37

3.3 RISK MANAGEMENT & OPPORTUNITIES

Cepsa s commitment to implementing an Integrated Risk Management System (IRMS) is reflected in the approval, by the Group s Board of Directors in 2017, of a General Risk Policy, which establishes the Company s risk compass, while al- ways standing close to our principles of caution and anticipation. The basic principles of the Policy are defined in the Basic Standards for Integrated Risk Management.

Thanks to our IRMS we are prepared to respond quickly and efficiently before a

risk event which may significantly affect our operations and/or the results gener- ated by each operation. As such we aim to identify and manage Company risks. This enables us to define a standardised risk strategy with an overview of the en- tire company.

In 2017, we updated our Risk Map, while assessing each and every inventory risk based on the potential impact on the Company and probability of occurrence. This map covers 15 types of risk across 4 main groups:

Strategic and Planning Risks

Financial and Market Risks

Operational Risks

Regulatory and Compliance Risks

High risk Medium-high risk Medium risk Medium-low risk Low risk

1. Refining margin 2. Regulatory uncertainly and Compliance 3. Operating safety 4. Physical security 5. Information security 6. Large projects management 7. Production and replacement of reserves 8. Geopolitical risk 9. Local communities 10. Commodity pricing 11. Foreign currency 12. Market competition 13. Demand evolution 14. Talent management 15. Credit risk

IM PA

CT

PROBABILITY

MAxIMISATION OF VALUE

GROWTh ROBUSTNESS

LEADERShIP

1 3 4 5 9 12 13 14

1

6

6

7

7 8 10 12 13 14 1 7 10 11 12 13 15

10 11 15

In comparison with the risk map for 2016, it is worth noting that the priority risks related to refining margin and safety, op- erationally and physically, remain. Mean- while, following the analysis carried out

in 2017, the risk related to production and replacement of reserves has decreased, arising from the reduction in the potential impact that it could have on the com- pany. By analyzing and monitoring how

the different risks evolve, we are able to anticipate future scenarios and minimize potential impacts, enabling us to capital- ize on new opportunities.

2017 ANNUAL AND CORPORATE RESPONSIBILITY REPORT