Non-financial risks identification

Through a "bottom up" approach, the Group involved various corporate units in order to identify the main risks related to the five areas referred to in the Decree: environment, social impact, personnel management, human rights and the fight against corruption and bribery.

The analysis conducted shows that the activity carried out by the Group is exposed to non-financial risks, mainly attributable to safety and security, personnel management, the environment, corruption, human rights and the supply chain. The following chapters include a description of the policies and activities undertaken by the Group to manage them.

Risks related to air navigation services: safety and security

The main risks managed by the Group in terms of safety are strongly linked to the company’s main business activities and are at core of ENAV’s mission. Safety risks refer to the possible occurrence of the so-called aeronautical accident as well as to the reduction of operations in the provision of air navigation services. In addition to these types of risks, there are Security risks, which consist mainly of possible damages to third parties, the company’s personnel, its infrastructures, technological systems and data, and threats to the protection of public security and national defense, both internal and external. Furthermore, they represent possible risks of loss or serious impairment of the availability, integrity and confidentiality of information and violations of the security system by the employees and the external staff.

Personnel Management

The risks to which the Group's employees may be exposed to in terms of health and safety in the workplace are associated with the type of working activity. Such risks may depend on: microclimate, natural and artificial lighting, noise, indoor air quality , video-terminal activities, electromagnetic fields, natural sources of ionizing radiation, fire, work equipment and work-related stress, maintenance activities at height and correlated risks of falling for those who carry out maintenance activities of installed equipment on pylons.

Furthermore, considering the critical nature of the infrastructure and the sensitive objective of each operating site, the Group's personnel is exposed to the risk of potential terrorist attacks and other types of criminal intents.

Other types of risks may arise during the recruitment. Such risks may stem from insufficient advertising of the job postings, lack or poor objectivity in relations to the skills required for the position and with respect to the position level (role and remuneration).

Another risk may lie in the inadequacy of human capital in relation to the operating model and the evolution of strategic business needs. In this respect, it should be noted that during 2017, the company implemented an assessment of the personnel management process, which allowed the identification of risks related to the failure or untimely communication of the training needs for the

preparation of the Annual Training Plan. Such risk may cause the Plan to be incomplete and/or non-aligned to the expressed needs, to be inconsistent with the allocated Budget, and to not be properly communicated to employees. Furthermore, it could also lead to the selection of instructors did not have the proper requirements, as well as to the inadequate monitoring of the attendance recording tools, and finally, to the improper dissemination of information/data relevant for privacy purposes.

The company also identified risks that were generated by external factors related to changes in the reference international and national regulations, which impose a substantial modification to the training programmes and in the technological paradigm that involve the modification/adaptation of the simulation systems in use.

The Group is also subject to the risk of union disputes, which may cause possible strikes deriving, for instance, from claims concerning the articulation of work shifts.

The environment and local communities

As far as the environment is concerned, the main risks associated with the activities of ENAV’s subsidiary companies may result from incorrect management of waste (e.g., used oil and filters from generators, batteries, toner and all electronic components in case of equipment renewal), from pollution due to direct and/or indirect emissions of greenhouse gases resulting from the operation of offices and infrastructures, from the impact on the environment due to the installation of infrastructure (in terms of landscape pollution) and the presence and management of the radiogenic radar components.

Lastly, it should be noted that the surveillance and air navigation systems, installed at the airports and remote sites of the national territory, emit high frequency electromagnetic waves that can reach significant values in the area surrounding the apparatus. Some of these systems are located within or near areas subject to environmental protection.

Corruption

Given the operational national context in which the ENAV Group operates and the international commercial activities it has recently undertaken, the Group has identified the risk of corruption as one of the possible risks to which the Group is exposed.

In particular, the Group identified the potential risk of corruption and bribery. Significant at-risk processes refer to: procurement, sales, financing and contributions, selection and recruitment of staff, corporate transactions of acquisition or sale of investments or the establishment of Joint Ventures.

In addition to these processes, the Group identified specific areas that are susceptible to corruption and bribery risks, namely, gifts, hospitality, entertainment expenses, contributions, liberalities,

donations, non-profit initiatives, payments, brokerage and agency contracts and incentive system for personnel, as well as wider accounting and budget management activities.

Human rights

Given the nature and geographical location of the activities carried out by the Group, there are no particularly significant risks of human rights violations, as defined in the Universal Declaration of Human Rights of the United Nations in 1948. However, there are other risks which fall within the broader definition of human rights and are normally inherent in business activity (managed according to regulatory requirements or dedicated initiatives). Such risk may concern discrimination in the workplace (addressed under the initiatives of the Equal Opportunities Committee) and the violation of the right of privacy and safety of the worker.

Supply Chain

Failure of suppliers to comply with social and environmental regulations and standards could lead to a violation of the ethical principles adopted by the Group.