Risks

In the performance of its corporate objectives, Ferrovial is exposed to diverse risk factors deriving from the nature of the sectors in which it operates, the countries in which its activities are located and the different regulations to which it is subject. Risk management is fostered throughout the Group and integrated in all key processes, from asset management to M&A.

Policy

The company has a Risk Control and Management Policy (hereinafter, “the Policy”), in line with COSO ERM framework and the ‘Three Lines Model’ as International reference standards, which provides the employees of Ferrovial with a general frame of action for the control and management of the risks of any nature that they face in the performance of the business objectives and the general strategy of Ferrovial. Following COSO´s guidance, risk appetite towards our strategic objectives has been determined by management and presented to the BoD, and targets and tolerance identified for key risk factors, integrating them into decision-making.

The Policy, approved by the Board of Directors, is updated at least every three years and is communicated throughout the organization for implementation. The most recent update took place in 2025.

Risk appetite is a key element of both the policy and Ferrovial’s Enterprise Risk Management (ERM) framework. Specific metrics have been established for the most relevant risk factors, enabling the organisation to quantify and effectively monitor its risk appetite.

Recently, the investment process has been reviewed, resulting in the introduction of new risk appetite metrics and targets, as well as the update of existing ones. The Investment Procedure has been revised to ensure that risk methodology is fully embedded, reinforcing the policy principle that risk considerations should be integrated into all strategic processes. This approach reinforces Ferrovial’s commitment to embedding risk management across all critical processes, including not only growth through investment but also the full spectrum of its core service activities, such as infrastructure management, construction, and energy and digital infrastructure

Compliance with the approved risk appetite is continuously monitored and periodically reported to the Audit and Control Committee, which in turn reports to the Board of Directors. The overarching objective is to align the organisation by using risk appetite as a fundamental tool for risk management and decision-making.

Board of Directors

Ferrovial’s Board of Directors identifies and analyses the risks associated with the strategy and activities of the Company and its businesses, in accordance with the Risk Control and Management Policy. It is responsible for risk management oversight, for establishing the risk appetite as well as the measures put in place in order to counter the risk taken. Based on risk assessment, the Board designs, implements and maintains adequate internal risk management and control systems.

Audit and Control Committee

The Audit and Control Committee assists the Board of Directors in fulfilling its responsibilities, discussing the Company’s policies with respect to risk assessment and risk management, and overseeing the Company’s enterprise risk management system.

Internal Audit

The Internal Audit function, acting as a third line of the ‘Three Lines Model’, supervises the company’s risk management system through internal audits of the company’s various risk management processes (financial, operational, compliance, etc.), issuing recommendations to correct any weaknesses detected. 

Enterprise Risk department

The Enterprise Risk department, independent of the business lines and acting as second line of the ‘Three Lines Model’, is responsible for developing the risk management process, known as Ferrovial Risk Management. This ensures uniform risk management across Ferrovial and involves periodic reporting to the Audit and Control Committee and, when appropriate, to the Board of Directors on the risks that threaten the achievement of business objectives and compliance with the risk targets approved by the Board of Directors.

On the other hand, as part of the second line, certain divisional and corporate directorates in their area of responsibility are responsible for establishing policies and strategies regarding their specific risks and for the monitoring and oversight of risk management across the organisation.

Business Managers

Business managers, acting as the first line of the ‘Three Lines Model’, are responsible for the identification and management of risks associated with the achievement of the objectives in their area of activity.

Ferrovial Risk Management

The Policy is complemented by the Ferrovial Risk Management (FRM) Procedure that describes in detail the different risk components within the process (identification, evaluation, management, monitoring & reporting) and activities performed by the Group. 

The risk identification and assessment, included in FRM, is a bottom-up process promoted by the Management Committee and implemented in all the company’s business areas, under the regular supervision of the Audit and Control Committee of the Board of Directors. The process is carried out twice a year.

Through the application of common metrics, the process allows risk events to be identified in advance and assessed in terms of their likelihood of occurrence and their potential impact on business objectives, including corporate reputation. In this way, the highest rated risks are prioritized in order to take the most appropriate mitigation measures according to the nature of the risk, as well as to take advantage of the opportunities that may arise from proper risk management.

The risk management process is periodically reviewed with the aim of continuous improvement. During 2025, Ferrovial launched a project to update the FRM model, including the implementation of a new GRC system. The new FRM model became fully operational for the 2026 Risk Map campaign and will further strengthen the evaluation, control, monitoring, and administration of Ferrovial’s risk framework. Furthermore, the GRC will serve as a unified platform for other areas that manage or oversee specific risks; where applicable, these domains will be integrated with the FRM.

Among the main innovations introduced in the new process, particular emphasis is placed on the inclusion of opportunities, the quantification of certain risks and opportunities, and the revision and expansion of the assessment scales. Risk management however, is embedded throughout the different processes within the group.

Risk Culture

Ferrovial promotes a strong risk management culture across all its divisions, supported by various initiatives such as periodic training on Risk Management throughout the organisation, including the Board of Directors and Non-executive Directors, and the inclusion of specific risk management metrics within senior management’s financial incentives.

Starting with the tone at the top, to further strengthen Board of Directors risk capabilities, a structured training programme delivered by highly regarded external experts has been established, providing the Board with periodic, specialised, and up-to-date sessions.

Given the seniority of Board members, these sessions focus on key risks—such as geopolitics,  cybersecurity or sustainability-, fostering continuous improvement in decision-making processes and risk management. This approach ensures that Board members maintain a robust and current understanding of evolving risks, thereby enhancing the quality of oversight and supporting continuous improvement in both decision-making and risk management processes.

Additionally, and in alignment with the recent methodological enhancements and the introduction of a new risk management tool, mandatory training sessions for all business managers were conducted in February 2026. These consisted of four sessions attended by a total of 162 managers.  These sessions comprehensively addressed the latest updates and reinforced fundamental principles of risk management. Furthermore, a deep-dive session was conducted with the management committee, and tailored training was delivered individually to each manager, ensuring a thorough and bespoke understanding of the revised processes and responsibilities.

Emerging Risks

The FRM process also identifies, assesses, and monitors emerging risks. In this regard, Ferrovial has launched an initiative that represents an important step forward in the proactive management of Ferrovial’s emerging risks, which will serve as a support tool in decision-making.

In March 2025, the first workshop on emerging risks brought together experts from various Ferrovial business units to identify and analyse potential risks to the company. Among the identified risks reported to BoD, the following are particularly noteworthy.

Disruptive technologies in mobility, such as vehicle automation and artificial intelligence are poised to significantly alter mobility patterns, potentially leading to decreased travel demand and reduced willingness to pay for time-saving, while the expansion of AI could lead to job losses among current commuters. To address these challenges, Ferrovial actively monitors emerging trends, performs scenario analyses, and pursues strategic partnerships to ensure resilience and adaptability.

Concerns about the sustainability of air travel, driven by its perceived negative impacts on climate change, health, and heightened environmental awareness, may result in declining air traffic demand. These shifts could initially affect business flights due to stricter sustainability policies, followed by reductions in leisure and tourism travel. Additionally, new regulations could increase operational costs and disrupt strategic plans and future business opportunities. To address these risks, continuous monitoring of trends and scenario analysis are performed for maintaining resilience.