Amadeus IT Holding, S.A. and Subsidiaries - Investor relations at ...

- To analyze, measure and evaluate said risks with regard to their probability and impact,
following procedures and standards that are homogeneous and common to the entire Group in
order to ascertain the relevance thereof.
- To prioritize said risks pursuant to the level of probability/impact and how they could
affect the Group’s activity or operations, and its objectives.
- To control and manage the most relevant risks through adequate procedures, including
contingency plans that are necessary to mitigate the impact of the materialization of risks. This
is achieved more specifically through the designation of ‘risk owners’ and the preparation of
action plans.
- To evaluate and monitor risks, together with action plans and mitigation measures.
The ultimate purpose is aimed at having a record of the most relevant risks which could
compromise the attainment of the objectives of the Group’s Strategic Plan. This risk analysis is
a fundamental element in the Group’s decision-making processes, both in the sphere of
governing bodies as well as in managing business.
The Risk Map at the Group level defines the twenty most critical risks in the areas relating to
the activity and to the attainment of the Group’s objectives. Highlighted among the latter are
technological risks, operational risks that could affect the efficiency of operational processes
and the provision of services, commercial risks which could affect customer satisfaction,
reputational risks and compliance risks.
Due to its universal and dynamic nature, the system allows considering new risks that could
affect the Group as a consequence of changes in surroundings or adjustments of objectives
and strategies. Periodic comparisons of the Risk Map are made which allow visualizing the
degree of progress in mitigating them or, as the case may be, the appearance of new risks or
increase in those already existing.
D.2 Please specify whether any of the different kinds of risk (operational, technological,
financial, legal, reputational or tax-related) that affect the Company and/or Group have occurred
during the year,
NO
If so, please specify the circumstances that caused these and whether established control
systems functioned correctly:
N/A
D.3 Please specify whether any committee or other governing body is responsible for
establishing and supervising these control devices.
If so, give details of its functions.
AUDIT COMMITTEE
The Audit Committee is a consulting body of the Board of Directors, whose principal duties
consist of serving as support to the Board in its monitoring tasks by means of, inter alia, the
periodic review of internal control and risk management systems, in order that the principal
risks may be identified, managed and disclosed adequately.
EXECUTIVE MANAGEMENT COMMITTEE
The Executive Mangement Committee establishes the Group’s global risk policy and, as the
case may be, establishes the management mechanisms that ensure the control of risks within
approved levels.
GROUP INTERNAL AUDIT OFFICE
42