As part of its Risk Management activities, the Group uses non-speculative hedging contracts to limit exchange rate risk and interest rate risk. The Iren Group’s business is exposed to various types of financial risks: 

• Liquidity risk - is the risk that financial resources available to the company will be insufficient to cover financial and trade commitments in accordance with the agreed terms and deadlines. The procurement of financial resources has been centralised in order to optimise their use. In particular, centralised management of cash flows in Iren makes it possible to allocate the funds available at the Group level according to the needs that from time to time arise among the individual Companies.

• Foreign exchange risk - except as indicated in the section on energy risk, the Iren Group is not significantly exposed to foreign exchange risk.

• Interest rate risk - the Iren Group is exposed to interest rate fluctuations especially with regard to the measurement of borrowing costs. The Iren Group’s strategy is to limit exposure to the risk of interest rate volatility, maintaining at the same time a low cost of funding.

Compliance with the limits imposed by the Policy are verified during the Financial Risk Commission meetings with regard to the main metrics, together with analysis of the market situation, interest rate trends, the value of hedges and confirmation that the conditions established in covenants have been met.

The Group’s credit risk is mainly related to trade receivables deriving from the sale of electricity, district heating, gas and the provision of energy, water and waste management services. Receivables are spread over a large number of counterparties belonging to heterogeneous customer categories (retail, business, government agencies). Some exposures are large in amount and are constantly monitored and made the subject of repayment plans. The Iren Group’s Credit Management units devoted to credit recovery are responsible for this activity.

In carrying on its business, the Group is exposed to the risk that assets may not be honoured on maturity with a consequent increase in their age and in insolvency up to an increase in assets subject to arrangement procedures or unenforceable.

To limit exposure to credit risk, a number of tools have been activated. These include analysing the solvency of customers at the acquisition stage through careful assessment of their creditworthiness, transferring the receivables of discontinued and/or active customers to external credit recovery companies and introducing new recovery methods for managing legal disputes. 

Credit risk is hedged, for some types of business customers, with opportune forms of first-demand bank or insurance guarantees issued by subjects of leading credit standing and with credit insurance for the reseller customer segment.

With regard to the emergency caused by Covid-19, with specific reference to the possible liquidity difficulties of the customer portfolio linked to the measures to combat the pandemic, the Group adjusted the provision for the impairment of receivables based on the assessment of expected losses.

The control of credit risks is strengthened by the monitoring and reporting procedures, in order to identify promptly possible countermeasures.

On a quarterly basis, the Risk Management Department collects and integrates the main data regarding the evolution of the Group companies’ trade receivables, in terms of type of customers, status of the contract, business chain and aging band. The assessment of credit risk is carried out both at the consolidated level and at the level of Business Units and companies. Some of the above assessments are carried out at intervals of less than three months or when there is a specific need.

The Iren Group is exposed to price risk on the energy commodities traded (electricity, natural gas, environmental emission certificates, etc.), as both purchases and sales are impacted by fluctuations in the price of such commodities directly, or through indexing formulae.

Exposure to foreign exchange rate risk, characteristic of oil-based commodities, exists, but is residual thanks to the development of the European organised markets that trade the gas commodity in Euro and no longer indexed to oil products.

The Group's policy is geared toward an active position management strategy to stabilise the margin by seizing opportunities in the markets. It is achieved both through the alignment of commodity indexing in buying and selling, vertical and horizontal exploitation of various business chains, and by operating in financial markets.

For this purpose, the Group plans the production of its plants and purchases and sales of energy and natural gas, in relation to both volumes and price formulae. The objective is to achieve sufficient margin stability through a policy of indexed purchases and sales that achieves a high degree of natural hedging, with adequate recourse to futures and spot markets.

The Iren Group has included in the Enterprise Risk Management system a Policy dedicated to climate change risks for the definition of its medium and long-term strategies.

The adoption of the Climate Change Risk Policy and the resulting risk analysis and management represent the preliminary steps in a process that will enable the Group to provide even more effective control over its exposure to damaging events and the opportunities that the external context and its changes may offer, as well as its contribution to the achievement of sustainable development objectives defined at national and international level. The Policy analyses and regulates, focusing on the applicability to the individual Business Units, the risk factors related to climate change, distinguishing between physical risks and transition risks.

Physical risks resulting from changing climatic conditions are divided into acute physical risks - if related to local catastrophic natural events (e.g. floods, heat waves, fires, etc.) - and chronic physical risks - if related to long-term climate change (e.g. global warming, rising sea levels, water scarcity, etc.). The transition to a low-carbon economy could entail extensive changes in government policies, with consequent regulatory, technological and market changes. Depending on the nature and speed of these changes, transition risks may result in a varying level of financial and reputational risk for the Group.

The Policy requires the presence of a Risk Commission to periodically review the Group's risk profile, defining and proposing updates to the Chief Executive Officer on strategies for managing risk classes and reporting any emerging critical issues to the Executive Bodies. 

As part of the Climate Change Risk Policy, in 2021, the Iren Group began implementing a tool that supports strategic decision-making. This tool has seen the development of a model based on three time horizons (2030, 2040 and 2050), identified in line with the objectives of the Group's Strategic Plan and Sustainability Plan, and on the use of scenarios.

Climate data are based on scenarios published by the International Panel on Climate Change (IPCC), the so-called Representative Concentration Pathways (RCPs) where the number associated to each RCP indicates the "strength" of climate change generated by human activity by 2100 compared to the pre-industrial period. The climate scenarios taken into consideration in the analysis are the RCP 2.6 scenario (~+1.5°C considered by the Iren Group), which envisages a strong mitigation aimed at keeping global warming below 2°C compared to pre-industrial levels with the simultaneous achievement of the targets defined by the Paris Agreement, and the RCP 8.5 (~+4°C considered by the Iren Group), which does not envisage the adoption of any particular countermeasures and a growth in emissions at current rates. 

Socio-economic data, on the other hand, are primarily based on the Sustainable Development Scenario (SDS) and Stated Policies Scenario (STEPS) scenarios from the World Energy Outlook (WEO) published by the International Energy Agency.

The model allows to quantify the variation of the economic-financial variables, through specific KPIs, for those assets that are potentially more exposed to climate change risks.

The application of the model showed that the actions introduced in the 2021-2030 Business Plan, approved on 11 November 2021, have a mitigating effect on the impacts of climate change on the activities of the Iren Group. Mitigation actions of a strategic nature, linked to investments, are flanked by others of an operational and insurance nature. 

During 2022, the assessment model will be completed, including all the most significant plants for the risk under consideration, paying particular attention to new regulatory and climate scenarios.

Iren Group has adopted a specific internal control and tax risk management system, understood as the risk of operating in violation of tax regulations or in contrast with the principles or aims of the legal system.

The tax risk control and management system, the “Tax Control Framework” (TCF), enables the Group to pursue the objective of minimising its exposure to tax risk by identifying, updating, assessing and monitoring tax-related governance, processes, risks and controls. The Group is committed to managing its tax affairs in accordance with all applicable laws and regulations.

For this reason, Iren has adopted the TCF as an internal control system that defines the governance for the management of taxation and related risk in line with the principles of the company strategy and, in particular, the Tax Strategy.

The Tax Control Framework adopted consists of a set of rules, guidelines, tools and models aimed at supporting the Group's employees in carrying out their daily activities, ensuring consistency on relevant tax matters.

Therefore, the TCF’s structure provides for the presence of two pillars that outline its operating scheme: the Tax Strategy and the Tax Compliance Model.

The Tax Strategy defines the objectives and the approach adopted by the Group in managing the tax variable. The purpose of this document is to establish the Principles of conduct in tax matters in order to i) contain tax risk due to exogenous and endogenous factors, and ii) continue to guarantee over time the correct and timely determination and settlement of taxes due by law, and the performance of related obligations. The Tax Strategy is approved and issued by the Board of Directors of Iren S.p.A.

The Tax Compliance Model is an element of the Internal Control and Risk Management System. This document contains the detailed description of the phases comprising the risk assessment, control and periodic monitoring processes carried out by Iren, and the subsequent reporting on tax issues to the Chief Executive Officer and the other relevant bodies and functions. It also aims to summarize the main responsibilities assigned to the various functions involved in tax-relevant processes. The Tax Compliance Model is prepared by the Tax and Compliance Function and is ultimately approved by the Board of Directors of Iren S.p.A.

The project for the creation of a TCF aligned with the best practices in the matter took shape with the presentation by IREN Spa and IREN Energia Spa of the application for access to the Collaborative Compliance institution, a regime between the Revenue Agency and the large companies introduced by Legislative Decree No. 128 of 5 August 2015 in order to promote the implementation of enhanced forms of communication and cooperation based on mutual trust between tax authorities and taxpayers, and to encourage, in the common interest, the prevention and resolution of tax disputes. The preliminary investigation for admission was successfully concluded in December 2021 with the admission of the two companies.

This category includes all the risks which may influence achievement of the targets, i.e. relating to the effectiveness and efficiency of business transactions, levels of performance, profitability and protection of the resources against losses.

The process of managing the Group’s risks entails that, for each business line and operating area, the activities performed are analysed and the main risk factors connected with achievement of the objectives are identified. Following the identification activity, the risks are assessed qualitatively and quantitatively, thus making it possible to identify the most significant risks. The analysis also involves an assessment of the current and prospective level of control of the risk, monitored by means of specific key risk indicators.

Along all the management phases, each risk is subjected on a continuous basis to a process of control and monitoring, which checks whether the treatment activities approved and planned have been correctly and effectively implemented, and whether any new operational risks have arisen.

The process of managing operational risks is associated with a comprehensive and structured reporting system for presenting the results of the risk measurement and management activity. Each process stage is performed in accordance with standards and references defined at Group level. 

The Group’s risk position is updated at least quarterly, indicating the extent and level of control of all risks monitored, including financial, IT, credit and energy risks. The risk reporting is sent to the top management and to the Risk Owners, who are involved in the management activity. The recent review of the Group Risk Map led to the development of a very detailed map, with details on controls, the impact of Covid-19, and existing or prospective mitigation actions. Each risk has also been associated with the ESG (Environmental, Social and Governance) category to which it belongs:

• Legislative and regulatory risks - The legislative and regulatory framework is subject to possible future changes, and therefore is a potential risk. In this regard departments operate, reporting directly to the Chief Executive Officer, dedicated to continual monitoring of the relevant legislation and regulations in order to assess their implications, guaranteeing their correct application in the Group.

• Plant‐related risks - As regards the amount of the Group’s production assets, plant‐related risks are managed in order to correctly allocate resources in terms of control and preventive measures (preventive/predictive maintenance, control and supervisory systems, emergency and continuity plans, etc.).. For the most important plants the Risk Management Department periodically conducts surveys, from which it can accurately detail the events to which such plants could be exposed and consequent preventive action. The risk is also hedged by insurance policies designed considering the situation of the single plants.

• Cyber risks - Cyber risks are defined as the set of internal and external threats which can compromise business continuity or cause civil liability damage to third parties in the event of loss or disclosure of sensitive data. From an internal point of view, the operational risks regarding information technology are closely related to the business of the Iren Group, which operates network infrastructures and plants, including through remote control, accounting operational management and invoicing systems and energy commodity trading platforms. 

The Iren Group is one of the leading Italian operators on the Power Exchange and any accidental unavailability of the system could have considerable economic consequences. At the same time, problems related to supervision and data acquisition on physical systems could cause plant shutdowns and collateral and even serious damage. A breakdown of invoicing systems could also determine delays in issuing bills and the related collections, as well as damage to reputation.

To mitigate such risks, specific measures have been adopted, such as redundancies, highly‐reliable systems and appropriate emergency procedures, which are periodically subject to simulations, to ensure their effectiveness. The Group has adopted a Cyber Risk Policy, approved by the Board of Directors of Iren S.p.A., which provides for the convening of specific Risk Commissions, the monitoring of performance indicators and dedicated reporting.

The Risk Management Department actively participated in the development of the new 2030 Business Plan and structured three distinct areas of analysis: a qualitative-quantitative risk assessment, a specific focus on Plan investments and a focus on climate change risks.

The qualitative Risk Assessment was based on an analysis of industry trends, the Group's exposure to related strategic risks and the related ability of the Business Plan to mitigate these risks. Consequently, for the risk categories and related elementary risks mapped as part of the Group's Risk Map, a detailed analysis of the quantitative drivers relating to the risks with an impact in the years of the Plan was carried out.

Once these risks have been identified - with the support of the Risk Owners and the Planning and Control Department - the relative impacts, probability of occurrence and mitigation actions have been quantified in order to quantify both the inherent and residual risk value. This assessment led to the enhancement of the Plan's stress test and related rating indices. The Risk Management Department also investigated a second line of analysis, which concerned the analysis of the Plan's investments, identifying both the capital expenditures with a mitigating effect on risks and those whose implementation may represent a possible source of risk, with possible repercussions in economic and financial terms, so-called "execution risks".

Finally, an analysis of the risk factors from climate change impacting the Group was carried out, with modelling of the most significant assets and risk factors for different energy scenarios and time horizons. Model results were analysed and investments to mitigate climate change risks were evaluated.

In addition to the risk analysis associated with the Plan, the Risk Management Department contributes risk assessments specific to mergers & acquisitions and the main strategic plans concerning Iren Group.