Opportunity and risk report

Opportunities

thyssenkrupp defines opportunities as events or developments that enable us to exceed the group’s forecasts or other targets. Opportunity management encompasses all measures required for the systematic and transparent management of opportunities. As it is integrated with the strategy, planning and reporting processes, opportunity management is an important element of the strategic and value-based management of the group.

Opportunity management process

In the annual planning process the segments describe bands, for instance for their earnings and liquidity targets (adjusted EBIT, free cash flow before M&A) in the planning period. In this way, they take account of the opportunities and risks of their businesses. The assessment addresses, among other things, market and technology trends which in some cases remain relevant far beyond the forecast period. In the subsequent monthly reports the segments update the earnings and liquidity projections as well as the corresponding opportunities and risks in the current fiscal year. The graphic “Opportunity and risk reporting at thyssenkrupp” in the “Risks” section of this report shows how these elements are integrated into the standard reporting system.

Management of our opportunities is a task shared by all relevant decision makers – from the Executive Board of thyssenkrupp AG to the segment management boards and the management of the companies through to officers and project leaders with local market responsibility. This structured involvement of numerous experts in decision-making processes within the group aims to reliably identify and systematically exploit opportunities.

Opportunities for the group

The main opportunities for thyssenkrupp derive from driving forward with our strategic realignment and consistently implementing the future model for the alignment of the group based on the stepwise transition of all businesses to stand-alone solutions that are open to third-party investment. We are convinced that establishing an independent organization for the segments – with the advantage of their own access to the capital markets and the option for third-party investment – will enable them to leverage their full value potential and provide more options for making investments, developing markets and achieving further growth.

Our strategic alignment is focused on leveraging the opportunities harbored by key future-oriented areas with significant growth potential in the medium to long term. Environmental issues play a central role here. On the path to climate neutrality, hydrogen technologies, green chemicals, renewable energy, e-mobility and supply chains are relevant focus areas. We see sustainability as an opportunity to work even more closely with our customers and for further innovations.

Alongside the products and solutions whose development we are driving forward for our customers and partners, we are working in parallel on the decarbonization strategy of our own group. For example, with the hydrogen-capable direct reduction plant that is currently under construction for Steel Europe we are seeking to become a major player in the European hydrogen economy and make Duisburg a key hydrogen infrastructure site.

In the second phase of the APEX performance program launched in October 2024, we see further opportunities for thyssenkrupp based on structural measures to improve efficiency, optimize business models and adapt to the markets and on the consistent implementation of necessary restructuring measures.

In addition, all businesses have operational opportunities in their specific markets.

A key determinant of the future business performance of Automotive Technology is the development of personal mobility. In the wake of the automotive sector’s ongoing transformation, size and innovative strength are increasingly becoming key success factors. We expect the new business booked to result in more or less stable demand for our products and technologies and anticipate additional opportunities if demand increases.

The aim at Decarbon Technologies is to contribute to the green transformation of industry and help shape it through technological advancements. To this end we are developing technologies that can significantly reduce the greenhouse gases generated in production processes. We also see opportunities to enhance and further extend our position as a partner for planning, development and services for industrial plants and systems.

In the case of Materials Services, wide-ranging opportunities are arising from growing customer requirements in respect of greater flexibility and resilience in supply chains, for example. Thanks to global market access and extensive sector and process know-how, we are convinced that we have enormous flexibility and scope – from procurement through processing to supply chain management – to manage even complex flows of goods in an intelligent and resource-saving manner.

The strategic realignment of Steel Europe is built on an industrial concept with a reduced operating point and profitable products in future markets, e.g., for electric powertrain technologies or the transformation of the energy system, and on more climate-saving production. The investments made in the course of implementing the realignment, especially at the Duisburg site, are the backbone of this transformation. They will provide us with further opportunities in the form of the highly precise, flexible and efficient production of premium steel, especially for use in e-mobility and energy transition applications.

Based on the significant year-on-year growth in the order backlog, Marine Systems has further opportunities to continue strengthening its market and competitive position. Following the spin-off of a minority interest in TKMS, the segment aims to establish a sound basis for further growth in the maritime defense market. Integration of the Wismar site is of particular importance to securing and processing the good order situation and also offers new potential.

The increased use of artificial intelligence (AI) harbors additional opportunities in all businesses but these cannot yet be predicted with any certainty. It is conceivable, for example, that AI will make it easier to respond to specific customer requirements or optimize logistics and production processes.

If economic and regulatory conditions develop better than planned and our businesses continue to improve their competitiveness worldwide, we see opportunities in all segments to moderately exceed the forecast performance targets. The basis for this are further investment, new products and increased digitalization at all sites.

Further details of our corporate strategy, our global research and development activities and the related opportunities can be found in the subsections headed “Targets and strategy” and “Technology and innovations” in the section headed “Fundamental information about the group.”

In our initiatives and development projects we are also always guided by the group’s financial scope. Unfavorable economic conditions may prevent us from fully or directly exploiting existing opportunities. Information on this and on other risks can be found in the subsection headed “Risks.”

Risks

thyssenkrupp defines risks as events or developments that reduce our ability to achieve our forecasts and targets. We also consider possible negative impacts on non-financial aspects such as environmental and climate protection. Risk management encompasses all measures involved in the systematic and transparent management of risks. With its link to planning and reporting processes in controlling, it is an important element of value-based management and goes beyond the early identification of risks required by law. Efficient, forward-looking risk management therefore also serves the interests of our capital providers and other stakeholders.

Overall assessment by the Executive Board: no risks that threaten thyssenkrupp’s ability to continue as a going concern.

Our risk management system with structured processes contributes to efficient management of the group’s overall risks. From the present standpoint, there are still no risks that threaten the company’s ability to continue as a going concern. This statement is based on an analysis of risk bearing capacity at group level.

Risk strategy and risk policy

Our risk strategy is focused on securing the existence of thyssenkrupp in the long term and sustainably increasing the value of the company. Therefore, risks threatening the company’s ability to continue as a going concern must be avoided.

Our overarching Governance, Risk and Compliance (GRC) Policy defines basic principles for corporate governance and risk management at thyssenkrupp as a global framework. The universally applicable principles of the group’s risk policy as a framework for meeting the requirements of proper, consistent and proactive risk management in the group are set out in detail in the group policy Risk and Internal Control. The objectives of risk management at thyssenkrupp enshrined in these principles include increasing risk awareness in all group companies and establishing a value-based risk culture. To this end, we analyze risks and opportunities transparently and incorporate them systematically into business decisions.

Risk management process

We have aligned thyssenkrupp’s risk management system with the internationally recognized COSO (Committee of Sponsoring Organizations of the Treadway Commission) model, integrated it with our internal control system and other management systems, and continue to develop it to reflect new requirements. Our corporate governance statement outlines the interaction of the individual governance systems at thyssenkrupp on the basis of our GRC Policy. Details of individual responsibilities in the risk management process and other requirements are defined uniformly in the binding group regulation Risk and Internal Control.

The design of our various risk management tools ensures that the sub-processes are integrated in a continuous risk management loop and all risk managers are involved appropriately in the risk management process. Our methods and tools to identify, assess, control and report risks are implemented throughout the group and we continually develop them when new requirements arise.

We have taken account of new risk management requirements arising from sustainability reporting in accordance with the CSRD (Corporate Sustainability Reporting Directive) by expanding our risk catalog – structured by risk causes, categories and effects – to include the relevant environmental, social and governance aspects. The risk inventory findings are used in the double materiality assessment, the results of which are examined for their relevance to the risk inventory and discussed with the risk managers.

The organizational anchoring of corporate risk management in controlling facilitates holistic risk management integrated with planning and reporting processes. The following graphic outlines our approaches:

Risk identification

The operational opportunities and risks not included in the updated monthly projections or in the annual budget are part of standard segment reporting. Regular discussion of opportunities and risks in established controlling meetings, which include the CFO, is a key element of integrated business management during the year and of corporate planning because it highlights bands for the performance indicators of adjusted EBIT and free cash flow before M&A related to the current and the subsequent fiscal year.

All consolidated companies worldwide use a standardized IT risk management application for structured documentation of risks and to prepare risk maps. The assessment period used for the risk map goes beyond the period covered by the forecast and covers the entire three-year operational planning period; this provides transparency in the local risk assessments over several years. The process-based regular reporting and updating of risks at local level also ensures that risk awareness remains high at thyssenkrupp.

Risks that have already been taken into account through provisions are also part of the standardized analyses and groupwide risk management reporting.

Our internal control system is designed to reduce procedural risks in business workflows. Further details can be found in the section on risk control.

Risk assessment

The identified risks are assessed uniformly using central principles. We define risk classes on the basis of probability of occurrence and impact on the performance indicators of adjusted EBIT and free cash flow before M&A in the planning period. If there are variances in the earnings and liquidity perspectives for individual risks, the higher assessment is used for the overall risk assessment. At the end of the fiscal year, the main individual risks are aggregated at group level and bundled in defined risk classes, which we address in the following sections. They are then assigned to the risk classes “high,” “medium” or “low” as shown in the following graphic.

Furthermore, we conduct a qualitative assessment of the possible negative impacts of our own actions on non-financial aspects such as environmental and climate protection.

Risk control

All consolidated companies are required to formulate risk control measures for the individual risks, systematically track their implementation and monitor their effectiveness.

Risk presentation at thyssenkrupp is by the net method, i.e. taking into account already realized, effective risk control measures that reduce gross risk.

Our goal is to prevent undesired risks from arising through the binding stipulation that our risk policy principles are followed and that no transactions are entered into that infringe codes of conduct or other groupwide policies. Binding standards are in place for all group companies to ensure risk prevention always stays at an appropriately high level. These standards are developed by experts from all areas of the group and updated as required. Internal and external auditors regularly check compliance with these standards.

We transfer risks in cases where the financial scale of a risk can be minimized by measures such as insurance policies. Risk transfer to insurers is handled centrally at thyssenkrupp AG. The scope and design of insurance cover are determined on the basis of structured risk assessments.

We reduce risks by taking appropriate targeted measures and for example by continuously improving our internal control system. Further information can be found in the following subsection.

Internal control system

In line with the corresponding COSO framework, the internal control system comprises all the systematically defined controls and monitoring activities aimed at ensuring the security and efficiency of business management, the reliability of financial and non-financial reporting, and the compliance of all activities with laws and policies. An effective and efficient internal control system is key to managing risks in our business processes successfully. The structure of the internal control system at thyssenkrupp covers all material business processes and goes beyond the controls for the accounting process.

For example, various monitoring measures and controls within the accounting process contribute to compliant financial reporting. For consolidation we use a system based on standard software. In this way we ensure consistent procedures, which reduce the risk of misstatements in our accounting and external reporting. Appropriate segregation of duties and application of the dual-control principle reduce the risk of fraudulent conduct. These coordinated processes, systems and controls help ensure that our accounting is reliable and complies with IFRS, the German Commercial Code (HGB) and other relevant standards and laws.

In the reporting year, new regulatory requirements led us to expand our internal control system to include the relevant aspects of the sustainability report. We are currently implementing the same methods for documentation and testing controls for non-financial matters as we do for financial matters.

We perform regular system backups on IT systems in order to avoid data losses and system failures. The security strategy also includes system controls, manual spot checks by experienced employees, and custom authorizations and access controls.

We continuously develop the requirements placed on the internal control system and adapt the control landscape to changing processes using a standardized risk control matrix and a structured self-assessment process. In the interests of comparable groupwide transparency of the local internal controls, the use of uniform IT software is mandatory in all units of the company.

To conclude the monitoring activities performed during the year, at the end of the fiscal year the segments confirm the correctness and completeness of the documentation of the internal control system for their sphere of responsibility through an In Control Statement.

Roles and responsibilities

Risk management at thyssenkrupp is organized as a combined top-down/bottom-up process. The binding process and system standards formulated centrally at group level apply to all operating entities. Responsibility for recording, measuring and controlling risks along the value chain lies at local level with the functional managers in the operating entities.

The group’s material risks are discussed and validated in meetings of the interdisciplinary Risk and Internal Control Committee (RICC) held once every quarter and chaired by the CFO. At the same time, the RICC meetings serve to prepare the subsequent risk reporting to the Executive Board and Audit Committee. The RICC meetings are attended by all key officers responsible for governance, risk and compliance in the group.

Employees responsible for risk management and the internal control system receive training as required. We also use our groupwide web-based IT applications to deliver targeted information and training material on a permanent basis.

Internal Auditing checks the effectiveness of the internal control and risk management systems and is integrated in the overall process. Internal Auditing uses the results of the risk inventory, the risk-control matrix and the self-assessment process as the starting point for its risk-based audit plan. The internal audits structured on this basis contribute to the efficient monitoring of the risk management system and internal control system and deliver insights to further improve risk management at thyssenkrupp.

Our standardized risk management processes are vital to ensure that the Executive Board and Supervisory Board are informed promptly and in a structured way about the group’s current risk situation. Nevertheless, despite comprehensive risk analysis, the occurrence of risks cannot be entirely ruled out. For our assessment of the appropriateness and effectiveness of the risk management system and the internal control system, please refer to the information in the corporate governance statement.

Risk categorization

We have pooled the types of risks relevant to thyssenkrupp in the following categories:

• Risks from external parameters

• Financial risks

• Legal risks and compliance risks

• Risks from operating activities

We deal in detail with these categories and explain and assess the risks in the following subsections. The risks apply across the group and thus to all businesses. Should individual risk categories display segment-specific aspects, we name these segments in the individual subsections. Compared with the prior year, the risk assessments revealed changes for valuation risks and investment risks.

Risks from external parameters

The external risks mainly include macroeconomic risks and regulatory risks.

Macroeconomic risks – Economic risks for our business models exist when positive impetus is not forthcoming from the global economy and markets of relevance for thyssenkrupp and the macroeconomic development may be below the economic forecasts. Our current assessments in this regard, which were used in planning, are presented in the subsection headed “Macro and sector environment” in the “Report on the economic position.”

Global economic development remains subject to considerable uncertainties. Geopolitical conflicts – especially in Ukraine, the Middle East and between China and Taiwan – are having a negative impact on international markets. Added to this are the restrictive trade policy measures adopted by the USA. This country’s tariffs on key partners such as the EU and China are detrimental to existing supply chains and an obstacle to international dialog, leading overall to a more restrictive investment climate on the part of our customers.

Any escalation of conflict situations could additionally increase market volatility. Moreover, continuing fluctuations in energy and raw material prices are having a substantial negative impact on economic development, especially in industrialized countries. In addition, natural events caused by climate transition represent on ongoing threat in many regions and could also have a negative impact on production and global supply chains.

As a matter of principle, we try to pass on higher tariffs to customers in order to preserve our competitiveness and supply capability. Moreover, Steel Europe in particular is lobbying government for a more efficient and proactive use of existing trade protection instruments and for additional measures to relieve the pressure caused by imports from countries with overcapacities, such as China.

In order to minimize the risks that might arise in connection with disruptions to the supply chain in the form of bottlenecks, increasing prices for raw materials and intermediates and higher transportation costs, we are increasing our focus on localization on both the supply side and production side, further diversification of suppliers and distribution channels, the establishment of direct strategic and long-term relationships with suppliers and the increase of our own inventories.

The performance of our businesses is closely tied to the global development of automotive markets, which are subject to risks from intense competition. A growing number of Chinese companies in particular are pushing onto the European market. We are seeking to counter these market developments by way of stringent performance measures, greater flexibilization of our processes, the relocation of capacities to countries with lower production costs, a concentration on market segments with lower competitive pressure and, where necessary, capacity adjustments – in addition to our continuous optimization and long-term efficiency improvement measures. We are also investing in growing our technological expertise and optimizing our global production network. By extending our range of services, we want to reduce our dependence on market fluctuations and increase our margins.

We continuously monitor economic development and corresponding country-specific conditions based on wide-ranging early warning indicators. In a negative-case scenario integrated into the planning process, we simulate the impacts of continued weakening of the economy on our business models to enable us to take action and minimize risks at an early stage when necessary.

If the growth of the economy as a whole and of the relevant markets were weaker than forecast in our plans as a result of these risks, the assessment of the individual economic risks for thyssenkrupp would be “high,” reflecting the persistently high uncertainty in a highly volatile environment.

Regulatory risks – New laws and other changes in the legal framework at national and international level could harbor risks for our business activities if they lead to higher costs or other disadvantages for thyssenkrupp compared with our competitors, either directly or with regard to our value chain. Overall the regulatory risks for thyssenkrupp are still classified as “medium.”

In our energy-intensive operations, particularly at Steel Europe, we face regulatory risks on the global markets if additional costs are imposed under energy- and climate-related rules which we are unable to pass on to our customers on the international market in full or at all, or if there is no longer demand for our products and technologies in the long term. Possible reductions in national funding programs also harbor risks for some of our businesses. This applies to the wind energy sector, for example, the development of which is dependent on factors such as political objectives, national incentive programs for renewable energies or the actual implementation of national climate targets.

thyssenkrupp supports effective climate protection efforts and a sustainable energy transition in which climate protection, security of supply, and competitiveness are equal priorities. We support the relevant discussion processes on regulatory efforts through close working contacts with the relevant national and international institutions and cooperate with industry associations at all levels to reduce possible risks.

The move towards an energy system dominated by renewables in Germany is creating major challenges and costs for energy-intensive industries in general and the steel sector in particular. For its green transformation the steel industry needs to be able to rely on the availability of sufficient quantities of electricity and hydrogen from renewable sources at competitive prices at all times. We are actively monitoring the current debate on the key aspects of the electricity market of the future because they are of central importance to our energy-intensive industry. On the political front, we are advocating for competitive electricity prices to safeguard the economic stability and future viability of the industry.

The EU market for steel and other products in the value chain is largely unprotected. The punitive tariffs imposed by the USA on steel (50%) has put a significant proportion of exports to the USA at risk and massive diversionary effects are maximizing what is already strong pressure on imports. The EU’s existing trade protection instrument – known as the Steel Safeguard – will expire in mid-2026 and it is currently hard to gauge whether the EU will replace it with a new and more effective successor.

The EU’s CO₂ border adjustment mechanism is also intended to help increase the fairness of competition in the steel business. To ensure its future effectiveness, we are advocating for a functioning approach and are pressuring the EU and the German government to extend application of the mechanism to processed steel-intensive products and to make other adjustments. In connection with the Carbon Border Adjustment Mechanism (CBAM), the current free allocation of CO₂ certificates in the EU emissions trading system is to be phased out gradually, a move that would further exacerbate competitive disadvantages vis-à-vis international rivals.

Moreover, we at Steel Europe only receive energy and CO₂-related funding from the EU in compensation for electricity prices if we reinvest a part of it in environmental measures – especially energy efficiency measures – which must be validated by an authorized external auditor. For this reason, we have adapted the processes in our certified energy management system. If our environmental measures in this respect are not recognized by the relevant authorities, there is a risk that we could lose any funding that we have already received or applied for.

Financial risks

The central responsibilities of thyssenkrupp AG include coordinating and managing finance requirements within the group and securing the financial independence of the company as a whole. This involves optimizing financing and limiting the financial risks.

Default risks – To minimize default risks from operating activities and the use of financial instruments, we only conduct such transactions with contractual partners who can meet our internal minimum requirements. The credit risk management function defines minimum requirements for the selection of contractual partners. The credit standing information is subject to appropriate, continuous monitoring which permits the credit risk management function to intervene at an early stage to minimize risks. Outstanding receivables and bad debt risks in connection with supplies and services are constantly monitored by our subsidiaries; in some cases they are additionally insured under commercial credit policies. The credit standing of key account customers is monitored particularly closely. Further details are reported in Note 22.

Liquidity risks – To secure the solvency and financial flexibility of the group at all times, we maintain committed credit facilities and cash funds on the basis of multi-year financial planning and rolling monthly liquidity planning. We use the cash pooling system to allocate resources to group companies internally according to requirements.

Market risks – To hedge market risks (currency, interest rate and commodity price risks) we use derivative hedging instruments.

To contain the risks of our numerous payment flows in different currencies – in particular in US dollars – we have developed groupwide policies for foreign currency management. All group companies are required to hedge foreign currency positions at the time of their inception. They mainly use our central hedging platform for this. Translation risks arising from the translation of foreign currency positions are generally not hedged.

Central interest rate management concentrates on controlling and optimizing the risk of changing interest rates on funds invested and borrowed. For this, regular interest rate risk analyses are prepared, the results are fed into our risk management system.

Taking into account the control measures selected, the financial risks outlined above are still assessed as “low.”

Valuation risks – For the success of our strategic realignment it is important to have an organization in which the businesses can develop optimally. Therefore, portfolio measures and restructuring of existing business activities are possible; these are generally associated with execution risks.

In addition, our strategic businesses are regularly tested for impairment. The risks identified in this category, which do not affect the performance indicators of adjusted EBIT and free cash flow before M&A and only become visible in net income, are currently considered to be “medium.”

Legal risks and compliance risks

Legal and compliance risks include litigation risks, compliance risks and risks from trade restrictions.

Litigation risks – We define litigation risks as risks in connection with pending or imminent lawsuits or regulatory or administrative court proceedings brought against thyssenkrupp. thyssenkrupp uses a software tool with which litigation risks are systematically identified, categorized, evaluated and reported to the Executive Board and the Audit Committee on a quarterly basis as part of the established risk management process. We carefully examine claims asserted by third parties for merit. Legal disputes in and out of court are supported by our in-house counsel and where necessary external counsel.

Currently we still classify the litigation risks both individually and cumulatively as “medium.” Cumulative litigation risks are combined risks from lawsuits brought by numerous claimants and from regulatory proceedings against thyssenkrupp which relate to the same matter and can be classified as a single litigation risk. Information on further litigation risks for which we have recognized provisions or which are classified as contingent liabilities is provided in Notes 16 and 21.

Compliance risks – We operate a strict compliance program focused on reducing risks in the areas of corruption prevention, antitrust law, data compliance, anti-money laundering and trade compliance because violations in these areas have enormous potential to cause financial and reputational damage. We therefore continue to classify these risks overall as “high.” Details of the compliance program and further information on the compliance organization can be found in the “Compliance” section.

Risks from trade restrictions – Due to our global business activities, we are exposed to possible risks stemming from trade restrictions, special monitoring measures, far-reaching economic sanctions against certain countries, persons, businesses and organizations, as well as other protectionist or politically motivated restraints.

These restrictions can impede our business activities in individual national markets. Moreover, violations could lead to severe penalties, sanctions, reputational damage and claims for compensation. We therefore take strict care to comply with the applicable regulations and other trade restrictions and consider the probability of occurrence to be low.

Risks from operating activities

Risks from operating activities include procurement risks, production risks, sales risks, order risks, risks associated with information security and personnel risks.

Procurement risks – To manufacture our products, we procure raw materials and other starting materials and also require energy. The purchase prices for key products may vary considerably depending on the market situation and could have a significant impact on our future cost structures if we are unable to pass these prices on to our customers or are able to do so only in part or after some delay.

The development of electricity and gas prices caused by the transition to an energy system dominated by renewables has created major challenges for energy-intensive industries such as the steel industry. The risk of rising energy prices is mitigated by structured energy procurement. In addition, in all our businesses we are working to reduce our dependence on gas, save energy and reuse residual materials. The risk of rising wholesale electricity prices is being countered by the supply of electricity produced primarily in-house.

There are also risks of logistics and supply chain disruption. These include supplier insolvencies, poor quality, production problems at some suppliers and a general shortage of certain starting materials. Disruption to transportation capacities could affect our production and jeopardize our ability to meet contractual obligations to our customers. We consider the individual risks identified in this category to be “medium.”

We aim to counteract procurement risks through margin-securing measures, alternative procurement sources, a diversification of the supplier structure and, where possible, strategic partnerships with suppliers. In addition, we work continually to systematize, optimize and digitalize our logistics processes and the entire supply chain.

We have a wide range of compensation measures to reduce the risks to the supply of starting products for Steel Europe resulting from increasingly extreme weather conditions. Examples are shifting some goods to modes of transport that are not affected or using additional equipment when loading and unloading.

In case, despite this, energy or starting products should not be available or not be available on time, we have developed business-specific contingency plans as part of our business continuity management in order to limit the consequences as far as possible.

Production risks – Unfavorable constellations and developments at our sites could expose us to a risk of business interruptions and property damage. In addition to the cost of repairing damage, there is above all the risk that a business interruption might result in production losses and thus jeopardize the fulfillment of our contractual obligations towards our customers. Moreover, we cannot rule out unplanned earnings impacts due to ongoing technological innovations and improvements and the ramp-up of new plants – which result in new or changed processes.

We work to counter these risks through regular and preventive maintenance measures and through modernization and investment in our machinery and production facilities. There are business continuity plans and emergency and crisis plans to deal with possible business interruptions. These set out measures to remedy the damage. In addition, we take out appropriate insurance and therefore transfer risks to external service providers. The remaining financial risks in this category are still classified as “medium.”

Accident risks and the related risk of harming people cannot be completely ruled out in the production, installation, maintenance and use of our products. A safety-oriented corporate culture and the extensive occupational health and safety measures implemented by our occupational safety organization are intended to help minimize the accident risks faced by our employees and subcontractors.

In our production plants and during transportation, there are process-related environmental risks relating to air and water pollution. Furthermore, some of the group’s real estate no longer used for operations is subject to risks from past pollution and mining subsidence. To minimize risks thyssenkrupp invests continuously and sustainably in environmental protection and scheduled remediation and maintains a close dialog with authorities, local communities and political representatives. We recognize adequate provisions for dealing with past pollution.

Sales risks – The risks described in the subsection headed “Macroeconomic risks” may diminish our business prospects on individual markets and therefore lead to sales risks. When developments become established, we carry out market-oriented adjustments or relocate capacities.

We counter sales risks resulting from dependence on individual markets and industries by focusing our businesses systematically on the markets of the future. As a company with leading engineering expertise, thyssenkrupp operates globally, maintains long-term customer relationships and seeks active strategic market and customer development. Our diversified product and customer structures help ensure that we remain largely independent of regional crises on our sales markets. In an attempt to lessen dependency on individual markets, we are expanding our customer base, developing new products and technical innovations and strengthening our international presence.

Product and process quality and compliance with the corresponding quality requirements and associated warranty and product liability obligations to our customers have top priority for us. However, we cannot rule out the possibility that we will not always be able to meet these quality standards. We still classify the risks arising from this as “low” and we counter them with extensive measures in connection with production and quality assurance systems.

Order risks – Particularly in the plant engineering business of Decarbon Technologies and the marine business, one of the core challenges is the execution of major contracts involving a high degree of complexity and long project run times. Technological risks are associated in particular with a small proportion of “first of their kind” contracts. Cost overruns and/or delays in individual project phases and differences in the interpretation of contracts cannot be ruled out. We classify individual identified risks in aggregate as “low.”

In the calculations for new orders, we endeavor to anticipate possible risks in the project period as early as possible so that we can respond flexibly to changes in the underlying framework. We continuously improve our management tools so that we have better information on order status at all times and can take project-specific measures more quickly if required. In the marine business especially, we identify and analyze scenarios that could result in significant delays or financial losses. We regularly prepare assessments and specific plans for alternative solutions for these scenarios. This helps us to flexibly secure our production capability in the long term.

We check the credit standing of our customers carefully before entering into contracts for major orders and deploy experienced project managers for order execution. Through transparent monitoring of order status we ensure that payments are made promptly on the basis of order progress and minimize payment defaults.

In the export business, especially at Marine Systems, orders where some relevant work is performed in the customer’s country or in currency areas outside the euro zone require careful monitoring and management of exchange rate and inflation risks as a result of the heightened volatility of some markets. We also seek to obtain any necessary export permits in a way that avoids delays to order execution.

Investment risks – In the course of executing major investment projects with a long run time, cost overruns and/or delays in individual project phases and differences in the interpretation of the contracts concluded in connection with the investments cannot be ruled out. We classify individual identified investment risks as “low.”

When planning major investment projects, we seek to anticipate as many risks as possible in the course of the project and take account of these in risk provisions. We establish an investment-related risk management process that delivers better information about the current status of the investment project and enables specific measures to be implemented quickly if necessary. As far as possible, we also deploy experienced technical and commercial project managers for project execution.

Should Steel Europe experience any further delays in the construction of the direct reduction plant, currently thyssenkrupp’s largest single investment, there is the risk of higher costs for CO₂ emission credits, especially in the year of the planned start-up, and the risk of being unable to benefit in full from funding from the German government and the state of North Rhine-Westphalia. In addition, there are risks associated with the future procurement of hydrogen and green electricity. Prices for hydrogen supplies may be higher than assumed because there is no functioning hydrogen market. For this reason, it is necessary to conclude long-term contracts. Moreover, deliveries could be linked with the provision of substantial securities. If we were unable to provide these securities, it might be necessary to operate the direct reduction plant with an energy mix that does not satisfy the criteria for funding, which could result in us having to pay penalties or repay funding in accordance with the EU’s state aid regulations. We are countering these risks by way of an intensive exchange with the funding provider, an active dialog on the political level and a procurement process involving a large number of energy suppliers that has been agreed with the funding provider. In respect of the costs of constructing the direct reduction plant, the possible additional costs identified by the rebudgeting are reviewed at regular intervals. The risk management system that has been implemented identifies financial risks in a timely manner and continuously monitors the construction costs. In parallel, mitigation measures are identified and initiated.

Risks associated with information security – Our IT-based business processes are exposed to various risks associated with information security, which are still classified as “medium” – measured by our performance indicators of adjusted EBIT and free cash flow before M&A. Human error, organizational or technical processes and/or security vulnerabilities in information processing can create risks that threaten the confidentiality, availability and integrity of information. For this reason we continually review our processes and technologies. Systems are updated and processes modified immediately as necessary. The IT-based integration of our business processes is subject to the condition that the risks involved for our companies and business partners are continuously minimized. This is all the more important when entire value chains are transformed as a result of increasing digitization.

The number of attacks on the IT infrastructure of German companies, including thyssenkrupp, continues to increase. In this connection we have introduced measures to further improve our information security management and security technologies. One focus is protecting our production operations from unauthorized access for the purpose of espionage or sabotage. A group of IT security experts provides cross-segment support in the early identification of risks; the number of experts is steadily being increased. In addition, the thyssenkrupp Cyber Defense Center regularly verifies the security of the infrastructure and if necessary takes corrective action. Extensive certifications in compliance with the TISAX standard (Trusted Information Security Assessment Exchange), which are aligned to the specific requirements of the automotive industry, round off the information security measures at Automotive Technology.

Sensitizing our employees to the risks involved in handling business-related information is very important. In this context we conduct internal communication and training drives and are working to ensure that the confidentiality of information is ensured through the corresponding technical support.

The greater focus of public reporting on the defense and security industry has been grounds for us to regularly update threat scenarios and assess the associated risks, especially for Marine Systems. The integrity of our product and project data is one of the core tasks of our business continuity management.

Together with the group’s data protection officers and coordinators, our experts ensure that personal data are processed in accordance with the rules of the EU General Data Protection Regulation and the applicable local laws.

All these measures are intended to protect the group’s business data as well as the privacy of our business partners and employees, and to respond appropriately to potential new risks.

Personnel risks – In all areas of business, we need committed and motivated employees and managers in order to achieve our strategic and operational targets. There is a risk of not being able to find enough key personnel or specialists with the necessary qualifications to fill vacancies or of losing competent employees. Extreme events, such as natural catastrophes, pandemics, terrorist attacks and serious accidents could also cause the loss of employees. Overall, we still consider the extent of these individual personnel risks to be “low.”

Through employer branding campaigns aimed at specific target groups, thyssenkrupp continues to position itself as an attractive employer – also and especially in the market for professionals who are in high demand – and promotes the long-term retention of employees in the group. Measures here include systematic professional development for employees, targeted management development, career prospects and attractive incentive systems, including fringe benefits and modern working conditions. We inform interested young people about career opportunities at thyssenkrupp from an early stage and support apprentices as they start their working life. We cooperate with key universities and establish contact with students from an early stage to secure the quality and number of talented youngsters we need.

We address the risk of human rights violations at thyssenkrupp companies through a systematic risk analysis of our areas of business. On this basis, we can take appropriate preventive measures in the event of elevated risks. To comply with our statutory due diligence obligations, we run mandatory training sessions. In addition, we have set up a whistleblowing system for reporting possible violations of human rights at thyssenkrupp.