
Management's Review Financial Statements Signatures Company InformationAalborg Portland Annual Report 2025
19
The Cementir Group's Internal Control and Risk Management System is
integrated into the Group's organizational, administrative, accounting and
governance structure and has been prepared on the basis of the principles
laid down by the Enterprise Risk Management - Integrated Framework, an
international standard developed by the Committee of Sponsoring Organi-
zations of the Treadway Commission (COSO Report), also ensuring greater
detail in the identification of the risks of the companies and Group and
integration with the results of the Audit activities. The methodology followed
involves an iterative process consisting of the following steps:
• Risk identification: the process starts with the definition of the Indu-
strial Plan and focuses on the main risks that could compromise the
achievement of the Group's objectives;
• Risk assessment: for each identified risk, management gives an inhe-
rent risk assessment (in the absence of controls/mitigation actions),
in terms of probability and impact during the horizon of the Industrial
Plan, using a 5-level assessment system (scoring):
- Impact: scale from 1 (Negligible) to 5 (Extreme);
- Probability: scale from 1 (Rare) to 5 (More than Likely).
• With regard to impact, three parameters are considered: economic
(quantitative), operational (qualitative), reputational (qualitative). Ma-
nagement at Region and Group level assesses the potential impacts
and likelihood of major risks that could have a material adverse effect
on the company's current or future operations. For sustainability and
climate-related risks, the time horizon was extended to a long-term
view for the analysis of various threats that could jeopardise the
implementation of the Group's climate transition plan;
• Identification and assessment of the adequacy of the existing con-
trols: for each identified risk, all the controls/actions currently in place
for risk mitigation are identified with the management;
• Residual Risk Assessment: taking into account the individual controls
for each risk and the relative adequacy, the residual risk is calculated by
applying a uniform calculation methodology to all Group companies;
• Identification of further actions: in the event that the residual risk is
higher than the predefined level of risk appetite, further actions are
agreed with management to mitigate the risk and contain it within
acceptable levels. The initiatives are taken promptly and within
budget limits, to effectively contribute to risk mitigation;
• Risk mitigation: Mitigation strategies are defined with specific action
plans for key risks;
• Reporting: reports are prepared at the company and Group level, show-
ing the main risks and initiatives taken by management to reduce the
risks to acceptable levels;
• Monitoring: the following are reviewed periodically: existing risk asses-
sments, assessment parameters, and new risks can be identified if
necessary.
The model, as described, subject to further and future updates, aims to
provide support for the decision-making and operational processes of the
company management, so as to reduce the possibility that specific events
could compromise the Group's ordinary operations or the achievement of its
strategic objectives.
To this end, the risk appetite level adopted in relation to strategic risks is
consistent with the vision of creating value, while always respecting the
environment and promoting integration with local communities. In relation to
operational risks, the risk appetite level is defined on the basis of the effecti-
veness and efficiency targets set by the management.
Provisions for compliance and financial reporting are different. The Group
does not accept an assumption of non-compliance risk for laws and regu-
lations (including those relating to safety), and of possible alterations to the
integrity of financial reporting.
The Cementir Group's Internal Control and Risk Management System is
integrated with the Group's Sustainability Strategy. In this perspective, from
2021 the Cementir Group launched a project aimed at implementing the
recommendations of the TCFD (Task Force on Climate-Related Financial
Disclosure) and from 2025, of the TNFD (Task Force on Nature-Related
Financial Disclosure), adopting a transparent approach to the reporting of
risks and opportunities related to climate change and nature. The identifica-
tion, assessment and effective management of climate and natural risks and
opportunities are fully integrated into the Group's Enterprise Risk Manage-
ment process. In 2022, to further strengthen its climate change disclosure,
the Group engaged Standard & Poor’s (S&P) to assess physical and transition
climate risks and to develop scenario analyses to support the implementa-
tion of the TCFD guidelines. The analysis showed a level of full compliance
with the eleven recommendations provided for by the TCFD, with an overall
score of 100%, confirming the completeness and transparency of the Group's
disclosure. During 2025, the Holding also collaborated with an external con-
sultant to integrate the principles of TNFD into its risk management system.
In relation to accounting and financial reporting, the existing Internal Control
System ensures its accuracy and completeness through constantly updated
administrative and accounting procedures.
Furthermore, as part of the compliance activities with the COSO structure,
during the year, the Internal Audit function carries out audit activities on the
aforementioned procedures to ascertain that the provided key controls are
being correctly applied by the involved company structures. The assessment
of the internal control system on financial reporting provided for by Cementir
Group procedures was carried out based on this activity.
On the basis of the activity carried out by the Internal Audit department and
the related results, the Audit Committee assessed the Internal Control and
Risk Management System as adequate, effective and appropriate for dealing
with business, operational, environmental, financial and compliance risks.
Since October 2023, the Group has launched the strategic initiative for the
digitalization of Risk Management, aimed at improving the resilience of the
organization by leveraging advanced technological solutions, simplifying
data-driven risk assessments and implementing real-time monitoring capa-
bilities, promoting a proactive and agile approach to risk mitigation across all
business functions. Starting from 2024, the Risk Management process of the in-
dividual subsidiaries is conducted solely and exclusively using the new platform.
In 2025, the Internal Control and Risk Management System was further
strengthened through the introduction of a second annual update cycle of the
ERM model.
If in previous years the analysis was carried out only once a year, from 2025
the process provides for two semi-annual checks, in order to ensure a more
timely alignment with the Business Plan and to intercept any changes in the
risk profile with greater timeliness.