Risks and uncertainties

The Iren Group’s business is exposed to various types of financial risks, including: liquidity risk, currency risk and interest rate risk. As part of its Risk Management activities, the Group uses non-speculative hedging contracts to limit currency risk and interest rate risk.

a) Liquidity risk

Liquidity risk is the risk that financial resources available to the company will be insufficient to cover financial and trade commitments in accordance with the agreed terms and deadlines.

The procurement of financial resources has been centralised in order to optimise their use. In particular, centralised management of cash flows in Iren makes it possible to allocate the funds available at the Group level according to the needs that from time to time arise among the individual companies. Cash movements are recognised in intra-group accounts along with intra-group interest income and expense.

A number of investees have an independent financial management structure in compliance with the guidelines provided by the parent.

b) Currency risk

Except as indicated in the section on energy risk, the Iren Group is not significantly exposed to currency risk.

c) Interest rate risk

The Iren Group is exposed to interest rate fluctuations especially with regard to the measurement of borrowing costs. The Iren Group’s strategy is to limit exposure to the risk of interest rate volatility, maintaining at the same time a low cost of funding.

Compliance with the limits imposed by the Policy is verified during the Financial Risk Commission meetings with regard to the main metrics, together with analysis of the market situation, interest rate trends, the value of hedges and confirmation that the conditions established in covenants have been met.

The Group’s credit risk is mainly related to trade receivables deriving from the sale of electricity, district heating, gas and the provision of energy, water and waste management services. The receivables are spread across a large number of counterparties, belonging to non-uniform customer categories (retail and business customers and public bodies); some exposures are of a high amount and are constantly monitored and, if necessary, covered by repayment plans. The Iren Group’s Credit Management units devoted to credit recovery are responsible for this activity.

In carrying on its business, the Group is exposed to the risk that assets may not be honoured on maturity with a consequent increase in their age and in insolvency up to an increase in assets subject to arrangement procedures or unenforceable. Among other factors, this risk is also affected by the economic and financial situation, which in the second half of 2021, led to a particularly significant increase in prices for end customers of gas, electricity and district heating. To limit exposure to credit risk, a number of tools have been activated. These include analysing the solvency of customers at the acquisition stage through careful assessment of their creditworthiness, transferring the receivables of discontinued and/or active customers to external credit recovery companies and introducing new recovery methods for managing legal disputes. In addition, methods of payment through digital channels are offered to customers.

The credit management policy and creditworthiness assessment tools, as well as monitoring and recovery activities differ in relation to the various categories of customers and types of service provided.

Credit risk is hedged, for some types of business customers, with opportune forms of first-demand bank or insurance guarantees issued by subjects of leading credit standing and with credit insurance for the reseller customer segment.

An interest-bearing guarantee deposit is required for some types of services (water, natural gas, highly- protected electricity sectors) in compliance with regulations governing these activities. This deposit is reimbursed if the customer uses payment by direct debit from a current account.

The payment terms generally applied to customers are related to the legislation or regulations in force or in line with the standards of the free market; in the event of non-payment, default interest is charged for the amount indicated in the contracts or by the legislation.

The loss allowance reflects, carefully and in accordance with the current legislation (applying the IFRS 9 method), the effective credit risks, and is determined on the basis of the extraction from databases of the amounts making up the receivable and, in general, assessing any changes in the said risk compared to the initial measurement and, in particular for trade receivables, estimating the related expected losses determined on a prospective basis, taking into due consideration the historical data. With regard to the emergency caused by Covid-19, and with specific reference to the possible liquidity difficulties of the customer portfolio linked to the measures to combat the pandemic and the regulatory and corporate measures to mitigate the economic and social impact of the crisis, the Group adjusted the loss allowance based on the assessment of expected losses.

The control of credit risks is also strengthened by the monitoring and reporting procedures, in order to identify promptly possible countermeasures.

In addition, on a quarterly basis, the Risk Management Department collects and integrates the main data regarding the evolution of the Group companies’ trade receivables, in terms of type of customers, status of the contract, business chain and ageing band. The assessment of credit risk is carried out both at the consolidated level and at the level of Business Units and companies.

Some of the above assessments are carried out at intervals of less than three months or when there is a specific need.

The Iren Group is exposed to price risk on the energy commodities traded, these being electricity, natural gas, environmental emission certificates, etc., as both purchases and sales are impacted by fluctuations in the price of such commodities directly, or through indexing formulae. Exposure to currency risk, characteristic of oil-based commodities, exists, but is residual thanks to the development of the European organised markets that trade the gas commodity in euro and no longer indexed to oil products.

The Group’s policy is oriented to a strategy of active management of the positions to stabilise the margin taking the opportunities offered by the markets; it is implemented by aligning the indexing of commodities purchased and sold, through vertical and horizontal use of the various business chains, and operating on the financial markets.

For this purpose, the Group plans the production of its plants and purchases and sales of energy and natural gas, in relation to both volumes and price formulae. The objective is to achieve sufficient margin stability through a policy of indexed purchases and sales that achieves a high degree of natural hedging, with adequate recourse to futures and spot markets.

For a more detailed analysis of the risks dealt with up to now, reference should be made to the paragraph “Group Financial Risk Management” in the Notes.

The Iren Group has included in the Enterprise Risk Management system a Policy dedicated to climate change risks, which are becoming increasingly important for organisations. Moreover, they affect the health of the planet, with estimates of significant effects already in the medium term. All companies, and in particular those operating in significantly exposed sectors such as the Iren Group, must consider the analysis of climate change risks as an emerging and determining factor in the definition of their medium and long-term strategies.

The adoption of the Climate Change Risk Policy and the resulting risk analysis and management represent the preliminary steps in a process that will enable the Group to provide even more effective control over its exposure to damaging events and the opportunities that the external context and its changes may offer, as well as its contribution to the achievement of sustainable development objectives defined at national and international level.

The Policy analyses and regulates, focusing on the applicability to the individual Business Units, the risk factors related to climate change, distinguishing between physical risks and transition risks. Physical risks resulting from changing climatic conditions are divided into acute physical risks - if related to local catastrophic natural events (e.g. floods, heat waves, fires, etc.) - and chronic physical risks - if related to long-term climate change (e.g. global warming, rising sea levels, water scarcity, etc.).

The transition to a low-carbon economy could entail extensive changes in government policies, with consequent regulatory, technological and market changes. Depending on the nature and speed of these changes, transition risks may result in a varying level of financial and reputational risk for the Group.

The Policy requires the presence of a Risk Commission to periodically review the Group's risk profile, defining and proposing updates to the Chief Executive Officer on strategies for managing risk classes and reporting any emerging critical issues to the Executive Bodies. The document also includes guidelines for reporting, aimed at ensuring transparency of information to all stakeholders.

As part of the Climate Change Risk Management Policy, in 2021 the Iren Group began implementing a tool that supports strategic decision-making. This tool has seen the development of a model based on three time horizons (2030, 2040 and 2050), identified in line with the objectives of the Group's Strategic Plan and Sustainability Plan, and on the use of climatic and socio-economic scenarios necessary to define evolution scenarios of the main quantities underlying the analysis.

Climate data are based on scenarios published by the International Panel on Climate Change (IPCC), the so-called Representative Concentration Pathways (RCPs) where the number associated to each RCP indicates the "strength" of climate change generated by human activity by 2100 compared to the pre-industrial period.

The climate scenarios taken into consideration in the analysis are the RCP 2.6 scenario (~+1.5°C considered by the Iren Group), which envisages a strong mitigation aimed at keeping global warming below 2°C compared to pre-industrial levels with the simultaneous achievement of the targets defined by the Paris Agreement, and the RCP 8.5 (~+4°C considered by the Iren Group), (commonly associated with the expression "Business-as-usual", or "No mitigation"), which does not envisage the adoption of any particular countermeasures and a growth in emissions at current rates.

Socio-economic data, on the other hand, are primarily based on the Sustainable Development Scenario (SDS) and Stated Policies Scenario (STEPS) scenarios from the World Energy Outlook (WEO) published by the International Energy Agency. The model allows to quantify the variation of the economic-financial variables, through specific KPIs, for those assets that are potentially more exposed to climate change risks.

The application of the model showed that the actions introduced in the 2021-2030 Business Plan, in which asset-specific investments are outlined, have a mitigating effect on the impacts of climate change on the activities of the Iren Group. Mitigation actions of a strategic nature, linked to investments, are flanked by others of an operational and insurance nature.

During 2022, the assessment model will be completed, including all the most significant plants for the risk under consideration, paying particular attention to new regulatory and climate scenarios.

The Iren Group has adopted a specific internal control and tax risk management system, understood as the risk of operating in violation of tax regulations or in contrast with the principles or aims of the legal system.

The tax risk control and management system, the “Tax Control Framework” (hereinafter “TCF”), enables the Group to pursue the objective of minimising its exposure to tax risk by identifying, updating, assessing and monitoring tax-related governance, processes, risks and controls.

The Group is committed to managing its tax affairs in accordance with all applicable laws and regulations.

For this reason, Iren has adopted the TCF as an internal control system that defines the governance for the management of taxation and related risk in line with the principles of the company strategy and, in particular, the Tax Strategy.

The Tax Control Framework adopted consists of a set of rules, guidelines, tools and models aimed at supporting the Group's employees in carrying out their daily activities, ensuring consistency on relevant tax matters.

Therefore, the TCF’s structure provides for the presence of two pillars that outline its operating scheme: the Tax Strategy and the Tax Compliance Model.

The Tax Strategy defines the objectives and the approach adopted by the Group in managing the tax variable. The purpose of this document is to establish the Principles of conduct in tax matters in order to i) contain tax risk due to exogenous and endogenous factors, and ii) continue to guarantee over time the correct and timely determination and settlement of taxes due by law, and the performance of related obligations. The Tax Strategy has been approved and issued by the Board of Directors of Iren S.p.A.

The Tax Compliance Model is an element of the Internal Control and Risk Management System. This document contains the detailed description of the phases comprising the risk assessment, control and periodic monitoring processes carried out by Iren, and the subsequent reporting on tax issues to the Chief Executive Officer and the other relevant bodies and functions. It also aims to summarise the main responsibilities assigned to the various functions involved in tax-relevant processes. The Tax Compliance Model is prepared by the Tax and Compliance Function and is ultimately approved by the Board of Directors of Iren S.p.A.

The project for the creation of a TCF aligned with the best practices in the matter took shape with the presentation by Iren S.p.A. and Iren Energia of the application for access to the Collaborative Compliance institution, a regime between the Tax Authority and the large companies introduced by Legislative Decree No. 128 of 5 August 2015 in order to promote the implementation of enhanced forms of communication and cooperation based on mutual trust between tax authorities and taxpayers, and to encourage, in the common interest, the prevention and resolution of tax disputes. The preliminary investigation for admission was successfully concluded in December 2021 with the admission of the two companies.

This category includes all the risks which, in addition to those already noted in the previous paragraphs, may influence achievement of the targets, i.e. relating to the effectiveness and efficiency of business transactions, levels of performance, profitability and protection of the resources against losses.

The Group’s Enterprise Risk Management model has as its objective the integrated and synergistic management of risks.

The process of managing the Group’s risks entails that, for each business line and operating area, the activities performed are analysed and the main risk factors connected with achievement of the objectives are identified. Following the identification activity, the risks are assessed qualitatively and quantitatively (in terms of magnitude and probability of occurrence), thus making it possible to identify the most significant risks. The analysis also involves an assessment of the current and prospective level of control of the risk, monitored by means of specific key risk indicators.

The above stages make it possible to structure specific treatment plans for each risk factor.

Along all the management phases, each risk is subjected on a continuous basis to a process of control and monitoring, which checks whether the treatment activities approved and planned have been correctly and effectively implemented, and whether any new operational risks have arisen. The process of managing operational risks is associated with a comprehensive and structured reporting system for presenting the results of the risk measurement and management activity. Each process stage is performed in accordance with standards and references defined at Group level. The Group’s risk position is updated at least quarterly, indicating the extent and level of control of all risks monitored, including financial, IT, credit and energy risks. The risk reporting is sent to the top management and to the risk owners, who are involved in the management activity. The risk analysis also supports the preparation of planning tools.

In this regard, Iren has equipped itself with a very detailed risk map that corresponds to the reality of the Group, with qualitative and quantitative assessments of each individual risk and with details of the controls and mitigation actions in place or planned. The identified risks have been associated with the ESG (Environmental, Social and Governance) category to which they belong. It is noted that for each risk it was verified whether and how it had been impacted by Covid-19.

Of particular note are:

a. Legal and regulatory risks

The legislative and regulatory framework is subject to possible future changes, and therefore is a potential risk. In this regard departments operate, reporting directly to the Chief Executive Officer, dedicated to continual monitoring of the relevant legislation and regulations in order to assess their implications, guaranteeing their correct application in the Group.

b. Plant‐related risks

As regards the amount of the Group’s production assets, plant‐related risks are managed with the approach described above in order to correctly allocate resources in terms of control and preventive measures (preventive/predictive maintenance, control and supervisory systems, emergency and continuity plans, etc.). For the most important plants the Risk Management Department periodically conducts surveys, from which it can accurately detail the events to which such plants could be exposed and consequent preventive action. The risk is also hedged by insurance policies designed considering the situation of the single plants.

c. IT Risks

Cyber risks are defined as the set of internal and external threats which can compromise business continuity or cause civil liability damage to third parties in the event of loss or disclosure of sensitive data. From an internal point of view, the operational risks regarding information technology are closely related to the business of the Iren Group, which operates network infrastructures and plants, including through remote control, accounting operational management and invoicing systems and energy commodity trading platforms. The Iren Group is, in fact, one of the leading Italian operators on the Power Exchange and any accidental unavailability of the system could have considerable economic consequences, connected with the non‐submission of energy sale or purchase offers. At the same time, problems related to supervision and data acquisition on physical systems could cause plant shutdowns and collateral and even serious damage. A breakdown of invoicing systems could also determine delays in issuing bills and the related collections, as well as damage to reputation.

To mitigate such risks, specific measures have been adopted, such as redundancies, highly‐reliable systems and appropriate emergency procedures, which are periodically subject to simulations, to ensure their effectiveness. The Iren Group is also exposed to the risk of cyber attacks aimed both at acquiring sensitive data and at stopping operations, causing damage to plants and networks and compromising service continuity. Market benchmarks also show that attacks aimed at acquiring companies’ and third‐party data are increasingly frequent, with consequent civil liability and sanctions, including serious ones, and at acquiring industrial secrets. In this regard:

• the data network was further segregated according to functional usage, especially by isolating the OT network;
• the Security Operation Center (SOC) is active with 24 hour monitoring of IT security events;
• policies were adopted to strengthen access to systems such as, in addition to the introduction of particularly complex passwords, the introduction of the second authentication factor and a platform for controlled and monitored access by system administrators. Adoption of systems with behavioural analytics capabilities and automated, remote response execution for workstations was completed;
• The Cyber Threat Intelligence (CTI) platform, aimed at acquiring evidence of attackers and threats potentially impacting corporate assets has been fully integrated with the monitoring and event management systems of IT security;
• a multi-year project was launched to raise awareness of IT security issues for all Group employees; this programme is based on phishing simulation campaigns, assessment questionnaires and targeted online training modules.

In addition, the Group Cyber Risk Policy is in force, approved by the Board of Directors of Iren S.p.A., which - like the other main risk policies - provides for the convening of specific Risk Commissions, the monitoring of performance indicators and dedicated reporting.

The operational risk management process also aims at optimising the Group’s insurance programmes.

In the development of the new 2030 Business Plan, the Group has structured three distinct areas of analysis: a qualitative-quantitative risk assessment, a specific focus on investments and a focus on climate change risks.

The qualitative risk assessment was based on an analysis of industry trends, the Group's exposure to related strategic risks and the related ability of the Business Plan to mitigate these risks. Consequently, for the risk categories and related elementary risks mapped as part of the Group's Risk Map, a detailed analysis of the quantitative drivers relating to the risks with an impact in the years of the Plan was carried out. Once these risks have been identified, the relative impacts, probability of occurrence and mitigation actions have been quantified in order to quantify both the inherent and residual risk value. This assessment led to the enhancement of the Plan's stress test and related rating indices.

With regard to the analysis of the Plan's investments, identifying both the capital expenditures with a mitigating effect on risks and those whose implementation may represent a possible source of risk, with possible repercussions in economic and financial terms (so-called "execution risks").

Finally, an analysis of the risk factors from climate change impacting the Group was carried out, with modelling of the most significant assets and risk factors for different energy scenarios and time horizons. Model results were analysed and investments to mitigate climate change risks were evaluated.

In addition to the risk analysis associated with the Plan, the Risk Management Department contributes risk assessments specific to mergers & acquisitions and the main strategic plans concerning the Group.