Risks

In the performance of its corporate objectives Ferrovial is exposed to diverse risk factors deriving from the nature of the sectors in which it operates, the countries in which its activities are located and the different regulations to which it is subject. Risk management is fostered throughout the Group and integrated in all key processes, from asset management to M&A.

Policy

The company has a Risk Control and Management Policy, in line with COSO ERM framework and the three line defense model as International reference standards, which provides the employees of Ferrovial with a general frame of action for the control and management of the risks of any nature that they face in the performance of the business objectives and the general strategy of Ferrovial. Following COSO´s guidance, risk appetite towards our strategic objectives has been determined by the BoD, and targets and tolerance identified for key risk factors, integrating them into decision-making.

The Policy, approved by the Board of Directors, is updated at least every three years and is communicated throughout the organization for implementation and employees receive specific training on internal risk management and control systems related to their activities.

Board of Directors

Ferrovial’s Board of Directors identifies and analyzes the risks associated with the strategy and activities of the Company and its businesses, in accordance with the Risk Control and Management Policy. It is responsible for risk management oversight, for establishing the risk appetite as well as the measures put in place in order to counter the risk taken. Based on risk assessment, the Board designs, implements and maintains adequate internal risk management and control systems.

The Board of Directors has the appropriate skills to perform its risk oversight function. A plan has been established to provide the Board of Directors with various training sessions related to their risk oversight function, among other areas. The annual training includes key topics, along with periodic, or as needed, sessions on specific topics, such as cybersecurity and sustainability. The aim is to further develop knowledge on the risks related to the diverse subjects and enhance decision-making processes.

Audit and Control Committee

The Audit and Control Committee assists the Board of Directors in fulfilling its responsibilities, discussing the Company’s policies with respect to risk assessment and risk management, and overseeing the Company’s enterprise risk management system.

Internal Audit

The Internal Audit function, acting as a third line of defense, supervises the company’s risk management system through internal audits of the company’s various risk management processes (financial, operational, compliance, etc.), issuing recommendations to correct any weaknesses detected.

Enterprise Risk department

The Enterprise Risk department, independent of the business lines and acting as second line of defense, is responsible for developing the risk management process, known as Ferrovial Risk Management. This ensures uniform risk management across Ferrovial and involves periodic reporting to the Audit and Control Committee and, where appropriate, to the Board of Directors on the risks that threaten the achievement of business objectives and compliance with the risk targets approved by the Board of Directors.

On the other hand, as part of the second line of defense, certain divisional and corporate directorates in their area of responsibility, are responsible for establishing policies and strategies regarding their specific risks and for the monitoring and oversight of risk management across the organization.

Business Managers

Business managers, acting as the first line of defense, are responsible for the identification and management of risks associated with the achievement of the objectives in their area of activity.

Ferrovial Risk Management

The Policy is complemented by the Ferrovial Risk Management (FRM) Procedure that describes in detail the different risk components (identification, evaluation, management, monitoring & reporting) and activities performed by the Group.

The risk identification and assessment, included in FRM, is a bottom-up process promoted by the Management Committee and implemented in all the company’s business areas, under the regular supervision of the Audit and Control Committee of the Board of Directors. The process is carried out twice a year.

Through the application of common metrics, the process allows risk events to be identified in advance and assessed in terms of their likelihood of occurrence and their potential impact on business objectives, including corporate reputation. In this way, the highest rated risks are prioritized in order to take the most appropriate mitigation measures according to the nature of the risk, as well as to take advantage of the opportunities that may arise from proper risk management.

For each risk event identified, two assessments are carried out: an inherent assessment prior to the specific control measures implemented to mitigate the risk, and a residual assessment, after specific mitigation measures have been implemented.

In a process of continuous improvement, Ferrovial periodically carries out reviews of the risk management process by means of an internal audit and an external consultancy exercise in order to detect weaknesses and improve the performance of the process in accordance with comparable international best practices.

Emerging Risks

The FRM process also identifies, assesses, and monitors emerging risks. In this regard, Ferrovial has launched an initiative that represents an important step forward in the proactive management of Ferrovial’s emerging risks, which will serve as a support tool in decision-making.

In March 2025, the first workshop on emerging risks brought together experts from various Ferrovial business units to identify and analyze potential risks to the company. Among the identified risks reported to BoD, the following are particularly noteworthy. Impact and mitigation actions were determined:

• The emerging risk of Quantum computing has stood out as one of the most significant for Ferrovial. Quantum technology in computing offers exponentially higher processing power compared to traditional binary systems.
  • Impact: This increase could significantly heighten cyber threat risks, as conventional encryption methods may become inadequate against quantum computing’s capabilities. This may lead to increased vulnerability to cyberattacks, information theft, and operational disruptions.
  • Mitigating actions: We are monitoring technological advancements and industry use cases and forming strategic partnerships with capable entities to develop protective technologies.
• Another emerging risk identified is changes in mobility patterns. Several emerging technologies and trends have the potential to change long-term mobility patterns in a way that could adversely impact Ferrovial’s business.
  • Impact: The rise of vehicle automation has the potential to decrease travelers’ willingness to pay to save time on the road, while the expansion of AI may result in job displacement among current commuters, potentially decreasing overall travel demand.
  • Mitigating actions: To address this risk, we are closely monitoring these and other emerging trends to ensure the resilience of our business model in response to evolving patterns in the movement of people and goods. In addition to monitoring trends, we are engaging in scenario analysis exercises and establishing strategic partnerships with leading companies.