Universal Registration Document 2024

RISK FACTORS AND INTERNAL CONTROL 2 INTERNAL CONTROL AND RISK MANAGEMENT

CSR risk management: setting the foundations for double materiality assessments Groupe ADP's existing risk management system is used to qualify and assess all types of risk, including those related to corporate social responsibility (CSR). As part of the process of adapting our reporting to the new CSRD (Corporate Sustainability Reporting Directive) regulation, the Audit, Security and Risk Management Department has adapted the existing risk rating scale, defining a single scale for rating risks, opportunities and impacts (positive and negative effects of the Company on its ecosystem). The aim was to build on the risk management process, in particular through the existing governance structure and committees which already exercise full control. A double materiality assessment is then applied to the process to guarantee a coordinated and consistent result through the use of a single scale for both impact materiality and financial materiality. Groupe ADP has chosen an approach that has made it possible to address sustainability matters and to focus reporting on the matters that are most material to the Group. Details of the methodology used and the link with Groupe ADP's risk factors are set out in section 1.4 "IRO analysis" of the Sustainability Report. Internal control “Internal control is a process implemented by the Board of Directors, management and staff of an organisation, intended to provide reasonable assurance as to the achievement of the following objectives: the achievement and optimisation of operations/reliability of financial and management information/ compliance with applicable laws and regulations,” according to the Committee of Sponsoring Organizations of the Treadway Commission (COSO II) for enterprise risk management. There are two types of controls: u all the controls put in place by the business lines to ensure compliance with internal procedures; u key controls, including "essential" key controls, which are those considered essential to ensure that the Company's activities follow them correctly, in order to reduce the risk associated with a critical objective. For the deployment of the internal control of each process, the organisation follows four main steps: u process analysis by identifying potential risks; u the development of guidelines (or control sheets) in which key controls are identified; u self-assessments by the business lines; u the deployment of field tests by internal controllers. These campaigns make it possible to analyse the controlled processes and propose recommendations in order to strengthen their robustness, where necessary. These controls are carried out on fully consolidated Group entities (France and international). The results of the self assessments and field tests are entered directly into a GRC (Governance, Risk and Control) tool that centralises the responses and related documentation. In addition, when a related risk is identified, some are designated as ethics and compliance controls in the "administrative, accounting and financial" key controls manual.

GROUPE ADP COORDINATED RISK MANAGEMENT SYSTEM

From 2022, the Group has included an analysis of emerging risks, the identification of which results from a prospective analysis of the activity and the collection of “weak signals”. The various emerging risks detected are presented to the governance bodies and then discussed with the Stakeholder Council in order to understand and integrate the expectations of Groupe ADP’s partners. These forward looking elements, as well as the thematic and business line mappings mentioned above, are part of the commitments made in the governance component of Groupe ADP’s Pioneers for Trust strategic roadmap. In 2024, the Audit, Security and Risk Management Department (ASM) broadened the scope of the Risk Management unit to include prospective analysis, with the aim of anticipating new types of risks and opportunities 10, 15 or even 20 years into the future, thus contributing to the Group's long-term vision. This approach is in line with the drive to further the work undertaken on emerging risks since 2022 with the Stakeholder Committee to develop socio economic topics in the context of low-carbon transition scenarios (analysis of risks and opportunities). In line with the results of the 2024 risk mapping and the risk factors presented in this chapter, the aim is now to analyse different prospective scenarios for Groupe ADP. The priority topics to be addressed in 2024/2025 are: u the ageing of the population (adapting airport facilities and processes to meet the acceleration of demographic ageing (mobility support, queues, etc.); u societal transformations (taking into account societal transformation trends in the business model ("future of work" and changes in working methods, the impact of new technologies, implementation of traffic calming measures, predominance of diversity and inclusion); u the availability of energy sources (the type and number of energy sources, access to these sources, their acceptability, the pressure on resources – deforestation, access to water, land take, etc. – and the evolution of energy costs).

125

UNIVERSAL REGISTRATION DOCUMENT 2024 w AÉROPORTS DE PARIS