
MANAGEMENT’S REVIEW FINANCIAL STATEMENTS SIGNATURES COMPANY INFORMATION
Aalborg Portland A/S Annual Report 2024 19
The Cementir Group’s Internal Control and Risk Management System is
integrated into the Group’s organisational, administrative, accounting and
governance structure and has been prepared on the basis of the principles
laid down by the Enterprise Risk Management - Integrated Framework, an
international standard developed by the Committee of Sponsoring Organi-
zations of the Treadway Commission (COSO Report), also ensuring greater
detail in the identification of the risks of the companies and Group and
integration with the results of the Audit activities. The methodology followed
involves an iterative process consisting of the following steps:
• Risk identification: the process starts with the definition of the Indu-
strial Plan and focuses on the main risks that could compromise the
achievement of the Group’s objectives;
• Risk assessment: for each identified risk, management gives an inhe-
rent risk assessment (in the absence of controls/mitigation actions),
in terms of probability and impact during the horizon of the Industrial
Plan, using a 5-level assessment system (scoring):
• Impact: scale from 1 (Negligible) to 5 (Extreme);
• Probability: scale from 1 (Rare) to 5 (More than Likely)
• With regard to impact, three parameters are considered: economic
(quantitative), operational (qualitative), reputational (qualitative). Ma-
nagement at Region and Group level assesses the potential impacts
and likelihood of major risks that could have a material adverse effect
on the company’s current or future operations. For sustainability and
climate-related risks, the time horizon was extended to a long-term
view for the analysis of various threats that could jeopardise the
implementation of the Group’s climate transition plan;
• Identification and assessment of the adequacy of the existing princi-
pals: for each identified risk, all the controls/actions currently in place
for risk mitigation are identified with the management;
• Residual Risk Assessment: taking into account the individual
controls for each risk and the relative adequacy, the residual risk
is calculated by applying a uniform calculation methodology to all
Group companies;
• Identification of further actions: in the event that the residual risk is
higher than the predefined level of risk appetite, further actions are
agreed with management to mitigate the risk and contain it within
acceptable levels. The initiatives are taken promptly and within budget
limits, to effectively contribute to risk mitigation;
• Risk mitigation: Mitigation strategies are defined with specific action
plans for key risks;
• Reporting: reports are prepared at the company and Group level, show-
ing the main risks and initiatives taken by management to reduce the
risks to acceptable levels;
• Monitoring: the following are reviewed periodically: existing risk asses-
sments, assessment parameters, and new risks can be identified if
necessary.
The model, as described, subject to further and future updates, aims to
provide support for the decision-making and operational processes of the
company management, so as to reduce the possibility that specific events
could compromise the Group’s ordinary operations or the achievement of its
strategic objectives.
To this end, the risk appetite level adopted in relation to strategic risks is
consistent with the vision of creating value, while always respecting the
environment and promoting integration with local communities. In relation
to operational risks, the risk appetite level is defined on the basis of the
effectiveness and efficiency targets set by the management.
Provisions for compliance and financial reporting are different. The Group
does not accept an assumption of non-compliance risk for laws and regu-
lations (including those relating to safety), and of possible alterations to the
integrity of financial reporting.
The Cementir Group’s Internal Control and Risk Management System is
integrated with the Group’s Sustainability Strategy. Starting from 2021 the
Cementir Group has launched a project to implement the recommendations
of the TCFD (Task Force on Climate-Related Financial Disclosure) commit-
ting to be transparent on risks and opportunities related to climate change.
The identification, assessment and effective management of risks and
opportunities related to climate change are fully integrated into the Group’s
risk management process. To promote and improve its climate change
disclosure, in 2022, the Group engaged Standard & Poor’s (S&P) to assess
physical and transitional climate risks and develop scenario analyses to
support the implementation of the TCFD guidelines. The analysis carried
out by S&P showed that the Cementir Group scored 100% on the overall
assessment of the eleven recommendations of the TCFD, which represents
a complete and transparent level of disclosure achieved. Furthermore, the
Group is integrating the guidelines published by the European Union “EU Ta-
xonomy Regulation”, which together with the TCFD constitute the reference
frameworks. For more details, see the paragraph ”Main risks to which the
group is exposed”.
In relation to accounting and financial reporting, the existing Internal
Control System ensures its accuracy and completeness through constantly
updated administrative and accounting procedures.
Furthermore, as part of the compliance activities with the COSO structure,
during the year, the Internal Audit function carries out audit activities on the
aforementioned procedures to ascertain that the provided key controls are
being correctly applied by the involved company structures. The assessment
of the internal control system on financial reporting provided for by Cemen-
tir Group procedures was carried out based on this activity.
On the basis of the activity carried out by the Internal Audit department and
the related results, the Audit Committee assessed the Internal Control and
Risk Management System as adequate, effective and appropriate for dealing
with business, operational, environmental, financial and compliance risks.
As of October 2023, the Group has launched the strategic initiative for the
digitalisation of Risk Management, aimed at improving the resilience of the
organisation by leveraging advanced technological solutions, simplifying
data-driven risk assessments and implementing real-time monitoring capa-
bilities, promoting a proactive and agile approach to risk mitigation across
all business functions. The digitisation process was completed during 2024,
and the Group Risk Management was updated using the new platform.