Processes for identifying, assessing and managing climate-related risks

Index: 25(a)(i)–(vi), 25(b) and 25(c) map to section 14.1 (p.116).

Risks. AGL maintains an enterprise-wide risk management framework embedded in business processes, strategy setting and operational activities, using defined thresholds for likelihood and consequence across six dimensions: Commercial/profitability; Regulatory compliance; Reputation, community and customer; Environment; Health and safety; and People. Many Tier 1 Strategic Risks contain climate-related aspects. Climate-related risks are identified and assessed top-down and bottom-up, drawing on risk registers, strategic and business planning, climate-related scenario analysis and consultation with senior management and subject matter experts, and are monitored through periodic climate risk reviews and management reporting. The Climate Risk Management Program was developed to align identification and disclosure practices with AASB S2. The test for whether a risk could reasonably be expected to affect prospects considers high-impact, low-likelihood catastrophic events (for example extreme bushfire) and/or risks that could significantly impact delivery of strategy.

Opportunities. AGL's two strategic pillars are the framework for identifying value pools. Assessment weighs qualitative and quantitative factors, top-down and bottom-up, and whether each activity is important to delivering strategy or expected to be strategically significant to stakeholders.

To support risk management, AMP has a Risk Management Framework which comprises of our Strategy and Business Plans, the Risk Management Strategy, our Risk Appetite Statement, and supporting policies and practices that guide consistent risk oversight across the organisation. Climate‑related physical and transition risks are integrated within the Risk Management Framework along with other material risk types. AMP follows a holistic approach to identifying, assessing, prioritising and monitoring risks. While the framework applies enterprise‑wide, business units have a standalone Risk Management Strategy, to address regulatory requirements, which builds on the AMP framework with additional provisions as required.

The process for identifying, assessing, prioritising and monitoring climate‑related risks and opportunities is: Identification → Assessment → Prioritisation → Monitoring.

Identification

Risk and opportunity identification is the key mechanism for understanding internally generated and externally influenced factors that might impact our business. Risks and opportunities are identified through several mechanisms, including risk profiling, stress testing, scenario analysis, stakeholder engagement and horizon scanning.

The AMP Risk Taxonomy articulates the material risk types and risk statements that have an impact, whether financial or non‑financial, on AMP. This allows for a consistent way for AMP entities and functions to identify, classify and report on risks across the business. The taxonomy is regularly reviewed and updated to ensure that it remains relevant. Climate‑related risk is defined as a material risk type in the AMP Risk Taxonomy to capture the potential impacts both physical and transition risks may have on our business.

AMP has identified a long list of climate‑related risks and opportunities, informed by a range of internal and external inputs including two climate scenario analyses conducted across three time horizons.

Internal inputs considered: Value chain modelling; Materiality framework; Scenario analyses; Risk Appetite Statement; Risk Management Strategy. External inputs considered: External climate scenarios; Peer reviews; TCFD defined examples of climate‑related risks and opportunities; ASIC RG280; Consultation with external expert.

Assessment

For each identified climate‑related risk and opportunity, AMP assesses its likelihood and impact using an internally developed framework to determine a qualitative risk rating and/or to inform any potential financial exposure. Each risk is evaluated on both an inherent basis (without consideration of mitigation treatments) and then a residual basis (after application of risk treatments or associated controls).

Prioritisation

Once a risk has been identified and assessed for materiality, it is prioritised based on its residual risk rating and risk appetite set annually by the Board. The risk appetite is formally documented in the Risk Appetite Statement and reflects the level of risk AMP is willing to accept in pursuit of our strategic objectives. It is designed to align risk‑taking with AMP's business strategy, capital planning, and broader business planning.

Climate‑related opportunities are prioritised based on their potential impact, feasibility and alignment with AMP's strategic objectives. Opportunities are evaluated based on their relevance to AMP's core business operations, stakeholder interest and potential to drive long‑term value creation.

Prioritisation outcomes are reviewed and approved by the Board, ensuring governance oversight and integration into AMP's broader risk management.

Monitoring

Risks are monitored on an ongoing basis to ensure that they are managed within appetite. This includes the consideration of any emerging risks, compliance with our legal and prudential obligations, the impact of any risk events or issues and the results of controls testing. As part of the ongoing monitoring process, risks are tested under stress scenarios to assess the ability of AMP to withstand plausible yet extreme conditions. Where a risk exceeds the defined appetite, a risk response plan is implemented to bring it within acceptable levels.

Opportunities are monitored through performance tracking of current investments and continuing assessment of market trends. This approach enables AMP to identify and harness opportunities that support the achievement of its climate objectives and contribute to long‑term organisational growth.

2.1 Risk management

Ampol's identification and management of risks is performed in accordance with the Ampol Risk Management Framework (ARMF), summarised in the Risk section of the OFR. The ARMF integrates enterprise, operational and critical risk management with governance, assurance and operational control systems. The ARMF is based on ISO 31000:2018 – Risk management – Guidelines and the ASX Corporate Governance Council's Corporate Governance Principles and Recommendations (4th Edition), reviewed by the Board at least annually. Climate-related risk governance is led by the Board and implemented through the Three Lines Model: line management manages day to day risks; specialist second line functions (Group Risk and Compliance, Group Sustainability) provide frameworks, oversight and challenge; Internal Audit provides third line independent assurance. Climate change is one of 16 key enterprise risks within the enterprise risk profile and register. The Board has no appetite for climate change inaction in strategic planning, or investment/divestment decisions, requiring management to actively model and plan for physical impacts, manage energy intensity to meet emissions reduction targets, and disclose to market/regulators routinely. Ampol treats climate-related risks as systemic, affecting strategy, capital allocation, operations, asset integrity, supply chain resilience, customer demand and reputation, and as drivers of other enterprise risks: organisational capability, regulatory compliance, strategy and transformation, capital management, business interruption and environment.

2.2.1 Climate-related risk and opportunity identification

Identification is performed across Ampol's operations and value chains, gathering and analysing: internal data (risks/uncertainties factored into business plans and corporate model, operational/asset integrity/incident data, insurance and financial information, emissions/energy data, asset-specific data e.g. site elevation and infrastructure measurements, and outputs from climate-related scenario analysis); and external evidence (government energy/climate policies, emissions trends, regulatory developments, technology/market changes e.g. EVs and lower carbon liquid fuels, customer demand forecasts, investor/stakeholder expectations, public/legal developments, industry peer disclosures). Opportunities are identified through monitoring climate-related trends and via the risk identification process. In 2025, Ampol used climate-related scenario analysis to identify risks and opportunities and test resilience of strategy and business model, considering different pathways for fuel demand, policy, technology and customer behaviour; outputs informed robustness of the business model/operations, appropriateness of strategy, and pace of investment, and assisted in identifying signposts for a timely strategic response.

2.2.2 Climate-related risk and opportunity assessment

Ampol assesses nature, likelihood and magnitude of impact using qualitative (stakeholder sentiment, regulatory response) and quantitative (financial impact, operational downtime) criteria; a scoring system assesses likelihood/magnitude for each risk. Risks are evaluated by combination of potential impact (financial, reputational, regulatory, business interruption, health/safety/wellbeing) and likelihood (industry/market trends plus Ampol's own estimates); this approach integrates climate risk into overall risk management. Climate-related opportunities are assessed through an annual strategy and business planning process across fuel supply, convenience growth, new mobility solutions and strategic enablers; key impacts/dependencies assessed using the ARMF to ensure transition, market, execution, regulatory and physical risks are considered against Board-approved risk appetite. Ampol applies an internal decision-making framework for material projects/investments presented to the Investment Committee, applying a weighted score against decision criteria including material risks, strategy alignment and decarbonisation approach alignment. Inputs quantify transition risk and chronic physical risk impacts, reflected in budgets, investment cases or business decisions; acute physical risk likelihood/magnitude assessed using quantitative (where available) and qualitative factors, with more detailed quantitative assessment performed when required (e.g. insure/self-insure decisions).

2.2.3 Climate-related risk and opportunity prioritisation

Climate-related risks are prioritised based on Board risk appetite; Key Risk Indicators (KRIs) set tolerance thresholds and monitor whether Ampol remains within appetite. Ampol prioritises risks potentially affecting performance/future cashflows over the next strategic planning cycle, based on potential impact on operations and financial performance; the ARMF incorporates probability and severity to support resource allocation across multiple time horizons. Climate-related opportunities are prioritised based on impact, feasibility and strategic alignment using the same Capital Allocation Framework and investment criteria as other initiatives; the Investment Committee assesses major investments against strategic fit, risk, financial hurdles and execution readiness, with post-investment reviews testing value delivery. Approved opportunities are embedded within the Group's strategy, with capital/operating expenditure reflected in the five-year business plan.

2.2.4 Climate-related risk and opportunity monitoring

Ongoing monitoring includes: annual deep dive review of climate-related risks on the material risk register, presented to the ALT and relevant Board committees; KRIs established for the climate change material risk with quarterly progress monitoring reported to the S≻ and KPIs tracking progress against specific mitigation activities (e.g. emissions reduction), with oversight from the Decarbonisation PRB. Material changes in climate risk profile, appetite breaches and assurance outcomes are reported to the ALT and Board committees; significant events are assessed under the continuous disclosure framework and disclosed under ASX Listing Rule 3.1 if market sensitive. Opportunities are monitored using KRIs measuring pace/quality of execution of energy transition strategy, capital deployment, decarbonisation milestones and targeted returns; variances trigger management review, escalation to the ALT and Board reporting under the Strategy and Transformation risk category.

2.2.5 Changes from the previous reporting period

In the current reporting period, there were no material changes to processes used to identify, assess, prioritise or monitor climate-related transition risks and opportunities, which continue to follow the ARMF. In 2025, improvements were made to physical climate risk modelling and assessment, aligning time horizons and scenarios with the business planning cycle and scenario analysis. An enhancement was also made to the climate KRI scorecard to move away from theoretical self-assessment against Climate Active 100+ assessment criteria; climate change KRIs were changed to quantitative thresholds for: emissions intensity at Lytton refinery and key terminals; Convenience Retail Scope 2 absolute emissions reductions; and rollout of public DC EV charging bays in Australia and New Zealand. These indicators are now embedded in Ampol's regular risk monitoring cycle.

2.2.6 Risk review process

Climate-related risks and opportunities feed into an annual risk review and rolling risk monitoring cycle including: annual review of the enterprise material risk profile/register under the ERM standard, incorporating climate-related transition and physical risks; annual deep dives to the S&SC on climate change, business interruption and strategy/transformation enterprise material risks; annual review of climate-related KRIs and risk appetite settings, including physical risk appetite and vulnerability metrics; regular monitoring/review through the Decarbonisation PRB; and integration of climate-related risks/opportunities into strategic planning, business planning, capital allocation and major project approvals.

Framework (page 40). Climate-related risks and opportunities are integrated into Beach's Risk Management Framework, which is aligned with the principles of ISO 31000 and uses a single risk matrix and a centralized digital risk management platform. Climate-related risks are assessed with the risk matrix, which considers likelihood and consequence, including impacts on financial performance, people, environment, reputation and legal or regulatory compliance.

Risks (pages 37, 40). Risks are identified through internal stakeholder engagement (at least annually, across the value chain and time horizons), asset and functional risk assessments, and climate-related scenario analysis. They are reported to the Executive team, the Audit and Risk Committee and the Board, escalated outside the regular cycle where required, reviewed at least annually and reassessed after a significant risk event, regulatory change or material change in operating context.

Opportunities (page 52). Identified through internal stakeholder engagement and scenario analysis and reviewed at least annually. Opportunities requiring capital investment are assessed through the Capital Assurance Framework, with carbon price sensitivities where relevant. High-graded opportunities are reported in the monthly Capital Project Update, and the opportunity register is a standing agenda item for the Technical Committee of the Board.

Approach (p. 76). One enterprise Risk Framework covers all risks and opportunities, including climate-related risks and opportunities (OFR 6, pp. 21–22), with mandatory minimum performance requirements and a Climate Change Global Standard across operated assets and functions. BHP does not manage non-operated joint ventures or third parties but seeks to oversee and manage the related financial, legal and reputational risks and opportunities.

Assessment and prioritization. Risks and opportunities are assessed by likelihood (probability and timeframes) and potential quantitative and qualitative impacts (health and safety, legal, sustainability, reputation, financial) in the context of BHP's overall material risk profile, which is used to prioritize controls and investment in risk treatment. Climate-related risks are required to be integrated into that profile where applicable.

Monitoring. The climate-related risk profile is reviewed annually; individual risks and opportunities, and critical controls, at least annually.

Scenario analysis (p. 76). The lower-warming scenario was used to review identification and assessment of transition risks and opportunities, and the higher-warming scenario to review physical risk profiles. No new or changed areas were identified.

Identification inputs (pp. 64–65). Risk Framework and material risk profile, strategic planning, external benchmarking, historical reporting, Investor Relations and subject-matter experts.

Integration (p. 179). Climate change is recognized as a material risk within BlueScope's Risk Management Framework, which provides an integrated approach to risk identification, assessment, evaluation and treatment in accordance with ISO 31000 and guided the assessment and management of climate-related risks and opportunities (CRROs). The assessment extended to controlled businesses, sites and services, including business units and joint ventures.

Process (Figure 1, p. 179). Scope and criteria; identification; analysis and evaluation; treatment; reporting; monitoring and review. Identification drew on the climate physical risk assessment, Quarterly Business Reviews, capital allocation decisions, business unit risk registers, the Climate Change Council, industry and supply chain peer reporting, sustainability disclosure standards and the outcomes of climate scenario analysis. Each CRRO was rated 1–5 for likelihood and consequence across short, medium and long-term horizons through workshops and placed on a risk rating matrix; quantitative materiality thresholds guided prioritization for reporting. Opportunities were assigned a treatment option (for example pursue, accelerate, monitor). Half-yearly CRRO updates were provided to the SSC in FY2026. The process was initially aligned to the (now superseded) Task Force on Climate-related Financial Disclosures (TCFD) framework.

The Group conducts an annual CRRO assessment as part of its broader risk management process (pp. 42, 57). The process is iterative: (1) an initial list of CRROs compiled from external research, industry reports and prior year assessments; (2) validation through workshops with internal subject matter experts and senior leaders, with likelihood and consequence assessed qualitatively over the short, medium and long term using the Coles Risk Standard criteria; (3) identification of existing and potential mitigations; and (4) prioritization of risks by risk rating and time horizon, and of opportunities by qualitative factors (p. 42). Scenario analysis is then applied to prioritized CRROs and, where possible, effects are quantified. Risks were assessed on a gross basis, before mitigation, to select those for disclosure, and assessed for quantitative materiality consistent with the financial statements (p. 42).

Physical and transition risks are assessed using the same Risk Standard process and criteria as other risks, with executive ownership assigned to each. Climate change is identified as a material risk; the risk and its key risk indicators are reviewed annually, monitored against risk appetite and reported to the Audit and Risk Committee, and Internal Audit periodically reviews climate risk and controls (p. 57). The report refers to its Risk management section (pp. 30 to 37) for further detail (p. 57).

Framework (p.118). Climate risk is managed under the Board-approved Risk Management Framework (RMF; Note 9, pp.268–276), reviewed annually by the Executive Leadership Team (ELT), the Board Risk & Compliance Committee and the Board. Climate risk sits within the E&S material risk type and can amplify strategic, financial, compliance and operational risks. The Risk Appetite Statement (RAS) sets thresholds for physical and transition risk exposures, with regular monitoring and escalation to the ELT and the Committee, including when thresholds are exceeded.

Identifying and assessing (pp.118, 122). Risks and opportunities go through a climate materiality assessment using externally informed and internally determined scenarios and data. Risks are tested by quantitative financial stress testing (long-term scenarios, acute event scenarios, climate-related expenses and provisions) and qualitative workshops with subject matter experts. Results are mapped to material risk types and rated against the RAS (financial) or a 5x5 risk rating matrix (non-financial and strategic). Opportunities are assessed in workshops and considered separately against the environmental strategy.

Monitoring and integration (pp.119–121, 133). A table of policies, processes and tools spans retail and non-retail financing and own operations. Climate-related vulnerability is measured using total committed exposures (TCE), and lending decisions use ESG risk assessments with escalation pathways.

The process to identify, assess, prioritize and monitor climate-related risks and opportunities is built on, and informed by, enterprise risk management processes (p. 145).

• Identification: an initial list came from internal data sources, the corporate risk register and prior climate risk and opportunity assessments. The 2022 assessment was the baseline, updated through targeted stakeholder engagement and further analysis of physical risk exposure. The latest assessment covered the value chain, including manufacturing facilities, laboratories, warehouses and logistics.
• Prioritization: enterprise risk management matrix criteria, in line with other business risks: qualitative (reputation impact, regulatory exposure, environmental and people harm) and, where possible, quantitative (financial thresholds), considering likelihood and impact to give a risk rating. The same approach was applied to opportunities. Scenario analysis was used to understand likelihood and impact and to validate the risks and opportunities identified.
• Monitoring: under the Enterprise Risk Management Framework alongside other operational risks; site physical risks in site-level risk registers; functional departments manage enterprise risks and opportunities, with GLT members accountable.

Company index: 25(a)–(c), p. 145.

Process (pp. 79–80). Climate-related risks and opportunities were screened from a large panel based on peer review and risk modeling, narrowed down after internal evaluation, and prioritized by risk and opportunity management ratings (likelihood of occurring and consequences) and the timeframe in which they would likely materialize (p. 80). A risk register database is maintained, and risks including climate-related risks are prioritized in a consistent manner using an internally developed risk management system (p. 79).

Approach (p. 87). A structured approach uses inputs and parameters such as historical climate data, predictive models and market research analytics, and management uses climate-related scenario analysis. Opportunities are identified and assessed using similar processes.

Integration and review (p. 87). The processes are integrated into the overall risk management framework and reviewed regularly in line with other items in that framework. Additional reviews would be triggered by a material change to business function, acquisitions or divestments, strategic and long-term planning, or significant related regulatory changes.

Downer identifies, assesses, prioritizes, monitors and manages climate-related risks and opportunities through a Climate-related Risks and Opportunities Procedure developed in FY26, aligned with its Group Risk Management Framework and ultimately governed by the Zero Harm Committee (p. 72).

Identification, assessment and prioritization (pp. 59, 72). Climate change is incorporated in the Group Strategic Risk Register, and consolidated Group and Business Unit registers go to the Audit and Risk Committee at least bi-annually. Business Unit strategic risk reviews apply the Risk and Opportunities Framework, with defined thresholds and classification matrices, and consider nature, timing and likelihood as well as Downer's vulnerability and capability to respond. Business Units reprioritize risks at least every six months. Climate-related risks and opportunities were assessed and ranked alongside other strategic risks in FY25 through the three-phase process on p. 59.

Monitoring (p. 72). Management monitors climate-related risks, opportunities and metrics at least annually, reporting to the Zero Harm Committee and Board.

Integration (p. 72). Climate is integrated into the strategic enterprise risk process (assessed bi-annually), the budget review process for investment initiatives, the Financial and Corporate Governance Self-Assessment questionnaire, and consideration of insurance coverage for weather-related losses and business disruption.

Identification (p. 44). Identified through internal and external inputs: prior climate risk and materiality assessment work, risk workshops, specialists' review, regulatory developments and market trends. A Group-wide climate risk assessment from the F23 year continues to inform identification; an F26 review reassessed risks and opportunities using the selected time horizons. Scenario analysis is not currently a direct input into identifying risks but informs understanding of the climate risk profile.

Assessment (p. 44). Under the RCMF, with climate risks in the Sustainability and ESG Risk Category. The methodology considers likelihood and consequence, with quantitative thresholds (e.g. impact to profitability) and qualitative ones (reputational, customer, team and safety impacts). Risks were evaluated under AASB S2 using the Group's materiality judgment criteria.

Monitoring and prioritization (p. 45). Business unit risk registers are reviewed with the Risk function at least twice per year. Ratings are assessed against risk appetite to prioritize and escalate risks; the enterprise-level risk register is reviewed by the ELT and ARC biannually, with climate risks incorporated alongside other risks.

Opportunities and changes (p. 45). Opportunities are considered through broader strategic planning and governance processes; none were identified as material for disclosure. No material changes were made to the methods used.

Framework (p. 90). Climate risks are managed under the Fortescue Risk Management Framework (FRMF), whose Risk Management Standard sets criteria and thresholds to assess, prioritize, escalate and manage them. Risk owners identify, assess and monitor exposures through business and operational risk registers; material and cross-cutting exposures are aggregated through the Group Risk Profile, and climate-related risks and opportunities are also consolidated in the Group climate and sustainability risk category.

Identification and assessment (pp. 90 to 91). Internal factors (assets, operational processes, strategic priorities, decarbonization) and external factors (economic and geopolitical developments, climate science, scenario analysis, investor and community expectations, peer benchmarking, regulatory change) are considered; scenario analysis informs identification and assessment of transition and physical risks. Nature, likelihood and magnitude are assessed under the FRMF, including the enterprise risk matrix; climate risks are prioritized alongside other enterprise risks.

Monitoring and opportunities (p. 91). The Audit, Finance and Risk Management Committee supports Board oversight through regular reporting; the Safety and Sustainability Committee also has oversight. Risks are reviewed at least annually. Opportunities are identified, assessed and progressed through business planning and investment evaluation, with Board endorsement where required.

GPT's climate and nature-related risks and opportunities are identified and managed in accordance with our enterprise-wide Risk Management Framework (RMF), which is consistent with ISO 31000:2018. The Risk Team, led by the General Counsel, oversees implementation and reports regularly to the Audit and Risk Committee on matters relating to the RMF, including key risks, emerging risks, risk appetite and risk culture.

Integration into Risk Management

Climate and nature-related considerations are integrated across the business through GPT's Risk Appetite Statement and key policies, linking sustainability factors to operational and strategic risk processes. Cross-functional governance committees (including representatives from finance, sustainability, risk, compliance and legal) review performance, emerging issues and control efficiencies.

In practice, this covers:

• Acquisitions and divestments: Due diligence screens (e.g., flood, heat, bushfire) can inform asset consideration or alter price/terms/investment considerations.
• Development and existing asset lifecycle upgrades: Long-term climate modelling is considered in design standards and upgrade timing to avoid stranded spend.
• Portfolio management: Risk appetite metrics flag assets with elevated long-term exposure, informing budgets and asset plans.

Risk assessments, thresholds, and management plans are updated as data, hazards, and regulations evolve.

Climate and nature-related risks and opportunities assessment

Direct asset risks and opportunities are assessed based on strategic, financial, and reputational impacts, using thresholds such as net operating income, capital expenditure and asset fair value to determine the magnitude of effects. In our assessment, we also consider qualitative indirect implications, including effects on surrounding properties, communities and infrastructure.

Asset level climate and nature risk and opportunity reviews and climate adaptation plans are undertaken referencing climate scenario modelling, on-the-ground surveys, expert studies (such as stormwater, ecology, heritage) and internal operational data.

Adaptation planning processes are aligned with ISO 14090:2019, ISO 14091:2021 and AS 5334-2013, and workshops involve cross-functional teams and stakeholders.

Scenario analysis

GPT uses scenario analysis to inform and test the resilience of risk and opportunity assessments. The inputs, time horizons and parameters applied are outlined in the Climate section of this statement, and are regularly reviewed through the Sustainability Steering Committee, including discussions of value chain boundaries relevant to the climate risk assessment.

Scenario analysis is applied across transition and physical (acute and chronic) risks, using asset-level modelling to evaluate both exposure and resilience. It helps to identify any potential impacts under low and high-emissions pathways (e.g., renewable energy integration, electrification) and potential strategic or reputational benefits.

Climate and nature-related risks and opportunities identified are evaluated alongside other enterprise risks in accordance with GPT's Risk Management Framework to maintain consistency and integration into business processes.

Prioritisation and management

GPT prioritises climate and nature-related risks based on their residual risk ratings, integrating them into risk registers, with corresponding mitigation actions where required.

For climate, we use a Climate Hazards and Consequences Matrix to evaluate operational and capital expenditure impacts to guide mitigation priorities. Transition risks are generally prioritised at the portfolio and regional levels, while physical risks are evaluated at the asset level. However, if transition risks pose a risk or opportunity at an asset level, they will be assessed and treated, where appropriate, alongside physical risks in climate adaptation workshops.

For nature, GPT considers the environmental resources and conditions that sustain our operations: land, water, biodiversity, and cultural heritage (also known as natural capital assets). We review ecological and heritage assessments and modelling tools, and monitor performance over time, including through water quality, biodiversity, and stakeholder feedback. Actions are incorporated into management practices, both through development delivery as well as operations where required.

Monitoring

Asset-specific climate and nature risks and opportunities are reviewed and inform aggregated and entity level risk and opportunity reporting to the Sustainability Steering Committee. Risks and opportunities are escalated to the Executive Team and Board, where appropriate, in accordance with the RMF.

Framework (p. 71). The Board has overall responsibility for oversight of the risk management framework. Management of each controlled entity implements it, supported by the chief risk officer. The framework applies to all material risks, including climate-related physical and transition risks, is "aligned with ISO 31000:2018" and is integrated into strategic planning, operational activities and decision-making. Climate-related risks and opportunities were assessed using methodologies consistent with ISO 14091.

Process (pp. 71–72, Figure 1). Four steps: identification, assessment, financial impact modeling and monitoring. Identification used desktop research, industry analysis and operating context, in alignment with guidance issued by the IFRS Foundation and ISSB. Assessment uses defined likelihood and consequence criteria to give inherent and residual ratings (for opportunities, size and ability to execute), drawing on internal data, external scenarios and data (including NGFS, IEA and IPCC) and regional validation workshops. Risks are prioritized on residual ratings against the Board's risk appetite, "consistent with the method of prioritising other risks"; "Further action would be taken to prioritise climate-related risks against other enterprise risks".

Monitoring (p. 72). All risks are reviewed annually by the risk owner and the Risk Management Team; climate-related risks each have an owner.

Iluka manages its climate-related risks pursuant to its Risk Policy and Management Framework, which aligns with the principles of ISO 31000: 2018 risk management – Guidelines.

In 2025, Iluka included the material climate-related risks identified in its Key Risk Register. The CEO is accountable for the key risks captured in this register and associated outcomes for risk management actions assigned to members of the Executive team, with progress and outlook considered every six months and monitored through Iluka's Key Risk Indicator Reporting framework.

The approach to identifying, assessing, prioritising, managing, monitoring and communicating climate-related risks and opportunities is consistent with the enterprise risk process. The process for identification of risks and opportunities changed compared to prior periods to more explicitly consider climate-related risks and opportunities, and to incorporate formal SusCo review over climate-related risks and opportunities. This process is managed with oversight by the ARC and SusCo respectively.

Relevant risks and opportunities are considered as part of Iluka's corporate planning process to inform its business plan and budget allocations. Iluka considered the potential impact of climate-related risks and opportunities across its value chain, including in relation to existing customer markets, operations at its current mining and processing locations (including suppliers of critical infrastructure such as roads, port facilities and transport logistics between its operating and mining sites), and on projects that are currently in execution (i.e. the Eneabba refinery).

Identify: Determining time horizons for purposes of assessing risks and opportunities; reviewing risks previously considered for TCFD reporting; scenario analysis to identify climate-related risks and opportunities against defined scenarios; engagement with internal and external subject matter experts to prioritise risks for assessment.

Assess: Determine assessment approach (quantitative or qualitative) based on data, inputs and sources available including clarity on legislative context; evaluate risks, applying Iluka's criteria over each timeframe, taking into account existing state of controls; assess impact (consequence and magnitude) and likelihood of each risk along each time scale under each scenario considered; physical risks assessed by considering against asset level downscaled data for each scenario; consider risk drivers (causes) and risk indicators; consider business impact category (e.g. impact to cost/margins, disruption to operations, asset damage, health and safety).

Prioritise: Prioritise risks considering whether it could reasonably impact Iluka's business against each time horizon and consider sufficiency of data/information to support the prioritisation; consider risks against backdrop of Iluka's overall business priorities and value drivers; prioritised risks to include in Key Risk Register to inform corporate plan review.

Manage: Consider adequacy of existing controls; management review and agree additional risk mitigations necessary in the context of business priorities and determine capital allocations; assign roles and responsibilities and agreed risk mitigations, and implement mitigations.

Monitor: Risks reviewed and outlook assessed by Executive on bi-annual basis; climate-related key risk indicators reviewed on a bi-annual basis and reported to ARC and SusCo; key risks and status of risk management actions reviewed and reported to ARC annually, with climate-related risks updated and reported to SusCo on an annual basis; progress against defined priorities updated to SusCo (including progress update on the Climate Change Work Program); process controls considered in internal audit planning; review and revisit assessment for material change in internal/external environments – including annual review of Iluka's shadow carbon price assumptions and its impact on the Group's safeguard compliance costs and ACCU purchase settings.

Communicate: Risks reviewed and signed off by Board.

Approach (p. 51). Processes within the Risk Management Framework and Strategy (RMFS) cover all risks including climate-related risks; a complementary climate-related risks and opportunities process (CRR&O Process) prioritizes those material over short, medium and longer-term horizons.

Risks (p. 51). Identify: Risk Event Management, the Strategic Opportunities and Risk Profile (SORP) and the CRR&O Process, informed by subject matter expertise and climate scenarios. Assess: the Risk Impact Matrix, the Group Risk Appetite Statement, and a quantitative-first CRR&O assessment on an inherent basis, with a qualitative view where quantitative assessment is uncertain. Prioritize: via the SORP and at divisional level, with responses in Divisional Business Plans. Monitor: annual SORP reviews, concentration monitoring and an enterprise risk dashboard.

Opportunities (p. 51). Identified through the SORP; prioritized through the Corporate Plan and Divisional Business Plans; monitored through business planning and Quarterly Business Reviews.

Integration and changes (p. 52). Climate-related risks sit within the existing risk class architecture. The RMFS applies to all consolidated entities except Insurance Manufacturers of Australia Pty Limited, IAG New Zealand Limited and RACQ Insurance (RACQI), which keep their own frameworks. In FY26 climate metrics were added to monitoring, the Group Social and Environmental Policy was updated, and the CRR&O Process now includes RACQI.

Framework (p. 57). The Risk Management Policy and Risk Management Framework, consistent with AS ISO 31000:2018 and regulatory guidance issued by the Australian Securities and Investments Commission (ASIC) and the ASX, set the methodologies for identifying, monitoring, assessing, managing and reporting risks. The Group applies the Framework when identifying and managing CRROs.

Identification (p. 57). A third-party independent environmental and sustainability advisor facilitated an inaugural CRRO assessment workshop with all members of the Group and brand executive teams to develop an initial list of the most significant CRROs and apply climate scenario analysis to each across operations and value chain. CRROs are identified by considering (1) physical climate hazards and their impact on operations and supply chain, (2) current and emerging climate regulations, (3) stakeholder feedback from suppliers, investors and industry experts, (4) latest industry trends and developments and (5) competitor and retail peer analysis.

Assessment and monitoring (p. 57). A CRRO register assigns each risk and opportunity to a Group or brand executive; likelihood of occurrence and potential impact are considered within the Framework's parameters. The Group sustainability team assists executives to formally review the register every 6 months, and the review is integrated into the Group's comprehensive review of its overall business risks.

Process (p. 74). The Group uses scenario analysis and a simplified version of its Enterprise Risk Management Framework to identify, assess, prioritize and test the resilience of its climate-related risk and opportunity assessments. The Climate-related Financial Disclosure Steering Committee (CRFD SteerCo) Charter sets a time frame for revisiting scenario planning in line with the strategic planning cycle, and the CRFD SteerCo oversees the key inputs, time horizons and assumptions. Capital allocation decisions and trade-offs are considered throughout.

Monitoring and integration (p. 74). Key metrics are in place to monitor potentially significant CRROs. The Group has plans to further integrate these risks and opportunities into the existing enterprise risk register.

Physical risk process (pp. 77, 79). A Climate Related Risk Assessment (CRRA) process, which sits outside the scenario analysis, applies to all new project opportunities and existing assets under management. The Swiss Re Risk Data & Services (RDS) platform estimates probability-weighted financial losses, and outputs are translated into red, amber or green levels of physical climate risk, which are included in reviews of potential investments. Assets and projects assessed at the red level must develop a mitigation plan, reported to the Risk and Sustainability Committee and tabled at Quarterly Business Reviews. Construction delays are tracked in the Lendlease Schedule Delay Register application.

Identification and assessment (p. 61). Metcash (1) considers its operations, resources and relationships; (2) draws on existing risk and opportunity assessments at Corporate, Pillar (Food, Liquor and Hardware) and site level, risks identified by selected market peer organisations and internal stakeholders; and (3) applies its Business Resilience Framework (BRF), weighing the likelihood of the event and the magnitude of the impact on strategy and business model, against qualitative or quantitative materiality thresholds. Scenario analysis is a key input. Risks and opportunities are identified and assessed before prevention and mitigation actions, while the financial effects assessment and scenario analysis consider mitigation actions. The same process is used for risks and opportunities and was further formalized during the reporting period.

Prioritization and integration (p. 61). Risks and opportunities are prioritized using the BRF, consistent with other business risks, and incorporated into the Group Risk Profile where appropriate.

Monitoring (p. 61). Monitoring is integrated within the BRF; climate-related risks and opportunities are monitored periodically and managed in the same way as other business risks, with scenarios reviewed within the strategic planning process.

Framework (p. 89). Climate change and sustainability risk is a principal enterprise risk under the Risk Management Framework (RMF), reported quarterly to the ELT and the ARCC. Principal risks are prioritized on residual risk rating.

Identification. Processes build on long-standing alignment with the TCFD. In FY26 Mirvac reassessed its CRROs to support alignment with AASB S2, using a working group of subject matter experts and external advisors, and used its three climate scenarios to assess impacts over short-, medium- and long-term horizons.

Assessment. CRROs are rated for likelihood and consequence using the RMF, across scenarios and horizons, giving a qualitative risk rating. Materiality combines financial materiality thresholds with relevance to primary users. Opportunities are assessed on alignment with strategy, achievability within the business model and potential material financial benefit. The Climate Disclosures Steering Committee endorses the assessment and the ARCC considers the outcomes.

Management and monitoring. Responses are embedded in investment decisions, design risk management, minimum sustainability standards, strategic asset planning and Climate Adaptation Plans. Material CRROs escalate to the Board where they may affect strategy or financial performance. If climate risk exceeds risk appetite, defined actions return it to appetite. Apart from the identification enhancements, no material process changes occurred in the period.

Climate-related risks and opportunities are identified, assessed, managed and reported through the Enterprise Risk Management Framework (ERMF), under the same criteria as all other enterprise risks (page 104).

Inputs (page 104). Risk registers and assessments are reviewed at least annually with input from key personnel. Inputs include CSIRO and Bureau of Meteorology climate projections, combined IPCC AR6 scenarios supplemented by transition scenarios from Commodity Insights and Wood Mackenzie, third-party coal and carbon price forecasts, and internal production, cost, emissions and incident data.

Assessment (page 104). The Group Risk Assessment Criteria combine a consequence rating (quantitative financial ranges plus selected qualitative categories), a five-point likelihood scale (Rare to Almost Certain) and control effectiveness, producing a residual rating of Low, Medium, High or Extreme.

Prioritization, monitoring, integration (page 105). Climate-related risks are not prioritized separately from other enterprise risks; those rated High or Extreme are tracked through governance processes. The Audit and Risk Committee reviews the register at least annually and the Board receives monthly risk reporting. Scenario analysis informs identification, assessment and management of risks. This period the Group developed an internal "base case" climate scenario as an input to the climate risk review.

Process (pp. 71–72). CRROs are identified and assessed through a structured process aligned with the Risk Management Framework (RMF), which provides a consistent basis for assessing consequence, likelihood, risk appetite and control effectiveness; the lifecycle is adapted from ISO 31000:2018 (p. 71). Inputs include physical climate hazard and transition pathway data, asset-level operational information, industry and peer benchmarking, investor and lender information needs, external climate expertise, the 2025 Double Materiality Assessment, prior TCFD-aligned disclosures and management input. An initial long list was assessed across the value chain, then consolidated or removed (p. 72).

Assessment and prioritization (p. 72). Each CRRO was assessed and prioritized across defined time horizons and climate scenarios using NEXTDC's ERM criteria, covering the nature of potential effects, their likelihood and magnitude, quantitative indicators and whether the matter could reasonably be expected to affect prospects, resilience or enterprise value. Inherent and residual ratings were considered.

Monitoring and integration (p. 72). The Climate Reporting Working Group and ESG Council review outputs and monitor CRROs. The assessment is reviewed at least annually and on material changes. NEXTDC is progressively embedding CRROs into enterprise, environmental, functional and facility-level risk management, including risk ownership, controls and monitoring.

Risk processes The Group identifies, assesses, prioritises and monitors climate-related risks through management oversight, site-level assessments and strategic planning activities. Climate-related risks are considered alongside other operational and market risks relevant to the Group's mining and processing activities, rather than through a standalone climate risk framework.

The Group uses climate scenarios associated with different global temperature outcomes, as set out in its physical climate risk assessment, to identify potential physical climate risks, understanding possible short-, medium- and long-term impacts on operations, assets and business continuity, including risks from extreme rainfall, flooding, heat stress and disruption to infrastructure and logistics. The Group considers scenario analysis and physical risk assessment findings when assessing the relative significance of climate-related risks. Transition-related factors (energy supply, emissions intensity, evolving market expectations) are considered in management and strategic discussions.

Climate-related risks are monitored through ongoing operational oversight and periodic review as part of broader business planning and in response to material changes in circumstances, including significant weather events or changes in the external operating environment. Scenario analysis also informs the identification of opportunities, including improvements in asset efficiency, renewable energy integration and alignment with demand for lower-emission nickel products.

Inputs and parameters Climate-related risks are identified using a combination of internal and external inputs. Internal considerations include operational exposure to weather-related disruption, energy consumption, emissions intensity, and site-specific physical risks identified through the Group's physical climate risk assessment. External considerations include regulatory developments, market expectations for lower-emission nickel products, and broader industry trends relevant to the energy transition.

Scenario analysis (for risk identification) Climate-related scenario analysis is used to support the identification of both risks and opportunities and to assess the resilience of the Group's strategy and business model. The physical climate risk assessment examines potential outcomes under different warming pathways to evaluate the nature and severity of physical climate risks. The assessment focuses primarily on chronic physical risks (temperature and rainfall pattern changes) and acute physical risks (extreme weather events). Outcomes are used to inform management's understanding of climate-related risks and support strategic and operational considerations, rather than to produce detailed quantitative financial modelling.

Nature, likelihood and magnitude of risk The Group assesses physical climate risks by considering the severity and frequency of climate hazards (extreme rainfall, flooding, heat stress), evaluated in the context of site-specific exposure and operating conditions. Transition-related risks and opportunities are considered in the context of energy use, emissions intensity, regulatory developments and market demand for nickel products used in energy transition applications.

Prioritisation of climate risk The Group uses publicly available climate data and scenario information referenced in its physical climate risk assessment to assess potential physical climate impacts across operating locations and assets. The prioritisation of climate-related risks is informed by the outcomes of scenario analysis and physical climate risk assessments, helping identify assets and regions more exposed to climate-related physical or transition risks over the short, medium and long term. Risks considered more likely to affect operations or strategic outcomes receive greater management attention. Climate-related risks and opportunities are not prioritised in isolation but are considered alongside other operational and strategic considerations.

Opportunities are evaluated with reference to how they support operational resilience, emissions reduction efforts and alignment with market demand for nickel products associated with the energy transition, viewed across short-, medium- and long-term horizons.

Monitoring Nickel Industries monitors climate-related risks and opportunities through ongoing management oversight and periodic reassessment as part of its broader operational and strategic processes. Climate-related considerations are reviewed over time to reflect changes in operating conditions, climate science, regulatory developments and market dynamics. Monitoring focuses on changes in exposure to physical climate hazards and transition-related developments.

Change in risk processes The Group continues to refine its understanding of climate-related risks through improved data, site-level assessments and scenario analysis, including outcomes of its physical climate risk assessment. Nickel Industries has continued to develop its understanding of climate-related risks and opportunities through climate risk assessments and climate-related scenario analysis, building on prior work by expanding consideration of climate-related impacts across the Group's operations and geographic locations.

Risk and opportunity identification process Potential climate-related risks are identified through consideration of entity-specific information and external sources relevant to the Group's operations. Internal considerations include exposure of mining and processing operations to weather-related disruption, energy use, emissions intensity and site-specific physical risks identified through the physical climate risk assessment. External considerations include regulatory developments, market expectations for lower-emission nickel products, industry trends and publicly available climate-related information. Opportunities are identified as part of the same process, including improvements in operational efficiency, renewable energy integration and alignment with demand for nickel products supporting the energy transition.

Integration with overall risk management Identified climate-related risks are assessed qualitatively based on their potential impact on the Group's operations and business performance. Physical climate risks are evaluated using the findings of the Group's physical climate risk assessment and scenario analysis. Transition-related risks are considered in strategic and investment discussions. The Group acknowledges that climate-related risks can act as drivers or amplifiers of other business risks, including operational, regulatory and market risks. Accordingly, climate considerations are integrated into broader business decision-making rather than treated as a separate risk category, and are not assessed in isolation but considered within the context of the Group's overall business and risk profile.

Process (p.159). The enterprise risk management framework embeds risk management in ongoing activities. Risks are categorized by area impacted and assessed on likelihood and magnitude of consequences, financial and non-financial, so climate-related risks are prioritized alongside other risks on a consistent basis, then escalated and monitored according to assessed materiality.

Scenario analysis (p.159). Climate-specific scenario analysis supports identification of CRROs through long term financial planning, major transaction and capital investment decisions, transition action planning and resilience testing, and is used where appropriate to assess likelihood, nature and potential impact of transition and physical risks.

Investment decisions (p.159). Major transactions and capital investments consider CRROs, the emissions profile of investments and links to targets. For some projects a sensitivity analysis applies Australian Carbon Credit Units (ACCU) pricing; in FY26 a real price range of $36 to $89 per tonne was applied.

FY26 assessment (p.159). Subject matter experts across the business assessed CRROs, mapped them across the value chain in line with AASB S2 and used the resilience testing scenarios.

Integration (p.159). Management applies processes integrated with existing risk management, strategy, capital allocation, assurance and reporting frameworks; controls over climate data and disclosures align with broader internal processes.

Integration into the Group's Risk Management Framework

Climate-related factors are integrated into Pepper Money's enterprise RMF and reflected in the Group's Risk Appetite Statement ("RAS"). A process was undertaken to identify, assess and prioritise climate-related risks and opportunities across the Group's operations during the reporting period. This process was embedded into the Group's enterprise risk management approach and supported by governance oversight through the Board and relevant Committees.

Prioritisation of climate-related risks was undertaken using the Group's risk matrix evaluation framework, applying criteria such as likelihood, magnitude of impact, and alignment with strategic objectives. Risks identified through the materiality assessment and scenario analysis were incorporated into existing risk categories, including credit, regulatory, operational, strategic, and reputational, and documented for ongoing governance oversight.

Monitoring of climate-related risks occurs through Pepper Money's established RMF processes and governance structures, which include ongoing risk reviews, escalation protocols, and reporting to the Board and Board Committees. These processes ensure that climate-related risks are tracked, assessed for changes in exposure, and escalated in line with the Group's risk appetite and governance requirements.

Operational accountability continues to follow the Three Lines of Accountability model:

• The First Line, comprising business units and operational teams, accountable for ownership and management of climate-related risks and opportunities within their day-to-day activities.
• The Second Line, Risk and Compliance, accountable for the RMF, providing tools and guidance for climate risk assessment, and independently monitoring the effectiveness of controls.
• The Third Line, Internal Audit, provides independent assurance to the Board and its committees on the adequacy of climate risk governance and control effectiveness. External auditors also contribute to the Third Line by providing assurance on financial statements and selected regulatory requirements.

Processes for identifying and assessing climate-related risks and opportunities

Pepper Money's approach to climate-related risk management commenced with an assessment of its consolidated operations and Value Chain activities, including mortgage lending, asset finance, loan servicing, funding arrangements, and corporate functions. The Group used a combination of internal portfolio data, external climate datasets, and scenario frameworks to inform its analysis.

Climate-related risks were recognised as drivers of existing risk categories, including credit, regulatory, operational, strategic, and reputational, and were identified through a Climate Risk Materiality Assessment. This assessment evaluated both physical risks, such as bushfire, flood, and cyclone, and transition risks, such as regulatory changes, carbon pricing, and shifts in consumer preferences.

The process applied both qualitative and quantitative techniques, using the Group's risk matrix to assess likelihood and impact across financial, regulatory, operational, customer, employee and reputational dimensions. Physical risk exposure was modelled at property level using geospatial data and RCP scenarios, while transition risk impacts were assessed through macro-economic modelling using NiGEM scenarios. Pepper Money applied three scenarios from the NGFS Phase V framework to assess potential climate-related risks and opportunities across short term (1 year), medium term (5 years), and long term (25 years) horizons.

Pepper Money has established processes to identify climate-related opportunities using the same approach applied for risk identification, namely, the Climate Risk Materiality Assessment and scenario analysis. These processes are designed to consider how shifts in policy, technology, and market preferences under different climate pathways could create opportunities for Pepper Money to support customers and enhance long-term resilience.

Governance of climate-related opportunities is embedded within Pepper Money's existing oversight structure. The BESG Co has reviewed and endorsed the approach to identifying and prioritising opportunities, ensuring that these considerations are integrated into strategic planning and risk management processes. While no material climate-related opportunities were identified during the reporting period, the framework remains in place to capture and assess potential opportunities in future periods.

As this is Pepper Money's first reporting period aligned to AASB S2, there have been no prior period processes for comparison.

Framework (p. 23). Climate-related risks are identified, assessed, monitored and managed through existing enterprise risk management processes under the Board-approved Qantas Group Risk Management Framework, and the Board's Risk Appetite Settings and Framework incorporate emissions considerations. Climate risks use the same Qantas Group Risk Assessment Guide methodology as other risks, so are comparable with the Group's other principal risks. There have been no significant changes to the process from 2024/25.

Assessment (p. 23). Management rates consequence on a six-level scale across categories including safety, regulatory compliance, brand, financial and environmental impact, and likelihood on a six-point scale from A (Almost Certain) to F (Very Rare). A matrix gives a residual rating of Very Low, Low, Medium, High or Extreme; Medium, High and Extreme risks face escalating governance approval and ongoing monitoring. Business Units report to the Group Leadership Team, Audit Committee and Board six-monthly. Scenario analysis informs scoring (pp. 38–39).

Identification and the opportunity (pp. 11, 23). Identification draws on external data, stakeholder feedback, industry benchmarks, internal workshops and third-party scenario analysis tools (p. 11). The Group Fleet Reference Plan governs the fleet renewal opportunity, reported monthly to a subset of the Group Leadership Team and six-monthly to the Board, with no change since the prior period.

Identifying and assessing climate-related risks

Climate change continues to be identified as one of the top risks for QBE and is managed as a sub-class of strategic risk within QBE's Risk Management Strategy. Climate-related risks are identified and assessed through the following processes:

Scenario analysis: Climate scenario analysis is used to assess the potential impacts of identified climate-related risks on QBE's underwriting and investment portfolios under a range of future climate pathways. The scope of scenario analysis is informed by QBE's assessment of risk exposures and concentrations. The outcomes of scenario analysis provide insights into the magnitude of potential impacts, which are then incorporated into QBE's risk assessment processes. This inputs into the top risk process.

Top risk process: QBE conducts a regular review of top risks, incorporating top-down horizon scanning, review of regulatory developments and bottom-up business input to identify top and emerging risks. As part of this process, climate risk has been identified as a top risk. Risks are assessed for their potential impact and likelihood, and the assessment considers both quantitative and qualitative impacts, in line with the Risk and Control Self-Assessment (RCSA) Standard. This inputs into the financial materiality assessment.

Financial materiality assessment: In 2025, climate-related risks were assessed to identify the risks that could reasonably be expected to affect the Group's prospects.

Managing and monitoring climate-related risks

Climate risk is monitored and managed in line with QBE's Enterprise Risk Management Framework, in its Risk Management Strategy. Monitoring of climate-related risks is supported by the following:

• Climate indicators are monitored through the Group ESG Risk Dashboard. The dashboard is presented to management on a regular basis to support awareness and understanding of climate risk.
• QBE has implemented a suite of policies to support climate risk management, including the Group Environment Policy, Environmental & Social Risk Framework, and Supplier Code of Responsible Conduct. These policies apply to operations, underwriting and investment portfolios and third-party relationships.
• Climate and other ESG-related topics are included in QBE's Key Reputational Issues List, requiring additional review prior to external disclosure. A greenwashing checklist and training module are available to guide employees in managing reputational and regulatory risks.
• An introductory ESG training module, which covers climate risk, was required to be undertaken by all Risk and Compliance staff globally this year to uplift capability around the identification, monitoring and management of climate and other ESG-related risks. Function-specific training is available to underwriting teams.

Climate risk is managed and monitored in line with the three lines model, with first line ownership of the risks across underwriting, investments, supply chain and operations. QBE's independent Risk and Compliance team provide second line review and challenge of management actions in place relating to climate risk management, including in relation to the Sustainability Scorecard and Environmental & Social Risk Framework, to enable effective implementation and monitoring. Second line also supports the review of risks and controls relating to QBE's internal and external climate risk management and obligations. The Group's internal audit function provides independent assurance over the effectiveness of climate risk management, including the adequacy of controls and governance processes.

Identifying and assessing climate-related opportunities

QBE continuously sources and evaluates climate-related opportunities, including:

• monitoring and evaluating possible climate solution investments as part of the Group's investment strategy;
• monitoring and evaluating climate and insurtech solutions to support customer resilience and enhance QBE's underwriting, claims and risk-engineering capabilities via QBE Ventures; and
• identifying and evaluating underwriting opportunities that support the transition to a lower-carbon economy, which has been a particular focus in the current year as part of the development of the Group's Transition Plan.

In 2025, QBE established a dedicated workstream to systematically assess and develop a strategy for climate-related opportunities within the underwriting portfolio, following a phased approach:

Phase 1: Identify and evaluate potential climate-related opportunities based on consideration of emerging market trends, QBE's existing capabilities and footprint, market size and growth potential, feasibility and scalability.

Phase 2: Develop strategic options and implementation requirements for advancing priority climate-related opportunities, informed by scenario analysis and quantitative modelling.

Phase 3: Develop implementation plan to deliver targeted interventions for priority climate-related opportunities, outlining key actions, milestones and governance for future execution. This phase is planned to be delivered in 2026.

Integration into overall risk management

Climate change is managed as a sub-class of strategic risk within QBE's Risk Management Strategy and is integrated into the top risk process, financial materiality assessment, the Enterprise Risk Management Framework and the three lines model, as described above.

Integration into risk management

The Board approves our risk appetite and oversees our principal risks. The Board is supported in monitoring a range of material financial and non-financial current and emerging risks by the Audit & Risk and Sustainability committees. Climate-related risks and opportunities are integrated in our enterprise-wide risk management framework. These are identified by product groups and supporting functions, then included in the appropriate risk register. These will be assigned a risk owner and evaluated on the maximum reasonable consequence (non-financial and financial) and likelihood of the risk. Consequences may include the impact on Group free cash flow or business value, or reputation and licence to operate. These risks are escalated to the appropriate level of management for oversight and action. Processes remain unchanged from the prior year.

Under our 3 lines of defence model, all employees are empowered to own and manage the risks that arise within their area of responsibility. Our Enterprise functions are our 2nd line of defence, providing deep subject matter expertise and objective challenge. Our Internal Audit function provides independent assurance. Where required by law, or where deemed appropriate, we also engage third parties to provide independent assurance. Where risks are material to the Group, they are escalated to the Risk Management Committee and, as appropriate, to the Board or its committees.

We actively monitor and assess the potential impact of climate risks and opportunities on our operations and business through scenario planning. Climate-related opportunities are prioritised by considering factors such as shareholder value, asset cost base, emissions abatement potential, and competitiveness against the marginal abatement cost curve.

In 2025, climate change has been elevated to a standalone principal risk to reflect its increasing relevance and potential to materially impact our business. All Group principal risks and uncertainties are reviewed on a quarterly basis by the Enterprise Risk function and the Risk Management Committee (RMC).

Physical risk identification and assessment process

Our climate risk management approach is built around 4 pillars:

1. Weather/climate analytics and insights: We apply advanced weather and climate data to support operational planning, emergency response, and long-term resilience, including short-term severe weather forecasts, climate outlooks, catastrophe modelling, and long-term climate projections (CMIP5 and CMIP6). Climate projections are available for all assets, including non-managed sites, covering over 60 variables and multiple emissions scenarios. Flood risk modelling has been completed for 100% of assets across present-day, medium, and long-term horizons.

2. Physical risk identification and assessment: All sites within our portfolio are exposed to varying degrees of physical climate risk. Our approach to quantifying and assessing physical risk covers individual assets (bottom-up) and Group level (top-down). We first identify climate risks and opportunities across varying time horizons and emission scenarios. Next, we evaluate their potential financial and non-financial consequences and likelihood. Then we prioritise these risks by materiality for effective risk management and appropriate resource allocation. This process is integrated within the Rio Tinto Risk Management Information System. The scope of our assessments includes our operations and the environments in which we operate, our people, the communities who host us and our supply chain.

3. Resilience planning and adaptation: Our resilience planning identifies the most appropriate measures to manage climate risks and adapt to them. We comprehensively evaluate an investment decision before funding is approved.

4. Monitoring and evaluation: We actively and regularly monitor risks, with clearly defined roles and responsibilities. We continually evaluate the latest generation of climate change data and emerging technologies to assess the risk profile of our assets and infrastructure over time. Assessment processes are revisited where we have identified a material change to the economic, social, environmental or physical context of the risk.

Financial exposure modelling (VaR)

We have continued to progress our Value at Risk (VaR) analysis by advancing physical climate change risk assessments through financial modelling at the product group level. In 2025, we completed assessments for our Aluminium & Lithium, Copper and Iron Ore product groups. Our climate physical risk modelling analysis, undertaken in collaboration with an external consultant, estimated expected financial losses from damage to individual assets, across various time horizons and emission scenarios caused by physical climate hazards, considering: asset portfolio and archetypes; climate scenarios, time horizons and hazards (nine hazards modelled, including flooding, coastal inundation, extreme heat, cyclonic wind, extreme wind, soil subsidence, forest fire and freeze-thaw); annualised damage (AD); and productivity loss (PL).

Considerations and limitations

Our climate physical risk modelling acknowledges limitations and uncertainties due to the dynamic nature of the earth's climate and unpredictable future GHG emissions. These models represent plausible futures, not predictions. The accuracy of our analysis depends on the quality of asset data and assumes no changes in operations or design standards. The modelling reflects only climate-related physical hazards and current asset configurations, and does not include network effects or wider supply-chain impacts. This analysis is iterative, evolving with new insights and projections.

Santos takes an enterprise approach to risk management and operates under one Risk Management Framework for all risks, including climate-related risks. Our Risk Management Framework requires the identification and management of risks to be embedded in business activities and provides requirements and guidance on the tools and processes to manage risks. To support the consideration of climate, Santos maintains a Risk Appetite Statement, that enables emissions to be considered in decision-making processes and is reviewed at least annually for ongoing alignment with strategic objectives.

Value chain

Our risk identification process is enterprise-wide and considers risks from a wide range of stakeholders such as government and capital markets, and includes the identification of significant events that impact our operations (e.g. extreme weather). Our scope considers upstream (suppliers) and downstream (customers), non-operated joint venture arrangements, as well as our own operated joint ventures.

Non-operated joint venture arrangements

For non-operated joint ventures, we have defined critical expectations and requirements for participation and operation. We have joint venture representatives who work closely with our joint venture partners to reduce the risk of misalignment in joint venture activities. We have identified our material non-operated joint venture arrangements based on production volume to support the consideration and engagement on climate-specific risks and opportunities.

Role of scenario analysis

Climate-specific scenario analysis is used to support the identification of climate-related risks and opportunities through our strategy process, long-term plans, major project design and resilience testing for reporting purposes. Physical risk scenario analysis has been integrated into regional business unit risk reviews for operated assets and used to support the identification of physical climate risks impacting our material non-operated joint venture assets. Whilst our physical scenario analysis does not extend beyond Santos’ operational boundary, it has been used to inform the identification of risks to supply chains and transport of product to the point of sale.

Major suppliers and customers

We have a diverse supplier base with flexibility to source from multiple suppliers. We also have a diverse customer base and can sell product to alternative customers. To support climate-specific risk identification we have identified our major suppliers and customers based on dollar value and requested information to understand their management of climate-related risks and opportunities. We expect that information may initially be limited in some areas.

Climate risk assessment and prioritisation

To assess climate-related risks (as for all risks assessed through the Risk Management Framework), we use internal stakeholder engagement and current and emerging threat reviews. We use qualitative and semi-quantitative criteria through a Risk Matrix, which considers the likelihood (by reference to timeframes) and severity of potential impacts by estimating the worst-case scenario in terms of damages and financial loss. This assessment results in the definition of a risk level that informs the prioritisation of climate-related risks (and all other risks), which are reviewed annually with risk owners for alignment with Santos’ enterprise-wide risks. This assists Santos in prioritising and understanding the significance of climate-related risks in relation to other risks.

Climate risk monitoring

The ongoing monitoring of climate-related risks is embedded into business activities through the SMS, which sets the mandatory requirements for how we manage and operate the business. This includes a Risk Management and Assurance Operating Standard that sets out the detailed requirements and tools to identify and manage risks. Risk owners must assess climate-related risks, considering potential impacts across assets and communities and verify the effectiveness of controls in managing these risks. Executive management and the Audit and Risk Committee regularly review the enterprise-wide risks, new or emerging risks, and the risk controls and mitigations that management has put in place in relation to those risks. To support climate-specific monitoring, climate-related risks and opportunities are summarised in our Climate Risk Register, which is used to monitor current and emerging climate-related risks and opportunities. There have been no major changes to our risk management process from the prior year.

Integration with overall risk management framework

Santos’ Risk Management Framework provides the overarching framework for managing risks, including climate-related risks. Santos’ climate-related risks are linked to enterprise and material business risks, which ensures climate-related risks are managed throughout the business in accordance with our Risk Management Framework. Santos’ climate-related opportunities form part of our company strategy and CTAP. This ensures our climate-related opportunities are managed through half-yearly review of our CTAP by the Safety and Sustainability Committee.

Approach to vulnerability - challenges and limitations

The term ‘vulnerable’ is not defined under AASB S2 climate reporting standards. Our approach has been to seek to identify the assets or business activities in the financial report that we currently view as most vulnerable to each climate-related risk and assumes unmitigated response. There are inherent limitations in assessing whether, when and how climate-related risks may eventuate and therefore in determining what assets or business activities could be vulnerable to such risks. Similarly, the term ‘aligned’ is not defined under AASB S2 climate reporting standards and therefore we have adopted a consistent approach for our assessment of assets or business activities aligned with climate-related opportunities as climate-related risks.

Approach to risk management

The Board and executive leadership team set the Group approach to risk management, which is promoted and role-modelled throughout the business. The Enterprise Risk Management Framework (ERMF) outlines how the Group identifies, assesses, manages and monitors risks and controls. It references globally recognised standards including ISO 31000:2018 as well as regulatory guidance from the Australian Securities and Investments Commission and the Australian Securities Exchange. The ERMF applies to all teams and identified risks, including climate-related risks.

Annual risk analysis processes include developing team and specific risk profiles that outline key controls and mitigation plans for managing identified risks, including climate-related risks. This in turn informs the review and update of the enterprise risk profile.

A Climate-Related Risks and Opportunities (CRROs) Management Framework was prepared in alignment with the principles of the Group's broader ERMF in 2024 and applied in 2025. The CRROs Management Framework details the approach to identify, assess, prioritise, mitigate and monitor climate-related risks and manage climate-related opportunities.

Controls and mitigation plans for climate-related risks are integrated in destination Climate Change Adaptation Plans (CCAPs), Destination Environmental Action Plans (DEAPs) and destination risk registers. Material risks receive oversight from the ERMC, the RSC and the Board.

Identification

An initial list of CRROs relevant to business operations was developed through external research, support and review from external advisers, internal sources including workshops with team members from across the business, and insights previously identified under the Task Force on Climate-related Financial Disclosures (TCFD).

Internal inputs included the Group's Integrated Environmental Plan and portfolio climate exposure assessments, focused on a broad range of physical climate hazards and the degree to which the Group's destinations may be affected.

External inputs included publicly available information and competitor data, property and construction industry reporting, and international perspectives informed by climate scenarios from the United Nations (UN).

Assessment and prioritisation

The Group risk assessment matrix considers categories including life safety, earnings and distribution, operational efficiency, environmental impact and reputation. This matrix was used to assess and prioritise the climate-related risks in a low and high-emissions scenario and within the Group's defined time horizons.

Medium and above ratings have the most potential impact on the Group. Given multiple controls are in place for the climate-related risks in the short and medium term, an inherent rating of medium was determined as adequate to capture those CRROs which could potentially pose a material risk to the Group. A medium rating can arise from different likelihoods and consequences, for example, almost certain/negligible, possible/moderate, or rare/major. By undertaking an assessment on those CRROs rated medium or above the Group captured risks that were either more likely with low impact or less likely with higher impact, reflecting a risk based approach to prioritising assessments.

Opportunities were assessed as to whether they were part of the Group's current strategy and activities, could be achieved through the existing business model and potentially provide material financial benefits.

The CRROs were endorsed and approved by the Executive ASRS Steering Committee, the RSC and the Board.

Mitigating and monitoring CRROs

CRROs are overseen by the Executive ASRS Steering Committee, the RSC and the Board. The ERMF and CRROs Management Framework will be reviewed at a minimum on an annual basis, with relevant enterprise policies and standards, as they relate to CRROs rated medium or above, to be updated where relevant. CRROs rated medium or above are subject to regular and ongoing assessment. Of these, six relevant CRROs have been identified for disclosure.

Climate-related transition risks and opportunities are monitored by operational and specialist teams for effective implementation and regular progress reporting to ensure they continue to align with the Group's obligations and strategy. For climate-related physical risks, ongoing management, monitoring and reassessment is conducted as part of processes and plans including Strategic Asset Plans (SAPs), Destination Risk Registers, Destination Environmental Action Plans (DEAPs), Climate Change Adaptation Plans (CCAPs), and asset capital planning and long-term budget forecasting, with portfolio coverage ranging from 19/42 to 42/42 destinations depending on the process/plan.

Framework (p. 167). An enterprise-wide Risk Management Framework prioritizes and manages climate risks alongside other material business risks. The Risk Appetite Statement incorporates climate-related considerations and is reviewed at least annually by the Board's Risk Management Committee. The processes were unchanged from the previous reporting period.

Identification (p. 167). Continuous monitoring of climate trends plus a structured risk-identification process that also captures emerging opportunities. Inputs: internal data (business plans, financial models, operational, asset and facility data, insurance, emissions and energy data, scenario analysis outputs) and external information (regulatory developments, climate science and emissions trajectory data, technology and market trends, stakeholder sentiment, legal developments, peer disclosures).

Scenario analysis (p. 167). The FY2025 analysis (two scenarios, all major operating geographies and business units) supported identification and assessment of risks and opportunities.

Assessment and prioritization (pp. 167–168). Likelihood and severity are estimated using a Risk Assessment Matrix combining qualitative and quantitative factors. Ratings are benchmarked against Board-approved risk appetite and tolerance criteria so risks are ranked consistently. Opportunities are assessed and prioritized with the same framework. Monitoring is ongoing within enterprise risk management processes (p. 168).

The approach taken to identify, assess, monitor and manage climate-related risks and opportunities is guided by the Group's existing commitments, principles and methodologies set out in the Enterprise Risk Management Policy and Procedure. The management of climate-related risks and opportunities alongside other business risks supports the Group's strategic and business decision-making.

Risk Management Process

The Group's approach to the identification, assessment and management of climate-related risks and opportunities is recorded in a standalone Climate Related Risk Management Procedure. The process mirrors those detailed in the broader ERMF and Procedure in the same way they are followed for all other strategic and operational risks. The identification and assessment of climate-related risks and opportunities is an iterative process where risks are continuously monitored and re-evaluated to reflect the latest developments.

Our ERMF is based on global standards, specifically, COSO ERM Framework and ISO 31000:2018 – Risk Management. It provides a structured and consistent approach to identifying and managing risks across the organisation. This framework guides the systematic application of management policies, procedures, and practices to the key activities of risk management – namely, communication and consultation, establishing the context, and the processes of identifying, analysing, evaluating, treating, monitoring, and reviewing risks. The Climate Related Risk Management Procedure builds on this foundational process by integrating the use of future climate scenarios, projections and time horizons in analysing risks and opportunities.

Risk and Opportunity Identification

Conducting an environmental scan to identify climate-related risks and opportunities that may impact Stanmore's business, strategy and financial planning is an integral step in the risk assessment process. The environmental scan draws on a wide range of internal and external sources to ensure a robust and forward-looking view of potential climate risks and opportunities. This includes consideration of market, legal, regulatory changes and trends affecting the metallurgical coal and mining industry and those affecting society more broadly. Assessment of future climate scenarios and projections, and historical data, and conducting industry benchmarking also forms part of the approach to the identification of risks and opportunities. Through this process, the Group identifies both strategic and operational climate-related risks, including: physical risks (both acute and chronic) – stemming from extreme weather events and longer-term shifts in climate patterns such as precipitation and rising sea levels; and transition risks – stemming from legal, regulatory and policy changes, technological developments and market shifts.

Risk and Opportunity Assessment

Risks identified through the initial scanning processes are analysed in terms of the impacts and likelihood of the risks over defined short, medium and long-term time horizons. This enables the level of risk to be determined for each risk and provides information to consider the approach for prioritisation, mitigation and treatment of risks. The potential impacts and the severity and likelihood of impacts are also assessed using scenario analysis. By assessing risks of different time horizons and exploring differing future climate scenarios, the analysis provides a more robust understanding of the resilience of our strategy.

In assessing climate risks and opportunities, we undertook a comprehensive evaluation that incorporated historical data, past events, and contextual circumstances relevant to our operations and business. We reviewed previous events and incidents – both internal and external – to inform our assessment of likelihood and impact, aligning with best practices outlined in our ERMF. Climate projections under the future scenarios also factored heavily into our assessment.

Historically, our climate risk assessments have relied primarily on qualitative methods, drawing on judgment and stakeholder input from key personnel including the ELT and subject matter experts from across our business, and narrative-based evaluations. In response to evolving disclosure standards and stakeholder expectations, we advanced our methodology this year by adopting a quasi-quantitative framework. This shift has enabled us to better estimate the severity of climate-related consequences – particularly from a financial perspective – and to determine their materiality to the company with greater clarity. Through workshops and sessions with key stakeholders, we considered the available information, both qualitative and quantitative, to map the severity of consequences and likelihood against our existing Risk Matrix used to determine which of the identified risks and opportunities are material. We sought third-party expertise to assist us throughout this process.

Risk and Opportunity Prioritisation

The Group prioritises climate-related risks and opportunities through a structured process that aligns with the ERMF and tools, and the risk appetite set by the Board which provides clear guidance on acceptable levels of exposure to risks. Identified and assessed risks and opportunities are recorded, along with applicable controls, mitigation measures or strategic benefits, are monitored to ensure that risks and opportunities are managed to required tolerances. Risks and opportunities are evaluated based on their potential to impact the Group's financial performance, operational stability and strategic objectives. Particular attention is given to risks that could materially affect cash flows or business continuity over the next strategic planning cycle. Prioritisation also considers the time horizon of each risk or opportunity, as well as its relevance across different business functions. The prioritisation process is dynamic and reviewed regularly to reflect changes in the external environment, stakeholder expectations, and internal business strategies.

Risk and Opportunity Monitoring and Reporting

Monitoring of climate-related risks and opportunities forms part of the structured risk cycle embedded within our ERM Framework. This includes quarterly environmental scans to identify changes in context or circumstance which may trigger a change in risk levels. In situations where there are factors identified which may impact risk ratings, a review and re-assessment of the relevant risk or opportunity is conducted. On a quarterly basis the following is considered: any changes in the internal or external context; any changes to the consequences and likelihood; whether the controls are still effective; whether any treatment actions are implemented; and whether the risk remains the same.

For climate-related risks and opportunities, where a risk rating changes as a result of the review, the reasons for the revised rating are recorded and an update provided to the Sustainability Committee, and where it is a material climate-related risk or opportunity, an update is also provided to the Audit & Risk Management Committee.

Integration into Overall Risk Management

Building on the identification of material climate-related risks and opportunities, the Group has embedded their management into its Enterprise Risk Management Framework (ERMF) to strengthen overall business resilience. Once consolidated, these risks and opportunities are formally documented, rated, and tracked in the Climate Risk Register and escalated in line with the treatment of other strategic risks. The register is reviewed regularly by the Audit and Risk Management Committee, ensuring ongoing governance oversight and integration into enterprise-wide decision-making. Through this approach, climate-related risks and opportunities are not managed in isolation but are fully embedded into core strategic and operational planning processes.

Materiality (p. 184). Determined using AASB S2 and AASB 101; information is material if omitting, misstating or obscuring it could reasonably be expected to influence primary users' decisions.

Risks (pp. 184–185). Step 1, identification: risks and opportunities register (pp. 65–67), scenario analysis, internal operations and key value chain providers, industry and government benchmarks and professional services firms, then management evaluation. Step 2: current exposure after resilience measures and mitigating controls gives a residual risk position. Step 3: ratings reflect likelihood, impact and embedded resilience measures and prioritize resilience plans. Step 4: the four climate risks map to one enterprise risk on the register; they are assessed annually under the Group Risk and Compliance process, with annual SLT attestations.

Opportunities (pp. 185–186). Assessed case by case through market scanning, portfolio-mix assessment and scanning of market practices, then prioritized against the capital allocation framework, investment criteria, impact on strategy and emissions, feasibility and commercial viability.

Review (p. 186). Scenario analysis informs the assessment and is refreshed every 2–4 years or after significant business changes.

Integration (p. 42). The Risk Appetite Statement and Enterprise Risk Management Framework recognize physical and transition risks, treated as standalone risks and as causes of other risks, managed under documented practices and prioritized by risk rating. Climate-related risks are managed through risk selection, natural peril pricing, the natural hazard allowance, reinsurance, capital and advocacy. Scenario analysis is a risk management tool; outcomes inform strategic and risk management decisions but do not determine annual risk ratings.

Risks (p. 42). Material natural perils are reviewed by the insurance pricing team using modeling that combines historical claims experience with climate, event and building construction information, and monitored using climate indices tracking weather extremes.

Opportunities (p. 42). Identified, assessed, monitored and prioritized through the annual business strategy development cycle, based on regulatory and strategic importance.

CRRO identification (p. 42). Four steps: identification and description (risk documentation, prior disclosures, scenario analysis, external frameworks, strategy documents, peer disclosures); elaboration and refinement (short, medium and long term, on a residual risk basis, with quantitative indicators where feasible); assessment of relevance and material information (Risk, Obligation and Control Self-Assessment processes); and final determination by governance and decision-making committees.

Index (p. 215): Risk management, p. 205.

Identification (p. 205). New and emerging risks, including climate risks, are identified through horizon scanning, review of historic incidents and impacts, operational management actions, anecdotal evidence, desktop assessments and advice from internal and external subject matter experts. Climate and nature considerations are embedded in the M&A screening process, an eco-design tool and the screening approach for new suppliers. Scenario analysis informs identification (physical hazards to 2050, transition over the medium term).

Assessment (p. 205). Risks are rated for consequence (seven categories, rated 1–5) and likelihood (rated A to E) to give an inherent rating; tested controls and leading and lagging indicators determine a residual rating, compared with a risk appetite set by the Board. Climate is core to the FY26 Material Risks of Climate adaptation and Energy resilience and a consideration in others.

Monitoring (p. 205). Risk owners give regular updates to the CEO Leadership Team, the Risk and Sustainability Committee and the Board; control owners meet more frequently with working groups and risk managers. There were no adjustments to the approach in the period.

Integration and opportunities. Climate-related risks are managed via the Telstra Group risk management framework (p. 187). In FY26 a likelihood and consequence rating scale for opportunities was developed using the same impact categories (p. 205).

The Group is committed to effective risk and opportunity management at all levels of the organisation as an essential element of business governance under its Risk Management Framework. The Group's enterprise-wide approach embeds risk management into processes and practices, supporting strategy execution, operational decision-making and business resilience.

The Group's Risk Management Framework establishes a consistent methodology for assessing and managing risks and opportunities across the Group and promotes the proactive recognition of external factors and uncertainties that may affect the achievement of its strategic objectives. The Risk Management Framework encompasses all risks that could have a material impact on the Group, including but not limited to strategic, health and safety, environmental, climate-related, financial, operational, cybersecurity, regulatory, reputational, market and fraud risks.

Each risk and opportunity is assigned a rating of either Very High, High, Moderate or Low, by considering the likelihood that the risk or opportunity may eventuate under five bands ranging from rare (<5% likelihood) to almost certain (>75% likelihood) together with the potential financial consequence under five bands ranging from negligible (<0.5% of the Group's EBITDA) to substantial (>7% the Group's EBITDA). The Group also considers non-financial consequences (including but not limited to health and safety, environmental, business continuity, human resources and compliance) in assessing any risks. The Executive Leadership Team (ELT) reviews the Group's risks and opportunities at least annually and agrees on a list of Top Risks, that are escalated to the Audit, Risk and Compliance Committee (ARCC) and the Board, and managed under defined tolerance.

These tolerances set the thresholds for when climate-related risks require escalation or additional controls and align with the Group's risk appetite, which ranges from averse to open depending on the nature of the risk. No specific prioritisation was applied to climate-related risks over other identified risks in 2025.

The Group's Risk Management Framework is overseen by the ARCC and aligns with ISO 31000: 2018 Risk Management – Guidelines, Principles and Framework. The Board undertakes an annual review of the Group's Risk Appetite Statements (RAS) and the Group's governance and compliance arrangements with the RAS. The ARCC monitors the framework for effectiveness quarterly. The Managing Director and Group CEO and the ELT implement the risk and opportunity processes within their areas of accountability.

The SASC and ARCC provide oversight of the Group's framework for the identification, management and reporting of climate-related risks and opportunities. The Group reviews its climate-related risks and opportunities at least annually, and these are subject to the same escalation mechanism to the ARCC and the Board mentioned above.

During FY25, the Group introduced climate scenario analysis for climate-related risks and opportunities.

Climate-related risk management

Our Group is exposed to climate-related risks, across multiple time horizons. In order to identify, assess and manage these risks, we apply our Enterprise Risk Management (ERM) Framework, along with our risk management policies and procedures. The ERM Framework is designed to ensure that appropriate systems are in place to identify material risks that may impact the Group's business, understand their potential financial impact, and implement effective internal control systems to limit exposure. It also establishes clear responsibilities for managing these risks, and articulates the Company's risk appetite.

Our ERM Framework and related Risk Registers enable us to consider our climate-related risks alongside other key categories of risk such as compliance and regulatory risks, Health, Safety, Security and Environment (HSSE) risks, and data and systems risks. The Risk Registers undergo regular reviews to account for changes in our internal and external environments, as well as the likelihood and impact of each identified risk.

The ERM Framework guided our detailed analysis of specific climate-related risks. Risk analysis aims to understand the nature of risk and its characteristics, including the level of risk for the Group. This process involves examining uncertainties, sources, consequences, likelihood, scenarios, and the effectiveness of existing controls. Each risk is then assigned a rating based on this evaluation. We applied the ERM Framework's risk assessment criteria and rating scale to determine the likelihood and consequence of each identified climate-related risk across the Group's operations. This analysis enables integration and comparison with other Group-wide risk assessments.

Climate-related opportunities are considered as part of our approach to mitigating emerging risks, including impacts associated with declining demand for hydrocarbon fuel products.

Under the ERM Framework, climate-related risks are reviewed and updated annually. Risks are also assessed throughout the year, when material changes occur in regulatory, economic, or physical climate factors. Risk assessments are undertaken at a Group-level, using publicly available geospatial data sets to analyse business and asset-specific data, including indicators such as rainfall, flood inundation, fire weather index and historic cyclone wind speed, recognising the increasing levels of uncertainty in the data over time. These datasets inform evaluations of physical climate risks based on our operational locations. We apply this data under the two climate scenarios and ERM Framework parameters to determine the likelihood and consequences of climate-related physical risks. Climate-related transition risks are assessed using various scenario indicators covering policy and legal, technology, and market risks.

The ERM Framework is aligned with the principles of ISO Risk Management Guidelines ISO 1300:2018. Our risk management system is embedded throughout the organisation, from the Board level, where there is oversight of risk strategy and policy-setting, to day-to-day operational activities, over which management has primary responsibility. The Audit and Risk Committee and the Sustainability Committee have primary oversight of Lines 2 and 3 of the 'three lines model', which is the foundation of the Group's risk oversight and governance approach.

Framework (p. 80). Risk management is embedded through the Wesfarmers enterprise risk management framework. Climate-related risks are identified, assessed and prioritized using the same taxonomy, likelihood scales and consequence ratings as all other Group risks.

Inputs and assessment (pp. 60, 80). Scenario analysis is an input to identifying and prioritizing CRROs. Physical risk assessment uses asset-level hazard data and scenario outputs over short-, medium- and long-term horizons; transition risk assessment uses policy, technology, market and reputational factors. Key risk indicators are monitored. Risks are assessed on an inherent and residual basis and aggregated at Group level. CRROs are prioritized when combined likelihood and consequence ratings exceed 'High' on an inherent basis; residual risks above risk appetite are escalated through divisional governance and the ARC.

Opportunities (p. 80). Identified through annual corporate planning, the investment evaluation framework (internal carbon price and sensitivity testing) and scenario analysis, and assessed against expected return, strategic alignment and risk profile.

Changes in 2026 (p. 80). Insurance-based catastrophe and climate risk modeling (including annual expected loss data) was formalized within the enterprise risk management consequence assessment methodology, and the ThinkHazard! classification system was introduced for divisions without prior likelihood values.

Framework and integration (page 61). Climate-related risks and opportunities (CRROs) are integrated into the Risk Management Framework, overseen by the Audit and Risk Management (ARM) Committee with ultimate responsibility resting with the Board. Environment and Climate Change is one of eight risk categories in the Board-set Risk Appetite Statement.

Identification, assessment, prioritization (page 62). Risks are identified through regular risk management reviews, corporate development activities, the Climate Change Working Group and scenario analysis, and reassessed after significant events such as major transactions, regulatory developments or changes in national policy settings of key customer countries. Assessments have historically relied primarily on qualitative methods, using workshops and a Risk Matrix ranking severity of consequences and likelihood. Risks are prioritized on residual risk rating and control effectiveness; climate-related risks receive no preferential weighting. Opportunities are evaluated on their significance to the business and potential to create value.

Monitoring and change (page 62). The Enterprise Risk Register was reported biannually to the ARM Committee and quarterly to the Executive Leadership Team in FY26. Transition risks have a targeted biannual review (to the ARM Committee) and physical risks a targeted annual review (to the Health, Safety, Environment and Community Committee). The process did not change in FY26.

Climate-related risk management follows the Group's Enterprise Risk Management Framework, with no difference from other enterprise risks (p. 213).

Identification and assessment (p. 213). Risks and opportunities are monitored and assessed annually by the Sustainability & ESG and Risk functions, using inputs including desktop research, validated by the Climate-related Risk and Opportunity Working Group and relevant functions such as Information Systems. Assessment starts at an inherent level, with likelihood and consequence considered against a matrix of qualitative and quantitative criteria, the same matrix used for other risks. Controls are then considered to understand the residual risk, and ratings are recorded in the risk register in the Governance Risk and Compliance tool. Scenario analysis is performed periodically when significant business changes occur, first in 2023 with external climate advisors; in FY26 it validated existing risks, and an identification exercise followed the e2open acquisition.

Prioritization and monitoring (p. 213). Prioritized by residual rating, not differently to other risk types. To support external reporting, additional structured assessment aligned with AASB S2 applies, against financial, stakeholder and sector impact criteria. Reports on new and emerging risks go to the Audit & Risk Committee quarterly.

Risk management process

Woodside's risk management process is described in Section 3.7 – Risk Factors. Sustainability risks are incorporated into this process. As a business, Woodside categorises its risks in three ways: strategic (those within our sphere of influence that could significantly affect our ability to achieve our medium- to long-term strategic objectives); emerging (those capturing external threats or factors that have a high degree of uncertainty and are not readily controlled by Woodside); current (those that could affect our ability to deliver our objectives).

Woodside's strategic risks align with several of its material sustainability topics. Risks categorised as "strategic" are reviewed by the Board, its Audit & Risk Committee and the Executive Leadership Team at least twice a year, and the Board confirms its risk appetite in relation to each strategic risk. Management actions that need to be taken in order to address the risks are incorporated into Woodside's internal risk management system.

Materiality assessment process for sustainability topics

Woodside undertakes a materiality assessment process which builds upon our risk management process with a specific focus on the further identification of sustainability topics. In undertaking the materiality assessment, management draws upon internal and external inputs, including from our risk management process, and the monitoring of developments, trends and stakeholder views throughout the year, as well as the experience and expertise of Board Directors and senior management. Some specific engagements with stakeholders (such as investors, customers, communities, and governments) can help to verify our analysis. When topics have been identified, they are prioritised. The highest priority topics are determined to be material. Following endorsement by the Executive Leadership Team and the Sustainability Committee, actions to address the material topics are included in Woodside's Sustainability Plan which is monitored by the Executive Leadership Team and the Sustainability Committee.

Board oversight of climate-related risks and opportunities

Woodside assesses and discloses the current and anticipated material climate-related risks and opportunities that could impact its business and value chain. These include physical risks, transition risks, and transition opportunities. The Board and its Sustainability and Audit and Risk Committees contributed to the design of this process and reviewed its outcomes. Risks and opportunities were assessed against factors including the potential effects on cash flows, access to finance and the cost of capital over the short, medium and long term. Where sufficient information is available, an assessment of the potential financial impact of these risks and opportunities has been undertaken.

Process for identifying and assessing material climate-related risks and opportunities (CRRO)

Woodside routinely reviews its risks as described in Section 3.7 – Risk factors. Material CRROs are identified, assessed and monitored through established governance processes. Accountabilities for managing current and emerging risks are clearly defined, supported by regular oversight and at least annual review.

In 2025, subject matter experts from across Woodside's business attended a series of workshops which considered physical risks, transition risks and transition opportunities across Woodside's value chain, utilising a methodology aligned to AASB S2 requirements.

CRROs were identified in relation to their potential effects on factors such as Woodside's operations, cash flows, access to finance and cost of capital. Additional mapping of the CRROs identified whether the causes were under Woodside's control or arose from market, legal, regulatory or other external sources. Where possible an assessment to quantify financial impacts was undertaken. Risks and opportunities were also categorised for where in the Woodside value chain, and over which time horizon they applied.

The CRROs assessment utilised external scenarios and internal analysis that Woodside considered could reasonably be anticipated to occur in the stated timeframes. This differs from the approach used for the resilience testing, which in order to meet the relevant requirements of AASB S2 also includes scenarios that Woodside does not currently or foreseeably observe evidence of eventuating.

The assessment produced an initial list of possible CRROs across Woodside's value chain over the short, medium and long term. These risks and opportunities were then further analysed and refined by internal subject matter experts, senior management and external advisers.

CRROs including those identified in 2025 are considered by Woodside in our business decision making. For example, risk mitigations such as Woodside's capital allocation framework and transition case methodology are applied to new investment decisions. Woodside performs ongoing assessment of investments to ensure potential trade-offs can be navigated relevant to available resources.

Process (p. 56). The Group uses its established risk management framework (RMF) and strategy planning processes to identify, monitor and report on material CRROs, evaluated alongside other material enterprise risks. Climate is treated as a macro risk factor. Inputs include climate scenario analysis, external research and expert climate modeling, existing and emerging risks, and business feedback. The top-down identification covered Australian Food, New Zealand Food and BIG W and the broader supply chain, covering 92% of revenue.

Assessment and prioritization (p. 56). CRROs are assessed using the RMF risk matrix on likelihood and consequence against financial and non-financial criteria. Only risks rated high or very high were considered relevant for disclosure, and a subset expected to exceed the financial materiality threshold was modeled. CRROs are prioritized by risk rating like other risks, not differently.

Opportunities and monitoring (pp. 56–57). Scenario analysis informs identification of physical and transition risks and of opportunities, which are assessed and prioritized on their potential to deliver commercial value and climate benefits. Management monitors risks through quantitative and qualitative methods and reports material changes in trajectory to the Sustainability Committee at least annually. There were no material changes to the risk management processes in the reporting period.

Framework (p. 51). The Sustainability team stewards the CRRO process, based on the Risk Management Standard and the Internal Risk Register, aligned with ISO 31000:2018, with roles framed around the Institute of Internal Auditors' Three Lines Model. The CRRO register is reviewed and updated each year: prior-year CRROs are refined, new ones added, and in FY2026 a targeted stakeholder engagement approach was used to refine and validate them.

Identify and assess (p. 51). Context is set each year; scenarios and time horizons are central parameters, and the scope covers all Group entities and activities including Joint Ventures. CRROs are identified through leadership insight, frontline teams, subject matter experts and workshops, then assessed qualitatively on consequence and likelihood scales across financial and non-financial impacts.

Prioritize, monitor, integrate (p. 51). CRROs rated high or very high go to financial effects modeling; high-priority CRROs are escalated to senior management and material ones to the Board. Outcomes feed Group risk reporting, where CRROs are compared with other business risks and opportunities, and inform resource allocation and financial planning. The Sustainability function monitors ratings, mitigation progress and modeling throughout the year. The process covers opportunities as well as risks.

Yancoal's Enterprise Risk and Opportunity Management Framework (EROMF) establishes a link between business objectives, strategy and risk, and opportunity management activities. It provides the foundation for managing uncertainty through a structured and consistent approach. The framework sets out the minimum requirements for identifying, assessing and managing risks and opportunities across the business, including those related to ESG and climate.

Our risk identification activities are guided by ISO 31000 Risk Management, and are undertaken on a periodic basis, with analysis performed at specific functional and mine-site levels.

Our risk management policies and procedures have been designed and implemented to identify, assess and manage any material exposure to risks. Yancoal is subject to a range of sustainability risks, including climate-related, environmental and social risks. These include, but are not limited to, those related to: transition to a lower carbon economy; and climate-related risks (among other listed risk categories).

CRROs are managed through our Enterprise Risk and Opportunity Management Framework (EROMF), which integrates climate considerations into the broader enterprise approach to identifying, assessing and responding to risk.

During the year, we enhanced our understanding of CRROs in line with AASB S2. This included progressing our phased Climate Scenario Analysis program, supported by external experts, to help assess the potential impacts of both physical and transition-related risks across a range of hypothetical future scenarios.

The Audit and Risk Management Committee (ARMC) annually reviews Yancoal's risk management framework to satisfy itself that it continues to be sound and that the entity is operating with due regard to the risk appetite set by the Board. The ARMC annually reports on this review to the Board.