17. The objective of this DR is to enable an understanding of the undertaking's risk management and internal control processes and systems in relation to sustainability reporting.

18. The undertaking shall disclose the scope, main features and components of its risk management and internal control processes and systems in relation to sustainability reporting.

AR 10 for para. 18
The undertaking shall consider the completeness and integrity of the data, and the accuracy of estimation results, as aspects that are relevant in the context of the risk management associated with the reporting process.

The internal control system for financial reporting is already established and is described in detail in the risk management section of the group management report. As the company will publish its first non-financial report in 2026, the risk management and internal control processes for sustainability reporting are not yet fully established, and the necessary internal controls for sustainability reporting have yet to be defined.

The ESG controls will be defined next year as part of the internal control system (ICS) and then implemented. One possible control measure is to set up an organisational structure and to assign responsibilities for ESG reporting. This is supplemented by procedures to check, review and approve the quality of the data used, in particular for the reporting on greenhouse gas (GHG) emissions. These controls aim to ensure accuracy and accountability with regard to ESG data and risk management.

General information on the company's risk management (enterprise risk management, ERM) is available in the 2023 annual financial report. Specific information on the risk assessment approach applied is available in chapter IRO-1 - Description of the processes to identify and assess material impacts, risks and opportunities.