Risk Report

Risk management is an essential pillar of business management practices, aimed at ensuring the achievement of strategic objectives. It is a shared responsibility among all Ferrovial members, from the Board of Directors to every employee.

The Board of Directors has defined and adopted a Risk Control and Management Policy (hereinafter, “the Policy”), in line with COSO ERM and the ‘Three Lines Model as international reference standards. Its purpose is to provide Ferrovial employees with a general framework for controlling and managing risks of any nature, including strategic, financial and sustainability reporting, operational and compliance risks, that they may face in fulfilling business objectives and Ferrovial’s overall strategy. It is reviewed at least once every three years; the latest update having taken place in 2025.

The Policy is complemented by other corporate policies and internal regulations and is implemented through Ferrovial’s Risk Management Procedure (FRM), as well as procedures related to specific risk domains (risk areas or activities) aligned with COSO ERM global methodology.

Regarding financial reporting risks, Ferrovial’s ICFR system is based on the model outlined by the Committee of Sponsoring Organizations of the Treadway Commission, known as the Internal Control Framework for Financial Reporting (ICFR), which incorporates requirements due to its Spanish, Dutch and Nasdaq listing and the provisions of the Sarbanes-Oxley Act (SOX). The main characteristics of the ICFR system are described in note 7.2 of the Consolidated Annual Accounts.

With respect to sustainability reporting risks, Ferrovial follows the recommendations of the Task Force on Nature-related Financial Disclosures (TNFD) and the Task Force on Climate-Related Financial Disclosures (TCFD), which are included in this report and for which relevant information can be found, among others, in:

• IRO-1: DESCRIPTION OF PROCESSES TO IDENTIFY AND ASSESS MATERIAL IMPACTS, RISKS, AND OPPORTUNITIES RELATED TO CLIMATE
• SBM-3: MATERIAL IMPACTS, RISKS AND OPPORTUNITIES AND THEIR INTERACTION WITH THE STRATEGY AND BUSINESS MODEL.

Compliance risks are managed through the general framework of COSO ERM and are governed by the framework of the Compliance Policies of Ferrovial and are adapted, if necessary, to follow the applicable laws in each of the jurisdictions where Ferrovial performs its activities being particularly relevant the Dutch Penal Code, the Spanish Penal Code, the U.S. Foreign Corrupt Practices Act, the U.K. Bribery Act.

The Compliance Program is assessed annually under the supervision of the Corporate Compliance Department, the Corporate Tax Department and the Tax Compliance Committee and reported to the Audit and Control Committee and Board of Directors. More information to be found under section G1-1: Corporate Culture and Business Conduct Policies in the Statement of Consolidated non-financial and sustainability information.

Operational risks are managed through the general framework of COSO ERM, and supervised by the Enterprise Risk Department as further detailed under the topic “Effective Risk Management: Ferrovial Risk Management (FRM)”.

The Risk Management process, defined in the FRM Procedure, comprises identification, assessment, management, control, monitoring and reporting of risks within Ferrovial and will follow the following basic principles:

• It must cover the possible risk factors that may be present in the pursuit of the strategic objectives.
• It is integrated into Ferrovial´s processes, especially in those related to strategy and planning, or that have a higher impact in reaching strategic objectives.
• The approach for the identification, management and control of risks is homogeneous and systematic across the Group and seeks the involvement in decision-making of the parties concerned.
• It will focus not only on imminent risks but also on emerging ones. Ferrovial’s understanding is that emerging risks are new or known risks that are changing or present themselves in a new form. These are difficult to quantify and to establish the probability of their materialization, with their impact being in the medium/long term. Additionally, they have the potential to have a significant impact on the business.
• Reporting of the main risks that could affect the achievement of strategic objectives will be transparent and without delay, allowing the governing bodies of Ferrovial to act if needed.
• Responsibilities will be shared in key processes to seek diversification of critical functions mitigating the risk of fraud and errors.
• It will be performed pursuant to the applicable laws and regulations and in respect of the principles of behaviour included in the Code of Business Ethics.
• Continuous improvement will be sought through periodic assessments of the FRM process, being verified both internally and externally.

The Board of Directors is responsible for establishing the level of risk the Company is willing to assume in the course of its activities (Ferrovial’s risk appetite), as well as for designing, implementing, and maintaining appropriate internal risk management and control systems that enable the achievement of its strategic objectives.

The Audit and Control Committee assists the Board of Directors in fulfilling its responsibilities. Among its functions is supervising and evaluating the effectiveness of Ferrovial Group’s risk management and control systems, which include strategic, financial and sustainability reporting, operational, and compliance risks.

The Chief Executive Officer and members of the Management Committee are responsible for implementing the Policy throughout the Group.

Enterprise Risks, reports directly to the Audit and Control Committee of the Board of Directors. It is independent of business lines and is responsible for developing the risk management process (FRM). Additionally, it reports quarterly to the Management Committee, semi-annually to the Audit and Control Committee, and at least annually to the Board of Directors.

Aligned with the ‘Three Lines Model:

• The first line includes all business managers, responsible for identifying and managing risks associated with achieving objectives in their area of activity.
• The second line, composed of certain divisional and corporate departments, including Enterprise Risks, is responsible for establishing policies and strategies regarding their specific risks and overseeing them across the organization.
• Internal Audit acts as an independent third line, providing assurance to senior management and the Audit and Control Committee on the proper functioning of the Risk Management and Control System.

The Board of Directors sets the risk appetite Ferrovial is willing to assume in achieving its strategic objectives, including both qualitative statements of appetite and quantified tracking metrics. This process involves Senior Management, which, after analyzing potential impacts on the strategic plan, proposes revisions to existing metrics and the inclusion of new ones to facilitate organizational alignment. Risk appetite is a key element of risk management, forming part of the Policy, and was reassessed in 2025.

Ferrovial has defined a risk appetite scale ranging from aversion to a high willingness to assume risk. For the main critical areas—Regulatory Compliance, Growth, Operational Performance, Financial Management, Environment, and Health & Safety—qualitative statements have been defined to reflect the level of risk accepted within the framework of strategic objectives. Additionally, specific metrics have been incorporated for the most relevant factors, allowing appetite to be quantified and monitored. Compliance with the approved appetite is monitored and periodically reported to the Audit and Control Committee, which in turn reports to the Board. The goal is to align the company using appetite as a management and decision-making tool.

The Risk Management process, defined in FRM, includes the identification, valuation, management, monitoring, control, and reporting of risks within the Ferrovial Group.

Identification and assessment are carried out twice a year and involve all business divisions and geographic areas of the Ferrovial Group. The approach is bottom-up, starting at the project level and ascending through Ferrovial’s hierarchical structure via validation exercises up to the Management Committee. Using corporate scales, inherent risk—prior to specific control measures applied to mitigate risk—and residual risk—considering specific control measures—are assessed, analyzing in both cases the likelihood of occurrence and potential impact on the Ferrovial Group through two different dimensions: economic and reputational.

The objective is to prioritize and allocate Ferrovial’s resources correctly, identifying risks with the greatest impact and deviation from the defined appetite. For all risks exceeding a certain threshold on the scale, the process requires action plan identification and implementation. Additionally, during 2025, a risk alert system was developed through Key Risk Indicators (KRIs) for all risks with critical or high impact. Enterprise Risks periodically monitors this information, reporting quarterly to the Management Committee and twice a year to the Audit and Control Committee.

Furthermore, the identification and assessment of emerging risks are carried out annually and are a fundamental part of the function’s forwardlooking vision. This process involves multidisciplinary teams within the Ferrovial Group and is complemented by information from external sources such as Gartner, World Economic Forum or the CRO Forum.

The risk management process is periodically reviewed with the aim of continuous improvement. During 2025, Ferrovial launched a project to update the FRM model, including the implementation of a new GRC system, which will be operational in 2026 and will further develop the valuation, control, monitoring and management of Ferrovial’s risk system. Furthermore, the GRC will serve as a unified platform for other areas that manage or oversee specific risks; where applicable, these domains will be integrated with the FRM. These improvements fulfil the recommendations from the most recent reviews included in the latest internal audit and an external consulting exercise, both conducted in the past two years. Additionally, in collaboration with an external consultant and on an annual basis, a self-assessment and a benchmarking analysis with international sector companies are carried out.

The Board of Directors and Audit and Control Committee perform an annual assessment of the effectiveness of the Risk and Control management systems included under the section 9. CORPORATE GOVERNANCE STATEMENT, STATEMENTS BY THE BOARD ON RISK MANAGEMENT of the Corporate Governance Report. In 2025 they relied on among others, the following resources:

• Its own assessment of the information presented by the Ferrovial Group management, including a self-assessment of the risk management
  system. During 2025, the Audit and Control Committee reviewed Ferrovial’s risk map in May and its subsequent update in December. Additionally,
  it periodically receives information on the evolution of key risks and their mitigation plans.
• Analysis provided by the Internal Audit department.
• External audits regarding reporting risks for both financial and sustainability information.

Ferrovial believes it has a strong risk management culture present across all its divisions, supported by various initiatives such as periodic risk training programs and the inclusion of specific risk management metrics within senior management’s financial incentives. The Board of Directors receives annual specialized and updated training aimed at strengthening, among other things, its risk oversight function. These training sessions, which address key topics such as cybersecurity and sustainability, aim to ensure that Board members have the appropriate knowledge, thereby fostering continuous improvement in decision-making processes and risk management.

MAIN RISKS

The chart shows the most relevant risk events that threaten the execution of Ferrovial’s corporate strategy.