2022 Integrated report

R I SK MANAGEMENT

R I SK MANAGEMENT

A GLOBAL R I SK MANAGEMENT POL I CY

CR I T I CAL R I SKS REV I EWED EACH YEAR

The risk management system contributes to the achievement of Groupe ADP’s strategic and operational objectives and to the development of the control of its activities, thanks to a regular assessment and monitoring of risks and their control elements. Governance and processes are structured around three lines of defence: operational management, central functions and internal audit. The approach is managed by the Audit, Security and Risk Management Department.

This mapping makes it possible to identify the major risks, prioritise them, address them and monitor the action plans. Risks are assessed according to their impacts and frequency, given the existing control measures. They are then prioritised according to their critical level.

Variation since 31 December 2021

Non financial risk

Net criticality

Description

Risks for the business model 1 - A: Risks related to the economic trajectory In an unstable health situation, the uncertainties weighing on the growth of air traffic and its recovery to that of 2019 weighed on Groupe ADP’s activities. 1 - B: Risks related to regulation Uncertainties about the legal framework of regulation and decision-making practices of ART are likely to affect Groupe ADP’s business model. 1 - C: Risks related to quality of service In regard of the consequences of the health crisis and the traffic seen in 2022, Groupe ADP is facing a real challenge in preserving and adapting its quality of service initiatives. 1 – D: Liquidity risks The current economic and health context poses a risk to the Groupe ADP ‘s cash position, which must remain sufficient to meet its commitments.

BOARD OF DIRECTORS AUDIT AND RISK COMMITTEE

+++

✔

+++

EXECUTIVE COMMITTEE (COMEX) RISK AND INTERNAL CONTROL OPERATIONAL COMMITTEE (CORCI)

+++

++

1 st LINE OF CONTROL

2 nd LINE OF CONTROL

3 rd LINE OF CONTROL

Risks of external threats 2 - A: Cybersecurity risks In a global context of increasing cyber-attacks, Groupe ADP may be exposed to malicious acts on its information systems. +++ 2 - B: Geopolitical risks Geopolitical events that may cause changes in the global economic situation are likely to affect Groupe ADP’s activities. +++ 2 - C: Safety and security risks In a turbulent global geopolitical context, marked by an ever-changing threat of terrorism or attacks by third countries, Groupe ADP may be exposed to malicious acts on its facilities or on the assets it operates. +++ Risks related to the maintenance and robustness of airport capacities 3 - A: Risks related to network management Groupe ADP faces challenges in the robustness of its key networks (electricity, energy, water, IT and telecommunications). ++ 3 - B: Risks related to asset management Groupe ADP must face the challenge of maintaining its assets. +

HR

INTERNAL AUDIT

LOCAL MANAGEMENT

Purchases

Legal

Actors involved in the business activity

EXTERNAL AUDITS REGULATION

Finance

RISK MANAGEMENT AND INTERNAL CONTROL RISK HEDGING BY INSURANCE

Management

3 - C: Risks related to the management of major projects Groupe ADP is exposed to the risk of non-control of major projects

ETHICS AND COMPLIANCE

IS …

+

New

Risk related to the development projects of the Group’s platforms: 4 - A: Risks related to the effects of climate change Insufficient awareness of environmental issues could negatively affect Groupe ADP’s activity and growth prospects, and even lead to a decline in air traffic. Compliance risks: 5 - A: Corruption and business integrity risks Prohibited practices contrary to ethics and compliance in business conduct by employees or third parties may damage Groupe ADP’s reputation and share value. 5 - B: Risks related to data management Legislative and regulatory changes may affect Groupe ADP’s data management and generate significant compliance costs. 5 - C: Risks related to aviation safety Groupe ADP is subject to particularly constraining civil aviation safety standards, non-compliance of which may have negative consequences for its airport management activity.

Network of ARCcoordinators andmanagement systems

+++

✔

Source: Institut Français de l’Audit et du Contrôle Internes (IFACI).

++

✔

+

New

To strengthen the coverage of risks and their control elements, Groupe ADP has undertaken an analysis of emerging risks, based on a forward-looking approach to activities. This is supplemented by analyses of thematic risks (climate, human rights, etc.). This approach is part of the governance component of the “Pioneers for Trust” CSR roadmap.

+

Net criticality: + low criticality ++ average criticality +++ high criticality. Variation compared to 2021: Increase Stable.

48

49

GROUPE ADP / 2022 I NTEGRATED REPORT

GROUPE ADP / 2022 I NTEGRATED REPORT