## At Carlsberg we consider effective risk management an integral part of our business operations as it reduces uncertainty, helps the Group achieve its strategic ambition and facilitates value creation for all stakeholders. 

Carlsberg’s comprehensive approach to risk management involves the identification, assessment, prioritisation and economic management of risks that might prevent the Group from achieving its strategic ambition. The Risk Management Policy sets out the requirements for the risk management pro- cess in the Group. 

RISK MANAGEMENT FRAMEWORK Carlsberg’s risk management framework is a systematic process of risk identification, analysis and evaluation, providing a com- prehensive overview of strategic risks and enabling the Group to mitigate and monitor the most significant risks. 

Our risk management approach is top-down and covers all major entities across regions, markets and functions. The framework is based at the strategic level to ensure that 

the risks related to carrying out the Group’s strategy – both short-term and long-term – are identified and that relevant preventive actions are taken. 

## RISK MANAGEMENT GOVERNANCE STRUCTURE 

Ultimately, the Supervisory Board is respon- sible for risk management. The Supervisory Board has appointed the Audit Committee to act on behalf of the Supervisory Board. The Audit Committee monitors the overall strategic risk exposure and the individual risk factors associated with the Group’s activities. Monitoring is mainly performed in connec- tion with the quarterly reporting process. The Audit Committee adopts guidelines for key areas of risk, monitors developments and sees that plans are in place for the manage- ment of individual risk factors, including commercial and financial risks. 

The Executive Committee (ExCom) is responsible for reviewing the overall risk exposure associated with the Group’s activ- ities. Strategic risks are assessed according to a two-dimensional heat map rating system that estimates the impact of the risk on net revenue or brand/image and the likelihood of the risk materialising. Based on this as- sessment, ExCom updates the existing heat map to reflect changes in perceived risks to the business, and a number of high-risk issues for the coming year are identified. In addition, any risks in relation to the Group strategy for the subsequent three-year period are identi- fied and appropriate actions are agreed upon. 

In accordance with the Risk Management Policy, ExCom identifies owners of short- term and long-term risks, who are then responsible for mitigating the risks through a programme of risk-reducing activities. 

Local entities and Group functions are responsible for the identification, evaluation, qualification, recording and reporting of the management of strategic risks at local level. Local-level risk assessment follows the same principles as Group-level risk assessment and is based upon the heat map described above. The local risk review is carried out regularly, and, following the review, local risk owners are appointed and given responsibility for mitigating the risks through a programme of risk-reducing activities. 

A formal procedure is in place for ongoing identification, assessment and reporting during the year of any new or emerging risks that are determined to have a material impact upon the business. 

Group Internal Audit is responsible for fa- cilitating and following up on risk-reducing 

