Downloads

Risk and opportunity management

At Aleatica, our risk management is proactive and agile, enabling us to anticipate threats and leverage opportunities in a volatile global environment.

We maintain our Risk Policies in force and operate under the international ISO 31000 certification, which confirms our commitment to the highest management standards.

Effective risk and opportunity management enables Aleatica to protect and create value, strengthen organisational resilience, support sustainable growth and reinforce stakeholder confidence.

Process for determining the risk appetite of identified risks

Our Risk Management Standard, approved by the Board of Directors and based on COSO ERM and ISO 31000, sets out how we determine risk appetite and risk tolerance. The Board of Directors is responsible for setting the Company’s risk strategy, appetite and tolerances.

Risk appetite is the amount of risk that the Board is willing to accept in order to achieve our objectives. It serves as a reference for business units and functions when defining their controls. For each principal risk, identified using impact and likelihood scales, we set a tolerance level. That level cannot exceed our risk capacity and must be aligned with the appetite. We compare the residual exposure of each risk with its tolerance. Where it exceeds the tolerance, we adopt additional controls or mitigation plans until the exposure falls below the threshold, giving priority to the risks with the greatest deviation.

We accept a risk when it falls within the tolerance or when the cost of mitigating it clearly outweighs the benefit, and we always justify the decision. Avoiding a risk is usually a Board decision, taken when the residual risk remains incompatible with the appetite. The Audit and Risk Committee oversees that exposures remain within the limits.

Risk management governance

Our governance is structured around the three lines of defence model, reinforcing comprehensive oversight led by the Board of Directors and the Audit and Risk Committee. 

As a key milestone, in 2025, we successfully maintained our ISO 31000 certification.

Continuous improvement of the risk and opportunity management system

2025 was a period of consolidation following the merger of the Audit and Risk areas in 2024:

Risk-audit synergy

The risk unit reviews all audit work programs to ensure the focus is strictly aligned with critical risks.

Regulatory update

We have comprehensively reviewed the risk taxonomy and updated the Business Continuity standard, incorporating a new Business Impact Analysis (BIA) format that includes requirements from the new cybersecurity framework.

Dynamic indicators

We incorporated key performance indicators and key risk indicators into the quarterly report for the boards.

Risk culture

In 2025, we strengthened our Risk Culture by adopting the COSO ERM 2017 framework (Integrating with Strategy and Performance) and implementing awareness initiatives at every level:

838

Total hours of risk management training in 2025

508

Webinar Participants on Climate Change Risks 2025

5

Articles in the internal magazine

2,854

Total minutes On-screen informational messages.

4

Risk-related Communications in 2025

2

Articles in external magazines

Workshops

on emerging risks

As part of the Executive Committee’s performance evaluation, their attitude and mindset towards risk management are taken into account, directly influencing their remuneration.

These initiatives contribute to strengthening risk awareness, accountability and decision-making capabilities across all organisational levels.

Risk and opportunity management process

Through our Comprehensive Risk Management framework, the Company continuously identifies, assesses, controls, monitors, and reports on the full spectrum of strategic, financial, operational, and compliance risks and opportunities to which we are exposed as an organisation:

1. Identification

Risks are identified by the owners in each of the Business Units and functional areas. To aid in identification, we have a risk taxonomy (universe) that is regularly updated and reflects the potential risks the organisation faces. This universe encompasses ESG risks, including environmental, human rights, and occupational safety risks, among others. Climate change risks are also included, aligned with the categorisation suggested by the TCFD (Task Force on Climate-related Financial Disclosure). All risks are classified based on the categories defined in the risk taxonomy. This allows us to analyse their exposure, streamline their aggregation and reporting, and show how they interact with other risks, rather than considering them in isolation.

Risks are assessed based on impact and likelihood criteria. The assessment considers three evaluations: an inherent evaluation, prior to the implementation of risk mitigation controls; a residual evaluation, after the implementation of controls; and an objective evaluation, following the implementation of action/mitigation plans. A software tool supports the entire process.
Regarding risks, the Business Units and Functional Areas define control activities and mitigation plans for each identified risk, documenting and monitoring them on an ongoing basis. It is important to note that while we focus on mitigating risks, some of them are beyond our control, such as changes in regulations, political, economic or social conditions, and exchange rate volatility. However, these risks are identified, assessed, and regularly monitored. Each risk is assigned a responsible party, who must ensure its proper management and the adequate implementation of mitigation plans.
The Risk Department, in collaboration with the Business Units and Corporate Functions, regularly monitors the progress of mitigation plans, as well as the behaviour or evolution of risks.
The most significant risks, as well as material changes, are communicated to and reviewed by Executive Management, including regional directors. The status of risks and mitigation actions is reported at least quarterly to the Committees and/or Boards of each Business Unit, the Group, and the Sustainability Committee. Additionally, individuals in key leadership roles within the organisation and its Business Units certify, on a quarterly basis, their understanding of the risks, controls, and mitigation measures (within their area of responsibility) that help control or reduce their exposure.

Key risks

Our organisation faces a range of risks and uncertainties that could significantly impact our performance and the achievement of our objectives. Below are the most significant risks identified so far.
Risk
Description
Mitigation measures
Changes to and/or rebalancing of concessions

Risk that changes to contractual terms or the economic-financial rebalancing process are not managed properly, affecting the concession’s profitability or viability.

Contract management with rebalancing clauses, rate reviews, and dispute resolution; active management with the grantor; financial control of works; review of financial models; crisis management plan; and a community/social program.
Construction progress
Risk of delays in construction or infrastructure expansion projects due to internal management, contractors, permits, or securing rights of way, which could affect delivery times and commissioning.
Construction plans with milestones and critical paths; change management; contractor evaluation and penalties; right-of-way monitoring; qualified staff; internal audits; and follow-up meetings.
Cost overruns
Risk that actual costs significantly exceed approved budgets due to poor planning, scope changes, price volatility, or contractor claims.
Monitoring of actual versus approved budgets; contract and change management; contractor evaluation with penalty clauses; and contingency provisions.
Business concentration
Risk of being overly dependent on a limited number of concessions, markets, or countries, which increases vulnerability to adverse changes in those segments.
Analysis of opportunities for expansion and partnerships; impact analysis in the event of a drop in traffic, regulatory changes, or defaults.
Infrastructure integrity/maintenance
Risk of deterioration, failure, or collapse of physical assets due to inadequate maintenance, design flaws, end of useful life, or excessive loads, resulting in interruptions, repair costs, or loss of value.
Major and minor maintenance programs; periodic technical inspections; insurance coverage; asset performance indicators; life cycle inventory; load controls.
Business continuity
Risk of critical process disruption and the inability to recover them within established timeframes and service levels.
Business continuity framework (BCP, DRP, crisis management); insurance program; maintenance and monitoring programs.
Estandares
Climate change (physical impacts)
Risk of infrastructure damage and operational disruptions due to acute weather events (floods, hurricanes, fires) or chronic ones (sea level rise, extreme temperatures).
Awareness and training; climate adaptation assessments; emission mitigation; physical and transitional risk manuals; continuity framework; insurance program.
Customer safety
Risk of accidents or incidents on managed infrastructure that result in injury or death to drivers, passengers, or pedestrians.
Road safety strategy with PRA and a Safe System approach; analysis of sections with a high concentration of accidents; signage; tools for monitoring accident rates; and training campaigns.
Cybersecurity
Risk of unauthorised access, data theft, system disruption, or extortion through cyberattacks, affecting the confidentiality, integrity, and continuity of operations.
Firewalls and anti-malware; Active Directory; internal policies for people using the system; penetration tests and audits; disaster recovery plan (DRP); awareness program; technology refresh.
Economic – political – social environment
Risk of a negative impact on results or operations due to adverse changes in the macroeconomic, political, or social environment (recessions, protests, strikes, regulatory changes, etc.).
Monitoring of the fiscal, regulatory, and geopolitical environment; scenario analysis and stress testing; geographic diversification; hedging financial instruments; lobbying; participation in forums; continuity plan and crisis management.

Emerging risks

Aleatica faces emerging risks, that is, new or uncertain risks whose exposure may increase owing to changes in the external environment. These scenarios may affect the organisation in the medium and long term and therefore require constant monitoring.

Emerging risks are assessed periodically through horizon-scanning exercises that examine the potential impacts on Aleatica’s business model, infrastructure assets, stakeholders and long-term strategic objectives. The emerging risks of greatest relevance to our business include:

The use and regulation of artificial intelligence

AI offers opportunities to enhance efficiency and innovation, but it also carries significant risks, such as algorithmic biases, a lack of transparency, job displacement, security and privacy vulnerabilities, as well as ethical and regulatory dilemmas. Responsible AI management requires preventive controls, impact assessments, and ongoing monitoring of new regulations.

Social and environmental challenges have intensified, directly impacting companies’ operations and reputations. Factors like climate change, the scarcity of natural resources, evolving sustainability regulations, and the growing expectations of communities and costumers call for strategies focused on adaptation, compliance, and transparent communication.
The rise and sophistication of cyberattacks, driven by digitalisation and AI, pose a growing risk to business continuity and information protection.
The global regulatory environment is becoming increasingly demanding, especially in terms of data, sustainability, and human rights, forcing companies to continually adapt their processes and reporting.

International tensions and the reconfiguration of supply chains are impacting costs, lead times, and access to key resources for infrastructure projects.

These risks, along with others such as social polarisation, economic volatility, and the challenges associated with the energy transition, require proactive, comprehensive, and dynamic management to anticipate and mitigate their impact on the organisation.

In 2025, Aleatica prioritised two emerging risks:

the use and regulation of artificial intelligence, and geopolitics and supply chains.

Name

AI use and regulation

Category

Technological

Description

As AI adoption increases across the organization, Aleatica has established a comprehensive governance and risk management framework designed to ensure that AI technologies are deployed in a manner consistent with the Company’s values, regulatory obligations and risk appetite. This framework includes a Responsible Use of Artificial Intelligence Policy, a dedicated Artificial Intelligence unit, and regular oversight through the Management Committee and the Audit and Risk Committee.

Impact

The Company has implemented processes to identify, inventory and classify AI initiatives, supported by a formal AI risk assessment methodology that evaluates potential impacts related to compliance, privacy, cybersecurity, data quality, transparency, bias and human oversight. AI initiatives are subject to multidisciplinary review involving business, technology, legal, privacy, cybersecurity and risk management functions, ensuring that risks are appropriately identified, assessed and mitigated before deployment.

Mitigation actions

In addition, Aleatica promotes awareness and training programs to foster the responsible use of AI across the organization. The Company continuously monitors regulatory developments and emerging risks associated with AI to ensure that its governance framework remains aligned with evolving legal requirements and industry best practices. Through these measures, Aleatica seeks to capture the benefits of AI-driven innovation while safeguarding human rights, data protection, transparency and stakeholder trust.

Name

Geopolitical instability and supply chain disruption

Category

Geopolitical

Description

International tensions and the reconfiguration of global supply chains represent a growing external risk for ALEATICA’s infrastructure projects. Together with related pressures such as social polarisation, economic volatility and the challenges of the energy transition, these dynamics require proactive, comprehensive and dynamic risk management to anticipate their potential impact on the organisation.

Impact

Armed conflicts, sanctions, or trade tensions between countries can disrupt the flow of critical inputs, driving up costs and creating shortages. The concentration of suppliers in politically unstable regions increases vulnerability to strikes, nationalizations, or abrupt changes in tariffs and export regulations. Restrictions on strategic raw materials can paralyze operations or suddenly increase production costs. Reshoring or nearshoring forced by geopolitical pressures implies unplanned investments and contract renegotiations. Additionally, exposure to suppliers linked to human rights violations or forced labor generates reputational and compliance risks under frameworks such as CSRD/ESRS or value chain due diligence. Currency volatility stemming from geopolitical crises also affects margins and long-term financial planning.

Mitigation actions

Monitoring and analysis of the fiscal, regulatory, macroeconomic and geopolitical environment; active engagement with regulators and industry associations; regulatory updates through external advisors; participation in industry forums and associations; supplier due diligence and monitoring processes; and periodic assessment of potential impacts on operations, projects and critical suppliers.