Risks

ANTICIPATING PROBLEMS

Effective risk management provides competitive advantages to meet the challenges of an evolving marketplace.

Ferrovial has a Risk Management and Control Policy, approved by the Board of Directors, which sets out the general framework for the management and control of various types of risks that the management team may encounter to attaining the business objectives, as well as the acceptable risk and the level of tolerance for each risk factor.

EFFECTIVE RISK MANAGEMENT: FERROVIAL RISK MANAGEMENT

In order to detect risks to attaining the business objectives sufficiently in advance, the company has a risk identification and assessment process called Ferrovial Risk Management (FRM), managed by the Compliance and Risk Department, promoted by the Management Committee and implemented in all the company’s business areas, under the regular oversight of the Board of Directors’ Audit and Control Committee.

Through applying common metrics, the process allows for early detection and assessment of risk events based on their likelihood of occurrence and potential impact on business objectives, including corporate reputation. This enables Ferrovial to roll out the most suitable management and protective measures according to the nature and location of the risk.

For each risk event identified, two assessments are carried out: one inherent, before the specific control measures put in place to mitigate the risk, and another residual, after implementing specific control measures.

FERROVIAL RISK MANAGEMENT

MAIN RISKS

Below is a description of the most relevant risk events, their potential impact and a list of the main control measures implemented to mitigate their impact and/or probability of occurrence.

RISK EVENT DESCRIPTION POTENTIAL IMPACT CONTROL MEASURES
COVID-19 PANDEMIC EFFECTS (SEE COVID-19 SECTION, PAGE 42-43) The mobility restrictive measures implemented by national and international authorities to deal with the serious effects of the pandemic on people’s health (border closures, lockdowns, partial mobility limitations, etc.) have had an adverse effect on the global economy, contracting activity and reducing individual income, which has had a negative impact on margins and flows of the mobility-dependent infrastructure projects managed by Ferrovial (toll roads and airports).

Uncertainty about the development and duration of the pandemic, as well as its effects on mobility habits in the medium and long term, and on the need to provide safe mobility, create an uncertain risk scenario for the fulfillment of Ferrovial’s strategic objectives.
  • Health and safety of employees.
  • Reductions in margins and flows in operating infrastructure projects.
  • Contractual breaches with third parties.
  • Reduction of business opportunities.
  • Standstills, delays or suspensions of tendering processes.
  • Liquidity strains.
  • Potential noncompliance with financial covenants.
  • Negative impact on asset valuation.
  • Health and safety protection measures for employees, following the recommendations of the health authorities.
  • Creation of a specific committee to monitor the pandemic and its impact on employees.
  • Measures to preserve liquidity in the short/medium term.
  • Negotiation of financial waivers with creditors.
  • Opex and Capex optimization plans.
  • Use of temporary suspension of employment instruments.
  • Use of contractual guarantees and insurance coverage.
  • Constant monitoring of business plans, scenario analysis and risk anticipation.
DISINVESTMENT PROCESSES In December 2018, Ferrovial decided to start the process of selling the assets linked to its Services division. The process has been delayed in part by the effects of the COVID-19 pandemic on economic activity, putting at risk meeting sales targets and the value of assets.
  • Delays in divestment.
  • Worsening of the financial situation of potential buyers and thus of sales opportunities.
  • Reduced expectations of value.
  • Active search for sales opportunities.
  • Measures of asset value generation.
POLITICAL FACTORS/
REGULATORY FRAMEWORK		 Some of Ferrovial’s assets are subject to specific regulation of the activity. The increase in protectionist policies in some of the areas in which Ferrovial operates, together with the general situation of economic contraction, could lead to regulatory changes on permits and authorizations not being granted, which could have a negative impact on asset management and development plans, and on tendering new projects.
In the case of Heathrow Airport, the negotiation of the next regulatory period, coupled with uncertainty over the airport’s expansion, puts meeting business objectives at risk. Conversely, the start of the negotiation of the next regulatory period is an opportunity to improve the value of the asset.
  • Compliance with asset development plans.
  • Reduction of tendering processes for projects in which Ferrovial has a competitive advantage (P3).
  • Impact on the project’s cash flows and therefore on its liquidity in the short/medium term.
  • Ongoing monitoring of regulatory and legislative processes that could affect activities.
  • Monitoring political movements in order to anticipate possible changes well in advance.
  • Active negotiation of new regulatory frameworks.
CYBER THREATS
(SEE
CYBERSECURITY SECTION, PAGE 98-99)		 The infrastructures that Ferrovial operates are exposed to risks associated with the threat agents that exist in cyberspace (mafias, government agencies, hacktivists, insiders, etc.) that can compromise the security and normal operation of assets through various kinds of cyber-attacks.

In December 2020, Amey, Ferrovial’s British services subsidiary, was the victim of a ransomware cyberattack coming from hostile government agencies that also affected other large companies in the United Kingdom. The case required the activation of the containment, response, recovery and lessons learned protocols defined by the company, which made it possible to isolate the incident at Amey’s local level, without affecting the rest of Ferrovial’s businesses and activities.
  • Degradation or impossibility of operation of the assets.
  • Loss or theft of know-how and/or intellectual and industrial property.
  • Economic loss due to the costs of recovering the activity.
  • Sanctions for regulatory and/or contractual breaches.
  • Damage to corporate reputation.
  • Global Security Model, ISO 27001 certified, audited annually.
  • Periodic evaluation of security controls deployed in the organization.
  • Establishment of a Global Security Committee.
  • Insurance coverage for various kinds of cyber incidents.
PROJECTS TENDERING AND CHOICE OF PARTNERS Ferrovial participates in highly competitive bidding processes for large infrastructure projects with long lead times to award. Success in these processes requires an adequate study of prices and deadlines, the availability of reliable suppliers, as well as the selection of suitable partners with sufficient technical and economic capacity.

In this context, Ferrovial is exposed to the risk of committing errors in the study and choice of suitable partners and suppliers, with a potential impact on the profitability objectives set.
  • Reduced margins in project implementation.
  • Breaches of contract with clients and imposition of penalties and sanctions.
  • Damage to corporate reputation.
  • Investment approval procedure, whereby the most relevant risks for each project are assessed and weighted.
  • Implementation of a new tendering process that focuses on price analysis and the selection of suitable partners and suppliers.
  • Enhancing pre-award supplier agreements.
QUALITY OF SERVICE/CONTRACTUAL DISPUTES
(SEE QUALITY SECTION, PAGE 80-81)		 Ferrovial’s strategy is focused on technically complex projects and numerous risk factors, sometimes difficult to foresee, may arise while these are being undertaken. This may generate conflicts and disputes with third parties.
  • Noncompliance with agreed quality standards.
  • Committed delivery deadlines.
  • Contractual disputes with third parties.
  • Damage to corporate reputation
  • Quality management systems by business (ISO 9001).
  • Indicators of quality levels in project implementation and service delivery.
  • Audit plan in place.
GENERATING AND ATTRACTING TALENT
(SEE PEOPLE SECTION, PAGE 72-73)		 The concentration of business opportunities in certain geographical areas in which Ferrovial operates increases competition and generates a strong demand for qualified professionals, making it difficult to attract, generate and retain the talent necessary to develop business plans.
  • Loss of business opportunities due to lack of qualified staff.
  • Non-fulfillment of commitments with clients (deadline, quality, etc.)
  • Plan for the identification and empowerment of talent in the organization.
  • Enhance the exploration of local markets.
  • Succession planning for key positions.
HEALTH AND SAFETY
(SEE HEALTH AND SAFETY SECTION, PAGE 74-75)		 The nature of Ferrovial’s activities exposes it to the risk of accidents that may cause damage to people and the company’s operations.

The current global pandemic context implies an additional risk to the health and safety of employees and the continuity of operations.
  • Physical harm to employees and third parties.
  • Operational impacts of business interruption.
  • Civil/criminal liability.
  • Damage to corporate reputation.
  • Implementation of health and safety systems (adapted with anti-COVID-19 measures) in accordance with the activities carried out and the characteristics of the workplaces.
  • Continuous health and safety training for employees.
  • Health and safety management systems audit plan.
  • Civil and professional liability cover.
CLIMATE CHANGE
(SEE
ENVIRONMENT, PAGE 86)		 Exposure to risks relating to climate change. First, extreme weather events that may affect infrastructure and, secondly, the economic effects (increased cost of raw materials) and technological changes resulting from regulatory changes aimed at reducing pollutant gases (increased taxes on fossil fuels, higher prices of fossil fuels, higher prices of fuels, prices of GHG emissions, new modes of transport with an impact on the business plan of the projects, etc.)
  • Physical damage to infrastructure and disruption of operations.
  • Decreased productivity in extreme weather conditions.
  • Increase in coverage premiums.
  • Rising commodity prices, increased taxes on fossil fuels.
  • Payment for emissions produced or incorporation of activities within the emission allowance market.
  • Process to identify and assess the risks arising from climate change in order to anticipate them sufficiently in advance to be able to implement remediation and adaptation measures in response to the new environment.
  • Control and monitoring tools.
ENVIRONMENTAL DAMAGE
(SEE
ENVIRONMENT, PAGE 86)		 The nature of the activities carried out by Ferrovial is exposed to committing actions that may damage the environment and the natural surroundings in which they are carried out.
  • Physical and structural damage to the environment in which the company operates.
  • Interruption of operations.
  • Civil and criminal liability of legal and natural persons.
  • Damage to corporate reputation.
  • Certified environmental management system (ISO 14001), audited annually.
  • Insurance policy with sufficient cover and compensation limits to meet possible liability arising from environmental risks.
  • Digital media to ensure compliance with and awareness of all applicable technical legislation and regulations.
ETHICS AND INTEGRITY
(SEE INTEGRITY, PAGE 82-83)		 Ferrovial’s activities are exposed to employees committing acts, with or without the help of third parties, which may involve a breach of the required principles of integrity, transparency and respect for legality and human rights.
  • Criminal liability of legal and natural persons.
  • Reduced business opportunities due to noncompliance with ethical requirements.
  • Damage to corporate reputation.
  • Compliance Program aimed at preventing unethical and unsound acts.
  • Certified anti-bribery and criminal prevention system (UNE-ISO 19601 and ISO 37001).
  • Training plan to combat crime and in particular corruption.
FINANCIAL RISKS Risks associated with changes to financial and counterparty data, access to the financial markets, cash management, the reliability of financial information and tax-related risks.

Financial risks and their treatment are detailed in note 5.4 of the annual financial statements.
  • Loss of opportunities due to reduced capacity to finance projects.
  • Reduced net margins.
  • Assessment and management of the risk exposure of the main financial variables: liquidity, counterparty, interest rate, exchange rate and share price. The analysis makes a distinction between the policies applied in
    infrastructure project companies and the rest of companies, in those cases where such a difference is relevant.

In addition, Ferrovial assesses and monitors the performance of emerging risks that could have a significant long-term impact on the business, mainly those with a potentially significant impact on the mobility patterns of individuals, on raising finance in the capital markets, on the development of transport infrastructure and on the physical and digital security of processes. These risks include sustainable financing linked to nonfinancial or ESG criteria (environmental, social and governance) due to their impact on the availability of resources to finance projects and their profitability, as well as the risks associated with the transition to a low-carbon economy and the potential impact of extreme weather conditions on the management of the company’s assets.

To mitigate these emerging risks, the company has developed a new Strategic Sustainability Plan, with environmental and social objectives, and is undertaking an analysis to categorize its activities to identify those that contribute substantially to sustainable growth and a climate-neutral economy.

Finally, it should be noted that increased global trade tension and the protectionist measures being implemented are having a negative impact on global trade, capital markets and the regulatory environment. In this context of socio-economic uncertainty, the relevance of some risks that are currently considered unlikely may increase.