CORPORATE RISK MANAGEMENT

We approach enterprise risk management through a holistic framework that supports the achievement of our strategic objectives, strengthens our decision-making processes, and promotes long-term value creation. Rather than addressing risks only after they occur, we adopt a proactive approach by assessing them together with their potential impacts. In line with this approach, we evaluate environmental, social, governance, operational, strategic, financial, and regulatory compliance risks from an integrated perspective.

We structure our enterprise risk management framework based on the Three Lines of Defense model. Through this model, we aim to ensure the effective identification, management, and monitoring of risks across the organization, while strengthening the effectiveness of our internal control and governance processes.

Within the first line of defense, operational units that are the direct owners of risks are responsible for managing risks within the scope of their daily activities, implementing internal controls, and ensuring the effectiveness of processes. Operations, plants, ready-mix concrete facilities, ports, and terminals, together with the managers responsible for these areas, constitute the main components of the first line of defense.

The second line of defense includes risk management, compliance, internal control, and related support functions. By monitoring the practices of the first line, these functions strengthen risk management processes through frameworks, policies, procedures, and guidelines. Within this scope, functions such as financial control, risk management, compliance controls, information technologies, information security, physical security, legal affairs, human resources, supply chain, and quality assurance contribute to the effectiveness of the second line of defense.

The third line of defense consists of the internal audit function, which provides an independent and objective evaluation of risk management and internal control processes. This line reviews the effectiveness of the first and second lines of defense, provides recommendations for improvement, and offers assurance to senior management and relevant committees.

Within the scope of our risk management processes, we identify risks, conduct impact and likelihood analyses, define control mechanisms, and monitor risks on a regular basis. In this process, we utilize various analytical methods and reporting tools to ensure the effective management of risks.

In our corporate reporting, we also integrate environmental, social, and governance (ESG) dimensions into our risk management approach. Topics such as the transition to a net-zero economy, the efficient use of natural resources, climate change, biodiversity, water, and marine resources are addressed within the framework of risks and opportunities, and developments in these areas are monitored on a regular basis.

In the assessment of climate-related risks and opportunities, we make use of national and international data sources as well as sector analyses. Within this scope, while continuing our efforts to determine the financial impacts of sustainability-related risks and opportunities, we address the risks and opportunities identified under topics such as climate change, air quality, resource use, circularity, water management, and biodiversity in alignment with our reporting frameworks. Detailed information regarding the management of climate-related risks and opportunities, as well as their impacts on our business strategies and financial planning, is presented in the Risk Management and Strategy sections of the Akçansa TSRS-Aligned Sustainability Report.

Within our risk assessment processes, we apply both qualitative and quantitative analysis methods and prioritize risks with significant financial and strategic impacts. By conducting location-based assessments, we also incorporate the environmental and social conditions surrounding our facilities into our analyses. Through this approach, we aim to effectively manage existing risks while identifying and leveraging long-term opportunities.

As part of our business continuity management approach, we focus on strengthening the resilience of our operations against potential disruptions. Based on the ISO 22301 Business Continuity Management System standard, we evaluate risk scenarios and regularly review our recovery and continuity plans. Our efforts to strengthen disaster management and operational resilience are integrated into our risk management processes.

To promote a strong enterprise risk management culture, we conduct training and awareness activities aimed at increasing employees’ risk awareness, and we continuously enhance practices covering risk, crisis, and business continuity management. Through this approach, we aim not only to manage risks but also to establish a robust risk management framework that supports the sustainable growth objectives of Akçansa.