly monitored. Iren Group’s Credit Management units devoted to credit recovery are responsible for this activity.

In carrying on its business, the Group is exposed to the risk that assets may not be honoured on maturity with a consequent increase in their age and in insolvency up to an increase in assets subject to arrangement procedures or unenforceable. Among other factors, this risk is still also affected by the economic and financial situation, which in 2022, led to a particularly significant increase in prices for end customers of gas, electricity and district heating. To limit exposure to credit risk, a number of tools are used. These include analysing the solvency of customers at the acquisition stage through careful assessment of their creditworthiness, transferring the receivables of discontinued and/or active customers to external credit recovery companies and introducing new recovery methods for managing legal disputes. In addition, numerous payment methods are offered to customers through channels, including digital channels, and appropriately monitored payment plans are proposed.

The credit management policy and creditworthiness assessment tools, as well as monitoring and recovery activities, are managed through automated processes and integrated with company applications and differ in relation to the various categories of customers and types of service provided.

Credit risk is hedged, for some types of business customers, with opportune forms of first-demand bank or insurance guarantees issued by subjects of leading credit standing and with credit insurance for the reseller customer segment.

An interest-bearing guarantee deposit is required for some types of services (water, natural gas, highly- protected electricity sectors) in compliance with regulations governing these activities. This deposit is reimbursed if the customer uses payment by direct debit from a current account. The payment terms generally applied to customers are related to the legislation or regulations in force or in line with the standards of the free market; in the event of non-payment, default interest is charged for the amount indicated in the contracts or by the legislation.

The loss allowances impairment reflect, carefully and in accordance with the current legislation (applying the IFRS 9 method), the effective credit risks, and are determined on the basis of the extraction from databases of the amounts making up the receivable and, in general, assessing any changes in the said risk compared to the initial measurement and, in particular for trade receivables, estimating the related expected losses determined on a prospective basis, taking into due consideration the historical data.

The control of credit risks is also strengthened by the monitoring and reporting procedures, in order to identify promptly possible countermeasures. Furthermore, on a quarterly basis, a report is produced containing the evolution of the trade receivables of the Group companies, in terms of customer type, contract status, business chain and ageing range. The assessment of credit risk is carried out both at the consolidated level and at the level of Business Units and companies. Some of the above assessments are carried out at intervals of less than three months or when there is a specific need.

Iren Group is exposed to price risk on the energy commodities traded, these being electricity, natural gas, environmental emission certificates, etc., since both purchases and sales are affected by fluctuations in the price of these commodities directly, or through indexing formulae. Currently no exposure to exchange rate risk, typical of oil-based commodities, is present, thanks to the development of the European organised markets that trade the gas commodity in the euro currency and no longer indexed to oil products.

The Group’s policy is oriented to a strategy of active management of the positions to stabilise the margin taking the opportunities offered by the markets; it is implemented by aligning the indexing of commodities purchased and sold, through vertical and horizontal use of the various business chains, and operating on the financial markets.

For this purpose, the Group plans the production of its plants and purchases and sales of energy and natural gas, in relation to both volumes and price formulae. The objective is to achieve sufficient margin stability through a policy of indexed purchases and sales that achieves a high degree of natural hedging, with adequate recourse to futures and spot markets.

In this context, particular attention is being paid to stabilising the margin of production from renewable sources; during 2023, Power Purchase Agreements were negotiated for electricity from renewable sources to end customers, either directly or indirectly according to the logic of portfolio aggregation and subsequent sale on the market effective 2024.

Iren Group has included in the Enterprise Risk Management system a Risk Policy dedicated to climate change risks, which are becoming increasingly important for organisations. Moreover, they affect the health of the planet, with estimates of significant effects already in the medium term. All companies, and in particular those operating in significantly exposed sectors such as Iren Group, must necessarily consider climate change risk analysis as an emerging and determining factor in the definition of their medium- and long-term strategies. The assessment of ESG risks, which includes climate change risks, is moreover one of the essential factors in defining the significance of the impacts generated and suffered, also in a medium- to long-term perspective.

The adoption of the Climate Change Risk Policy and the resulting risk analysis and management represent a process that will enable the Group to provide even more effective control over its exposure to damaging events and the opportunities that the external context and its changes may offer, as well as its contribution to the achievement of sustainable development objectives defined at national and international level.

The Policy analyses and regulates, focusing on the applicability to the individual Business Units, the risk factors related to climate change, distinguishing between physical risks and transition risks. Physical risks resulting from changing climatic conditions are divided into acute physical risks - if related to local catastrophic natural events (e.g. floods, heat waves, fires, etc.) - and chronic physical risks - if related to long-term climate change (e.g. global warming, rising sea levels, water scarcity, etc.).

The transition to a low-carbon economy could entail extensive changes in government policies, with consequent regulatory, technological and market changes. Depending on the nature and speed of these changes, transition risks may result in a varying level of financial and reputational risk for the Group.

The Policy requires the presence of a specific Risk Commission to periodically review the Group's risk profile, defining and proposing updates to the Chief Executive Officer on strategies for managing risk classes and reporting any emerging critical issues to the Delegated Bodies. The document also includes guidelines for reporting, aimed at ensuring transparency of information to all stakeholders.

As part of the Climate Change Risk Management Policy, in 2021, Iren Group began implementing a tool that supports strategic decision-making. This tool has seen the development of an assessment model based on three time horizons (2030, 2040 and 2050), identified in line with the objectives of the Group's Strategic Plan and Sustainability Plan, and on the use of climatic and socio-economic scenarios necessary to define evolution scenarios of the main quantities underlying the analysis.

Climate data are based on scenarios published by the International Panel on Climate Change (IPCC), the so-called Representative Concentration Pathways (RCPs) where the number associated to each RCP indicates the "strength" of climate change generated by human activity by 2100 compared to the pre-industrial period.

The climate scenarios taken into consideration in the analysis are the RCP 2.6 scenario (which envisages strong mitigation aimed at keeping global warming well below 2°C compared to pre-industrial levels while achieving the objectives defined by the Paris Agreement), the RCP 4.5 scenario (considered by Iren Group to be the most representative of the current global climate and political context), which envisages easing of objectives compared to the RCP 2.6 scenario and a stabilisation of emissions by 2100 at around double pre-industrial levels, and the RCP 8.5 scenario (commonly associated with the expression 'Business-as-usual', or 'No mitigation'), which envisages no particular countermeasures and a growth in emissions at current rates. Socio-economic data, on the other hand, are mainly based on the International Energy Agency's NetZero Emissions by 2050 Scenario (NZE) and Stated Policies Scenario (STEPS). The assessment model adopted by the Group allows to quantify the variation of the economic-financial variables, through specific KPIs, for those assets that are potentially more exposed to climate change risks.

The application of the model shows that the actions introduced in the 2030 Business Plan, in which asset-specific investments are outlined, have a mitigating effect on the impacts of climate change on the activities of Iren Group. Mitigation actions of a strategic nature, linked to investments, are flanked by others of an operational and insurance nature.

Recently, a further project phase was developed to complete the assessment model, which included the inclusion of the most significant plants/activities for the risk under consideration that were not included in the previous analysis, also updating the model with respect to the new regulatory and climatic scenarios. For more details on the assessments that emerged, please refer to Iren Group's Sustainability Report.

In addition, in 2022 and 2023, for the purpose of applying the European Taxonomy (EU Regulation 2020/852), the Group carried out an analysis specifically aimed at verifying the DNSH (Do No Significant Harm) criterion for the climate change adaptation target, which requires that, for each activity, a physical climate risk assessment (acute and chronic) be carried out and an adaptation plan implemented that presents possible solutions in the event of significant risk exposure. To this end, for the activities/assets managed by the Group, the relevant risk factors were identified, in the current and future scenarios with a time horizon of 2050, and an adaptation plan was defined, where necessary.

Iren Group has adopted a specific internal control and tax risk management system, understood as the risk of operating in violation of tax regulations or in contrast with the principles or aims of the legal system.

The tax risk control and management system, the "Tax Control Framework" (hereinafter "TCF"), enables the Group to pursue the objective of minimising its exposure to tax risk by identifying, updating, assessing and monitoring tax-related governance, processes, risks and controls. The Group is committed to managing its tax affairs in accordance with all applicable laws and regulations.

For this reason, Iren has adopted the TCF as an internal control system that defines the governance for the management of taxation and related risk in line with the principles of the company strategy and, in particular, the Tax Strategy.

The Tax Control Framework adopted consists of a set of rules, guidelines, tools and models aimed at supporting the Group's employees in carrying out their daily activities, ensuring consistency on relevant tax matters.

Therefore, the TCF’s structure provides for the presence of two pillars that outline its operating scheme: the Tax Strategy and the Tax Compliance Model.

The Tax Strategy defines the objectives and the approach adopted by the Group in managing the tax variable. The purpose of this document is to establish the Principles of conduct in tax matters in order to i) contain tax risk due to exogenous and endogenous factors, and ii) continue to guarantee over time the correct and timely determination and settlement of taxes due by law, and the performance of related obligations. The Tax Strategy has been approved and issued by the Board of Directors of Iren S.p.A.

The Tax Compliance Model is an element of the Internal Control and Risk Management System. This document contains the detailed description of the phases comprising the risk assessment, control and periodic monitoring processes carried out by Iren, and the subsequent reporting on tax issues to the Chief Executive Officer and the other relevant bodies and functions. It also aims to summarize the main responsibilities assigned to the various functions involved in tax-relevant processes. The Tax Compliance Model is prepared by the Tax and Compliance Function and is ultimately approved by the Board of Directors of Iren S.p.A.

The project for the creation of a TCF aligned with the best practices in the matter took shape with the presentation by Iren S.p.A. and Iren Energia of the application for access to the Collaborative Compliance institution, a regime between the Revenue Agency and the large companies introduced by Legislative Decree no. 128 of 5 August 2015 in order to promote the implementation of enhanced forms of communication and cooperation based on mutual trust between tax authorities and taxpayers, and to encourage, in the common interest, the prevention and resolution of tax disputes. The preliminary investigation for admission was successfully concluded in December 2021 with the admission of the two companies.

This category includes all the risks which may influence achievement of the targets, i.e. relating to the effectiveness and efficiency of business transactions, levels of performance, profitability and protection of the resources against losses.

For each business chain and operational area, the Group's risk management process provides for an analysis of the activities performed and the identification of the main risk factors related to the achievement of objectives. Following the identification activity, the risks are assessed qualitatively and quantitatively (in terms of magnitude and probability of occurrence), thus making it possible to identify the most significant risks. The analysis also includes an assessment of the current and prospective level of risk control, monitored by means of specific key risk indicators. The above steps enable the structuring of specific treatment plans for each risk factor.

Along all the management phases, each risk is subjected on a continuous basis to a process of control and monitoring, which checks whether the treatment activities approved and planned have been correctly and effectively implemented, and whether any new operational risks have arisen. The process of managing operational risks is associated with a comprehensive and structured reporting system for presenting the results of the risk measurement and management activity. Each process stage is performed in accordance with standards and references defined at Group level. At least annually, the operational risk situation is updated, in which the dimension and level of control of the monitored risks are highlighted; financial, IT, credit and energy risk situations are updated quarterly.

Group risk reporting, updated every six months, is sent to top management and risk owners, who are involved in management activities. The risk analysis also supports the preparation of planning tools.

In this regard, Iren has equipped itself with a very detailed risk map that corresponds to the reality of the Group, with qualitative and quantitative assessments of each individual risk and with details of the controls and mitigation actions in place or planned. For each risk identified, the relevant ESG (Environmental, Social and Governance) impacts are associated.

The operational risk management process also aims at optimising the Group’s insurance programmes.

Of particular note are:

a. Legal and regulatory risks

The legislative and regulatory framework is subject to possible future changes and, therefore, is a potential risk. In this regard Departments operate, dedicated to continual monitoring of the relevant legislation and regulations in order to assess their implications, guaranteeing their correct application in the Group.

b. Plant‐related risks

In relation to the size of the Group’s production assets, plant‐related risks are managed with the methodological approach described above in order to correctly allocate resources in terms of control and preventive measures (preventive/predictive maintenance, control and supervisory systems, emergency and continuity plans, etc.). The Risk Management Department periodically performs surveys on the most important facilities, through which it can accurately detail the events to which these facilities could be exposed, and the consequent preventive actions. The risk is also hedged by insurance policies designed considering the situation of the single plants.

c. IT Risks

Cyber risks are defined as the set of internal and external threats which can compromise business continuity or cause civil liability damage to third parties in the event of loss or disclosure of sensitive data. From an internal point of view, the operational risks regarding information technology are closely related to the business of Iren Group, which operates network infrastructures and plants, including through remote control, accounting operational management and invoicing systems and energy commodity trading platforms. Iren Group is, in fact, one of the leading Italian operators on the Energy Exchange and any accidental unavailability of the system could have considerable economic consequences, connected with the non‐submission of energy sale or purchase offers. At the same time, problems related to supervision and data acquisition on physical systems could cause plant shutdowns and collateral and even serious damage. A breakdown of invoicing systems could also determine delays in issuing bills and the related collections, as well as damage to reputation.

To mitigate such risks, specific measures have been adopted, such as redundancies, highly‐reliable systems and appropriate emergency procedures, which are periodically subject to simulations, to ensure their effectiveness. Iren Group is also exposed to the risk of cyber attacks aimed both at acquiring sensitive data and at stopping operations, causing damage to plants and networks and compromising service continuity. Market benchmarks also show that attacks aimed at the acquisition of one's own and third parties' data, resulting in civil liability actions and even serious penalties, and the acquisition of trade secrets are becoming increasingly frequent. In this regard, by way of example:

• A Web Application FireWall (WAF) solution was adopted to protect against attempted exploitation of portal vulnerabilities.
• A Virtual Patching solution was introduced, with the aim of protecting "obsolete" systems that can no longer be updated from a security point of view.
• Continuous monitoring was activated by the Iren CSIRT in the face of the Russian-Ukrainian and Israeli-Palestinian war, through the adoption of specific monitoring measures, etc.

The Group Cyber Risk Policy is in force, approved by the Board of Directors of Iren S.p.A., which - like the other main risk policies - provides for the convening of specific Risk Commissions, the monitoring of performance indicators and dedicated reporting.

In the development of the 2030 Business Plan, the Group has structured three distinct areas of analysis: a qualitative-quantitative risk assessment, a specific focus on investments and a focus on climate change risks.

The qualitative risk assessment was based on an analysis of industry trends, the Group's exposure to related strategic risks and the related ability of the Business Plan to mitigate these risks. Consequently, for the risk categories and related elementary risks mapped as part of the Group's Risk Map, which also integrates the ESG impacts for each risk, a detailed analysis of the quantitative drivers relating to the risks with an impact in the years of the Plan was carried out. Once these risks have been identified, the relative impacts, probability of occurrence and mitigation actions have been quantified in order to quantify both the inherent and residual risk value. This assessment led to the enhancement of the Plan's stress test and related rating indices.

With regard to the Plan investment analysis, the mitigating effect on risks and execution risks of the capital expenditure categories and major initiatives were identified.

Finally, an analysis of the risk factors from climate change impacting the Group was carried out, with modelling of the most significant assets and risk factors for different climate scenarios and time horizons. Model results were analysed and investments to mitigate Climate Change risks were evaluated.

M&A transactions and other initiatives of a strategic nature, which were assessed during the year, were also subject to detailed analysis, with a particular focus on the impact of these transactions on the Group's sustainability objectives (environmental indicators, where significant, and social indicators relating, for example, to compliance with labour, health and safety regarding the target and governance policies) and consistency with the EU Taxonomy.