Risk Management at the Brisa Group is a fundamental tool for supporting decision-making and a cornerstone of its governance. In a context marked by rapid technological evolution, environmental challenges, the growing interdependence of markets, and geopolitical instability, the ability to anticipate and respond to uncertainty has become an essential factor for the Brisa Group’s sustainability and success. In this context, risk management plays a decisive role in supporting the achievement of strategic objectives, protecting and creating value, and strengthening organizational resilience. It is an active, dynamic, and integrated process that promotes a preventive and forward-looking approach to the risks and opportunities that may impact the Group’s performance. The approach adopted involves managers from the various business units within their respective areas of operation, fostering a cross-functional culture of risk management that is integrated into business processes and decision-making.

The Brisa Group’s risk management model is reviewed periodically to ensure it remains aligned with national and international best practices, as well as with applicable legislation. It is based on the principles and guidelines defined by COSO Enterprise Risk Management (ERM) and ISO 31000—Risk Management.

The model promotes: alignment of the Group’s mission, values, strategy, and operations; the setting of strategic objectives in accordance with the risk appetite approved by senior management; the identification, characterization, and assessment of risks; the establishment of response mechanisms, controls, and mitigation measures; and the continuous monitoring and communication of relevant risks.

Managers of the various companies and business areas are responsible for identifying and describing, at least once a year, the main strategic, operational, compliance, and financial risks that could affect their respective objectives.

The risk management team provides full support for this process, including consolidating the information gathered, assessing the Group’s risk profile, and ensuring that the findings are reported to the Board of Directors and relevant stakeholders.

Risk management also involves identifying opportunities, enabling the Group to transform uncertainties into value-generating initiatives and strengthening its ability to respond to the challenges and opportunities arising from technological advancements, climate change, sustainability, cybersecurity, and the regulatory framework.

For more details on the risks most relevant to the Brisa Group’s operations, please refer to the Integrated Report.

The Brisa Group continuously monitors key risks and market trends, seeking to ensure that its risk profile adequately reflects developments in the economic, technological, environmental, regulatory, and geopolitical contexts.

This monitoring of the risk profile is complemented by tracking and reporting mechanisms that promote alignment between strategy, decision-making, and the risk appetite defined by the Group, as embodied in its Risk Appetite Framework.

At the same time, the processes that support risk management are periodically reviewed and adjusted. This approach helps strengthen the Brisa Group’s ability to anticipate and adapt, consolidating an increasingly integrated, consistent, and value-oriented approach to risk management aimed at creating and protecting sustainable value.