ESG governance is the responsibility of the following bodies:

ESG Steering Committee

Chaired by the Chief Executive Officer, supported by the CFO in the role of Deputy Chair, and meeting on a quarterly basis to define and promote Italo’s ESG policies and decision-making mechanisms, aligning them with the Company’s strategy. The Committee oversees the processes involved in approving ESG programs and initiatives and coordinates with the heads of the departments responsible for assessing technical and economic feasibility. The ESG Steering Committee is responsible for the Sustainability Report and the Sustainability Plan.

ESG Team

It meets at least once a month and has the role of putting forward programs designed to strengthen the Company’s ESG culture and values, in accordance with the guidelines provided by the ESG Steering Committee. The ESG Team is responsible for:

• initiatives relating to environmental protection, cutting emissions and energy use, and health and safety. It overseas the implementation of these initiatives and monitors environmental KPIs to ensure that they are in line with the Company’s goals;

• proposing and overseeing social programs for employees and their families and the community, ensuring their alignment with the Company’s goals;

• promoting awareness of ESG issues through internal communication initiatives.

Internal Audit and Risk Management

Italo’s risk management and internal control system is based on the Framework of Committee of Sponsoring Organizations of the Treadway Commission (the CoSo Report - CoSo ERM) and the Three Lines Model of Institute of Internal Auditors (IIA). Its adequacy is constantly assessed and continuous improvement plans are drawn up with a view to boosting its operational efficiency and effectiveness.

On this basis, Italo has adopted an integrated approach and internal procedures designed to facilitate the information sharing and coordination within the organization. A working group with members representing the second and third lines of defense has been set up to discuss their key findings, to standardize operational plans and produce a periodic report  on internal control and risk management for senior management.

At the reporting date, Italo’s main risks consist of:

• Strategic and business risks: the risk of failing to achieve the Company’s business objectives, including market and social factors;
• Financial risks: risks that can adversely affect Italo’s ability to meet its financial obligations (e.g., credit, liquidity, borrowing and interest rate risks);
• Operational risks: risks caused by flawed or failed processes, due to inadequate or malfunctioning internal procedures, malfunctioning systems and/or external events, including environmental factors;
• Compliance risks: the risk of incurring legal or administrative sanctions or reputational damage.