Risk management

Italgas has an Internal Control and Risk Management System integrated into the organisational, administrative and accounting structure and, more generally, a corporate governance system that ensures compliance with laws and company procedures, safeguards company assets and contributes to the management of activities, providing solidity to the accounting and financial data processed.

The Enterprise Risk Management (ERM) department oversees the integrated enterprise risk management process for all Group companies. The main objectives of ERM are to define a homogeneous and transversal risk assessment model, identify priority risks, ensure consolidation of the mitigation actions and develop a reporting system.

The ERM methodology adopted by the Italgas Group is in line with the reference models and the existing international best practices (COSO Framework and ISO 31000). The process for the identification, assessment, measurement and management of the risks is carried out at least annually on the basis of the relevance of the risk and any changes in context.

The activities directly involve all business departments through dedicated meetings that allow to incorporate updates to the information on the description, significance and management of the risks already existing in the portfolio, as well as the detection of new emerging risks. These activities are carried out considering the entire scope of the Group and all the potential applicable events. Risk is assessed using a special assessment scale that sets out the thresholds of relevance for the Group (impact dimensions: economic-financial; operational; legal, governance and compliance; environmental, health and safety; reputational and market) that allow the assignment of a “rating” to each risk and facilitate their prioritisation. For all risks, the risk ownerships are identified and assigned. Management strategies are defined and drilled down into specific actions for dealing with the risk and establishing the relative implementation time.

It should be considered that the Enterprise Risk Management Department, in coordination with all relevant departments, carries out a specific in-depth analysis of risks and opportunities related to the Strategic Plan. The analysis is conducted using a proprietary Monte Carlo simulation model that, based on the information gathered on magnitude and volatility of modelled events and on the related correlations, generates a multitude of alternative scenarios for the evolution of the variables underlying the Strategic Plan and evaluates their overall impact on the value-creating drivers. The analysis allows to determine the worst case and best case scenarios of main indicators: cumulated net profit before taxes of the Strategic Plan, Net Debt/RAB ratio, FFO/Net Debt ratio. In addition, specific “what-if” scenarios concerning the reference context on which the Strategic Plan is based, are identified and the respective impacts on the strategic agenda are assessed. The “what-if” and Monte Carlo analyses allow to confirm the defined economic, financial and capital targets and evaluate the level of resilience of the Strategic Plan.

At the same time, such process allows the definition of Risk Appetite Levels for Italgas key risk categories (Strategic, Financial, Normative, Operational). Risk Appetite Levels (High, Medium, Low) are quantitatively defined on the basis of the worst/best case impacts of each risk category on the Group’s financial targets:

– Financial: “Medium” Risk Appetite level, due to the uncertainty of the external context, which is open to several scenarios based on the evolution of key external financial variables (e.g. government bond yields, interest rates) impacting the Group’s targets over the Strategic Plan timeframe, also considering the potential effects on allowed revenues;
– Normative: “Medium” Risk Appetite level, mainly due to the possible medium-term update of regulated parameters that could impact on allowed revenues;
– Strategic: “Medium” Risk Appetite level, mainly due to the timeframe of gas distribution tenders and related outcomes;
– Operational: “Medium” Risk Appetite level, mainly due to artificial intelligence adoption and gas-distribution related operational risks.

The Risk Analysis section of the Strategic Plan document, which has been approved by Italgas S.p.A.’s Board of Directors, focuses on the output of this analysis including the Risk Appetite Levels related to each risk category.

ERM and Sustainability departments collaborate to ensure the integration of materiality analysis with the risk assessment of the Group, in a two-way perspective: i) materiality analysis results are used as input to ERM processes to support the identification of risks across the Organization; ii) risks identified and assessed are linked with each applicable material issue resulting from the materiality analysis.

The Enterprise Risk Management Department draws up specific reports on the identification, assessment and management of the risks and shares them with the different company levels. The risks are updated once a quarter, half-year or year, depending on their relevance.

The results found in relation to the main risks and related management plans are presented to the Control, Risk and Related Party Transactions Committee at each updating. Moreover, the mapping of risks and the relative management strategies are presented periodically to the Board of Statutory Auditors and the Supervisory Body of Italgas and to the Boards of Statutory Auditors and the Supervisory Bodies of the Subsidiaries. On these occasions, the ERM Department is responsible for inducting new members and/or carrying out educational activities for executive and non-executive directors regarding the methodologies for risk identification, valuation, prioritization and treatment, key risk indicators and the updates of the ERM model. Furthermore, specific risk management training is delivered to managers and risk owners throughout the Group to transfer Italgas’ methodologies and risk culture. For example, extensive education sessions are delivered on the occasion of new appointments, hires and following M&A activities. Ultimately, in 2026, training courses on selected risk management topics (e.g. Corporate Reporting Internal Control System, Model 231, Tax Control Framework and Tax Risk Assessment) continue to be delivered on MyLearning platform, accessible by all employees.

The Officer Responsible and the Internal Audit department periodically receive the results of the risk assessments performed by the ERM department.

Since ERM process is an integral part of the Group Management System, it is subject to internal audit on annual basis. Moreover, ERM process is externally audited during the process of renewal of Anti-Corruption and ISO HQSE certifications of the Group’s Entities (e.g. DNV anticorruption, whistleblowing, corporate compliance and quality audits on Italgas Holding in May 2026, DNV quality and occupational health and safety audits on Italgas Holding in November 2025, DNV corporate compliance audit on Italgas Holding in July 2025, DNV HSEQE audit on Italgas Reti in June 2025, DNV HSEQE audit on Toscana Energia in May 2025).

The reconciliation table below shows the main risks mapped in the ERM process being monitored, the main management methods.

Please note that, in spite of the mitigation measures introduced to monitor and prevent relevant risks from arising, Italgas does not rule out the possibility that the occurence of specific events may entail the registration of possible liabilities in the financial statements.

Description

Risk of changes in the regulatory and institutional context in Europe or nationally. Risk of a penalising update of the rate of return on net invested capital recognised by the Regulator.

Main methods of management

Active participation in the consultations called by the Regulator.

Active participation in consultations called by the Italian government or by European community organisations on relevant topics.

Guidance aimed at defining unified trade positions.

Description

Physical Risk: increased frequency of extremely intense natural events.

Emerging risk: Physical Risk: an increase in average temperatures.

Emerging risk: Transition Risk: changes in the legislative and regulatory environment for greenhouse gases.

Emerging risk: Transition risk: technological evolution that may have a negative impact on the number of active re-delivery points served.

Main methods of management

Operational countermeasures as described in the “Service continuity: malfunctioning, accidents or extraordinary events” risk

Targets for reducing net greenhouse gas emissions (Net Carbon Zero target by 2050) and net energy consumption.
Use of Picarro Surveyor technology.

Process of transforming the network into digital infrastructure to enable the distribution of gases other than methane, such as hydrogen, biomethane and e-gas.

Joining the UN Global Compact and the OGMP 2.0 of the UNEP.

Carrying out energy efficiency projects and investments in the water and energy efficiency sectors.

Actions intended to promote the development and dissemination of biomethane and power-to-gas technology.

Climate Risk Assessment – Physical and Transitional Risks

Italgas’ strategy is influenced by climate change: the analyses of climate scenarios and related Impacts, Risks and Opportunities (IRO) are constantly considered while during the drafting of the Strategic Plan. The identification and assessment of climate-related IROs is part of the double materiality analysis, which considered significant impacts from an inside-out perspective and significant risks/opportunities from a financial perspective. Climate change risks and opportunities are integrated into Italgas Enterprise Risk Management System (see “Overview of Enterprise Risk Management Model”).

To ease risk identification related to Climate Change, Italgas performs a specific analysis based on physical and transition scenarios identifying a list of risk/opportunity events applicable to Italgas. Climate Risk / Opportunity analysis involves ERM Function, Strategy Function, Sustainability Function as well as the relevant Risk Owners. Climate Change Risk and Opportunities are reported to Control and Risks and Related-Party Transactions Committee, Sustainable Value Creation Committee and Board of Directors.

Given the long timeframe that has to be considered to fully take into the account of occurrence and/or impact of such events, climate risks and opportunities are assessed within the 7-year Strategic Plan timeframe and beyond.
As part of the financial materiality assessment, the following climate-related risks/opportunities were identified as significant:

i) Risk of weakining of the weight of gas as an energy carrier.
ii) Opportunities to enable the use of renewable gas in order to meet residential demand.

Both of these events are considered Climate-related Transition Risks.

The assessment of the resilience of the Group’s strategy to mitigate and adapt to climate change was developed following an analysis based on climate scenarios that best represent the context in which Italgas operates, both transitional and physical, qualitative and quantitative, which are publicly available and do not exclude any physical or transitional risks of climate scenarios. The analysis helps identify and assess potential business impacts, and define the responses and actions needed to manage these risks and opportunities.

Regarding Physical Climate Change Risks, our climate scenario analysis is based on a third-party climate model that allows to obtain the evolution of main physical parameters, up to 2050, under RCP 1.9, 2.6, 4.5, 8.5 scenarios in the local areas (up to municipal level) served by Italgas. Physical parameters considered by the model include, for example, heating degree days, days with heavy rainfalls and water stress. Their potential impacts are then assessed on key business variables (e.g. active redelivery points), as well as considering potential damages to Group Top Locations and overall gas infrastructure (upstream and downstream of the distribution).

Regarding Transition Climate Change Risks, they are analyzed on several third parties climate and energy related scenarios with each Process Owner, as for Italgas ERM model described in the section “Overview of Enterprise Risk Management Model”. In particular, the following risks have been considered: risks associated to potential changes in National and European regulation, risks associated to non-compliance with regulation or failure to intercept/transpose new regulation falling under the scope of application, risks associated with technological changes, risks associated to environmental protection. Considerations of impacts include the overall gas infrastructure (upstream, own operations and downstream relative to distribution).

Description

Risk of not being awarded concessions in the planned areas, or being awarded concessions with less favourable conditions.

Risk of legal and/or arbitration disputes deriving from the complexity of the legislation that governs the expiry of the concessions held by Italgas.

Risk that the redemption value of the concessions for which, following the assignment process, a third party is an assignee is lower than the value of the RAB.

Main methods of management

The existing legislation states that, in the event of failure to be awarded concessions previously managed, the outgoing operator is entitled to the redemption value for the networks it owns.

Monitoring of legislative changes and evaluation of the potential impacts on the tender process.

Planning of the Tender calendar and the bidding strategy integrated into the Group’s Strategic Plan.

Critical analysis of the quality of the tender bid and implementation of improvement measures, including through use of external experts, organisations and universities.

Description

Risk of negative changes in the geopolitical context and/or atypical events with potential tensions on the financial markets, impacts on operating continuity and/or on health and safety of staff and/or on the supply chain.

Main methods of management

Group Security Operation Center (G-SOC) and central platform for correlation of information from security systems.

Travel security and operational intelligence platform.

Integrated Security Cloud Command Center and Physical Security Information Management.

With reference to the conflicts in Russia/Ukraine, Israel/Palestine conflicts and the geopolitical and military tensions in the Persian Gulf area, the absence of production activities, personnel and first- or second-tier suppliers in the areas concerned is confirmed, and no significant critical issues are reported in view of Ukraine’s decision not to renew the Russian gas transit agreement.

Description

Risk of potential losses arising from counterparties failing to fulfil their obligations or delayed payment of amounts owed.

Main methods of management

Rules for user access to the gas distribution service established by the Regulator and set out in the Network Codes.

Strong reliability of gas distribution customers as at 31 December 2025: i) in Italy, on average, 98.0% of trade receivables relating to gas distribution are settled by the due date and over 99.7% within the following 4 days; ii) in Greece, on average, 96.9% of trade receivables are settled by the due date and approximately all within the following 4 days.

Description

Risk of fluctuations in interest rates.

Risk that inflation remaining below the Group’s forecasts for a prolonged period may have negative effects on the RAB and on expected regulated revenues.

Risk of an unexpected increase in the inflation rate.

Main methods of management

High incidence of fixed-rate financial and bond debts (as at 31 December 2025, 79.8% of the gross financial debt was at a fixed rate and 20.2% was at floating rate)

Mix of external financial resources.

Monitoring of the main economic and financial indicators.

Description

Countermeasures as described in the “Changes in Interest rate, inflation and deflation” risk

Risk that new financial resources may not be available (funding liquidity risk) or that the company may be unable to convert assets into cash on the market (asset liquidity risk), meaning that it cannot meet its payment commitments.

Main methods of management

Adequate level of cash held in current accounts and fixed-term deposits with leading banks.

The EMTN programme, in addition to funding from the banking system, which presently allows issue of the remaining bonds worth a nominal € 5.0 billion to be placed with institutional investors.

Description

Risk of a downgrade in Italgas’ credit rating due to worsening in the economic and financial parameters or due to a downgrade of the rating of the Italian Republic.

Main methods of management

Countermeasures as described in the “Changes in Interest rate, inflation and deflation” risk.

Constant dialogue with rating agencies.

Description

Risk of failure to comply with financial covenants for existing loans (in some cases only when this non-compliance is not remedied within a set time period, and the occurrence of other events, such as cross-default events, some of which are subject to specific threshold values), which could result in Italgas’ failure to comply and could trigger the early repayment of the relative loan.

Main methods of management

Absence of financial covenants and/or collateral in the loan agreements (as at 31 December 2025, there were no loan agreements with these characteristics, except for the EIB loan taken out by Toscana Energia, for a nominal amount of € 45 million, which  requires compliance with certain financial covenants).

Monitoring of compliance with the following types of contractual clauses, such as negative pledge undertakings, pari passu and change of control clauses, limitations on some extraordinary transactions that the company and its subsidiaries may carry out (as at 31 December 2025, these commitments appear to have been respected).

Description

Risk of increased levels of malfunctioning of remote-reading meters with lost/failed reading of the use and/or requiring replacement or regeneration.

Main methods of management

Adoption of Nimbus, the new generation smart meter.

Maintenance of an adequate fund to cover malfunctions.

Issue of adequate guarantees by suppliers.

Resolution ARERA/DINE 01/2023 which requires, for G4/G6 smart meters produced by 2016 and installed by 2018, the recognition of the residual value.

Audits on suppliers and supply tests.

Description

Risks of malfunctioning and unforeseeable distribution service disruptions from unintended events, such as accidents, breakdowns or malfunctioning of equipment or control systems, the underperformance of plants, and extraordinary events such as explosions, fires, earthquakes, landslides or other similar events beyond Italgas’ control.

Main methods of management

Third Party Liability Insurance and Asset Protection coverage Procedures.

Communication campaigns, training and meetings to raise awareness.

DANA (Digital Advanced Network Automation), network command and control system.

Smart Maintenance: GIS model for the intelligent maintenance of Italgas networks.

Scheduled gas leakage detection.

Description

Risks of cyber attacks on the IT (Information Technology), OT (Operational Technology) and IoT (Internet of Things) sectors.

Main methods of management

Cybersecurity insurance coverage.

Bludigit ISO 27001 certification.

Security measures to protect endpoints, access, information.

Specific training on cyber risks.

Phising simulations for the Group’s employees.

Secure Product Development Lifecycle process, regular IT and OT vulnerability assessment and penetration tests.

Real-time monitoring of IT and OT systems using the Security Information and Event Management (SIEM).

Leading sector suppliers with maximum levels of security defined and monitored.

“Cybersecurity Awareness for third parties”.

Cyber Threat Intelligence.

Description

Risk of incidents and/or injuries involving employees and partner companies.

Risk that Italgas may incur costs or liability, including to a significant extent, arising from any environmental damage.

Risks associated with the spread of pandemics or new diseases.

Main methods of management

Insurance policies for “individuals”.

HSE system certified according to international legislation.

Monitoring of HSE legislation.

Digital applications for reporting and recording “near misses” and for waste management.

Communication campaigns, HSE awareness meetings and training sessions also with suppliers/contractors on HSE topics and for creating standardised operating procedures.

Internal procedures providing for specific measures against suppliers/contractors in the event of non-compliance in the HSE field.

Audits on suppliers during qualification and normal activities.

Activities to promote health and well-being.

Specific actions for remediation activities, such as risk provision and audits on sites undergoing remediation, carried out internally and by third parties.

Description

Risks associated with the development of human resources, including risk of resources in key roles leaving, lack of technical and specialist know-how, increase in the age of company personnel, drop in the level of satisfaction and/or increase in workplace disputes.

Main methods of management

Top Employers certification.

Italgas Academy, Training courses in partnerships with universities, Multimedia platform with training initiatives.

Knowledge transfer system.

I-Grow Programme and Smart Rotation System.

Succession plan for senior roles.

UNI/PdR 125:2022 certification for gender equality.

Survey on corporate climate extended to all Group employees.

Welfare system.

Description

Risk of non-compliance of the commercial levels of service for services to sales companies and/or risk of delayed or partial compliance with the obligations assumed.

Main methods of management

Continuous monitoring of Key Performance Indicators.

Capexforce software for digital oversight of the investment process.

Surveys at sales companies.

Mapping the existing concession obligations, monitoring and activating the network technical units for prompt interventions.

Constant dialogue with contracting parties.

Description

Risks associated with the availability and cost of materials, services and supplies, the operating capacity and scalability and the reputational and compliance reliability (including respect for human rights) of the suppliers and contractors of the Group.

Main methods of management

Planning of procurement, analysis and monitoring of department KPIs.

Economic-financial, reputational verifications and on-site technical and ESG checks for the Qualification purposes and ESG for Suppliers deemed Critical/Strategic.

“Supplier Code of Ethics”.

Standardised tender processes and regulations.

ESG reward criteria during the tender phase, ESG audits and implementation of the Action Plan.

Anti-mafia audits in tender procedures relating to special sectors.

Supplier performance evaluation, including in terms of sustainability.

Procurement diversification and scouting activities for innovative assets, produced with alternative materials.

Description

Emerging risk, whose potential effects for the Company and/or the industry refer to a medium- to long-term time horizon, associated with the evolution of the AI Models (Machine Learning and Generative Artificial Intelligence) commercially available, whose time-to-market and functionalities may be unforeseeable, and with the adoption and use by the Group. These models, in case they are not properly trained (i.e. external data reliability), managed, updated and monitored, may result in unreliability in terms of quality, controllability, interpretability of outputs and potentially lead to decision-making errors, with negative consequences on the Group’s cost and investment profile.

Main methods of management

Presence of a dedicated department (Group Artificial Intelligence Office) aimed at leading the transformation, coordinating the various stakeholders involved in the deployment, overseeing the implementation and coordinating the overall digital transformation plan of the Group’s activities.

Model training carried out in the development phase and periodically updated.

Testing during the development phase.

Monitoring of model performance level in terms of accuracy and reliability.

Description

Risk of non-compliance with legislation at European, national, regional and local level with which Italgas must comply in relation to the activities that it carries out and/or risk of failure to intercept and transpose new regulations falling under the scope of application.

Main methods of management

Internal control and risk management system and areas of responsibility defined in terms of compliance.

Code of Ethics, Model 231, Policy for the prevention of and fight against corruption, ISO 37001 anti-bribery certification.

ISO 37301 compliance system certification.

Training for personnel on compliance issues.

Analysis and monitoring of the reputational requirements of the Group’s counterparties.

“Supplier Code of Ethics”.

Description

Emerging risk, whose potential effects for the Company and/or the industry are referred to a medium-term time horizon, associated with the worsening of ESG performance in the supply chain, due to the potential difficulty of Group suppliers to adapt and comply with future ESG regulatory requirements. Given the relevance of Small-Medium-Enterprises in our supply chain, the risk impact is to be meant as the possible difficulty of finding suppliers with ESG standards adequate to future regulatory evolutions (e.g. CS3D, CBAM as well as today unknown evolutions) with operational impacts (e.g., execution delays, replacement costs), reputational impacts, and / or worsening of Group performance related to indirect emissions (e.g., Scope 3 emissions).

Main methods of management

ESG Reporting is a mandatory requirement in the Group’s supplier qualification process.

Assessment and development plans for strategic suppliers.

Periodic monitoring of suppliers with a focus on ESG.

Training and awareness programmes for Suppliers on ESG topics.

In compliance with the CSRD, the Italgas Group has conducted the double materiality exercise in accordance with the European Sustainability Reporting Standards (ESRS). The analysis is the starting point for the identification of the most relevant issues for the Group and its main stakeholders, as well as for the definition of the topics to be addressed and deepened within the Sustainability Statement. The main Impacts, Risks and Opportunities (IROs) linked to environmental, social and governance issues for the Group’s direct operations, as well as along the value chain, have been identified in a structured and systematic way, considering the time horizons in which they are expected to be implemented. The assessment of Risks and Opportunities carried out by the ERM department serves as input for the assessment of possible Impacts; at the same time, the updated list of impacts is critically analysed by ERM for identifying possible Dependencies and Impacts as sources of potential Risks and/or Opportunities with financial effects, identifying possible alignments, synergies, contributions and possible trade-offs between Risks and Opportunities, and Impacts. This process is closely integrated into the Group’s ERM system, in line with international best practices and standards, such as the COSO Framework and ISO 31000; it has also been shared with company departments competent in the subject matter, and with the Group’s Top Management, ensuring that the data collected is validated and a complete view of the impacts and risks is obtained. The decision-making process involves the Sustainable Value Creation Committee and the Control and Risks and Related-Party Transactions Committee, which evaluate the results of the analysis before their final approval by the Board of Directors.

In particular, in the context of the financial materiality analysis, an outside-in perspective was adopted, aimed at identifying risks and opportunities that affect or could affect the Group’s financial position, economic results and cash flow, as well as access to the financial market and cost of capital, in the short, medium and long term. The significant risks/opportunities have been outlined for each applicable ESRS Topic/Sub-Topic.

Each event was assessed using thresholds of probability of occurrence (very likely, likely, possible, remote) and impact on the economic-financial dimension (maximum, high, medium, low), taking into account the persistence of the impact in the short, medium or long term. The combination of the level of probability and maximum impact on the economic-financial impact scale constitutes a rating (very relevant, relevant, of little relevance and not relevant) associated with each risk/opportunity, and represents its prioritisation. The methodology followed for the prioritisation of risks and opportunities does not depend on the type of risk; in fact, sustainability risks are prioritised using the same criteria as those used for other types of risk. Risks/opportunities rated “relevant” or “very relevant” are considered significant; the presence of at least one significant risk/opportunity determines the financial materiality of the ESRS Topic/Sub-Topic to which the event is connected. Significant risks are linked to those present in the mapping of ERM risks. Relevant opportunities are incorporated into the strategic agenda. The main inputs taken into consideration for the analysis of the significant risk relating to the topic of Climate Change refer to energy scenarios developed by external sources (ENTSOG-ENTSOE Distributed Energy and Global Ambition). For the analysis of relevant opportunities relative to the topic of Climate Change, the investments and assumptions set forth in the Group’s Strategic Plan were taken into consideration.