Material risks are identified, analyzed, and assessed systematically and early on via both the uniform risk management process (which all Group companies undergo several times a year) and the internal control systems (which also are integral components of the organizational and operational structure). Taking both risk appetite and risk capacity into account, actions taken to control risk entail different strategies. This includes wording such as “avoid/avert,” “mitigate,” and “secure” as well as combinations thereof; the wording, “to bear risk,” comes into play to the extent that financial considerations preclude any other actions. Local management is responsible for defining and implementing the measures.
voestalpine’s risk management covers all divisions and all hierarchy levels—both strategically and operationally. The risk management process follows several steps; its structure is similar to the recommendations in the guidelines of the Organization for Economic Cooperation and Development (OECD) for multinational groups.
The operating units have access to a risk management questionnaire specific to voestalpine in the form of a checklist, which supports identification of potential risks. The current RMQ comprises 13 chapters that cover, inter alia, strategic risks, financial risks, compliance risks as well as risks related to human rights, the environment, and climate change. The risk management questionnaire is reviewed at least once a year to ensure that it is up to date, and supplemented if necessary.
As part of an update of the materiality analysis based on the principle of dual materiality (see the chapter “Stakeholders and CR Management” for more information), voestalpine used a multi-stage and holistic approach in the business year 2023/24 to identify the material topics relating to a sustainable business model. Each sustainability topic is assigned opportunities and risks in the areas of employee matters, combating corruption and bribery, environmental matters, social matters and respect for human rights, which are taken into account in Group strategy and risk management and successively incorporated into medium-term business planning.
The identification and further development of opportunities are an integral part of the Group’s strategy management process. The Group strategy provides the strategic framework. Building on this, opportunities are identified and analyzed as part of the strategy review process and subsequently implemented in the business units. Targeted processing together with the Group’s holding company enables strengths to be outlined and strategic growth potential to be tapped. Management at the individual companies is directly responsible for identifying, analyzing, and implementing operational opportunities.
The following sustainability-related risks have been identified as material for voestalpine.
Risks in connection with climate change and decarbonization
Physical climate risks
The short and medium-term physical vulnerabilities associated with climate change from natural hazards—such as flooding or low water, snow load, drought, storms and strong winds or temperature fluctuations—were identified and reported as part of the implementation of the EU Taxonomy Regulation (for more information, see the chapter “Environment”). To this end, voestalpine prepared detailed climate risk and vulnerability analyses for all relevant operating sites in order to determine their resilience to physical risks associated with climate change. Physical climate risks were identified, quantified, and disclosed with the help of simulation-based software. The scenarios used were those of the Intergovernmental Panel on Climate Change (IPCC) that correspond with the time horizon proposed by the EU taxonomy. Heavy rainfall, flooding, and mudslides, for example, are significant physical climate risks for the voestalpine Group.
Extensive precautionary measures were taken as a result. Among other things, this includes construction measures, fire alarms, sprinkler systems, flood protection as well as logistical adjustments in case of low water levels. Existing preventive measures are evaluated as to their current appropriateness and/or completeness and adjusted to new circumstances or expanded as necessary in connection with regular run-throughs, tests of existing emergency plans as well as physical inspections and risk surveys carried out with insurance companies. The Group’s existing insurance policies for natural disasters and other risks are regularly reviewed as to their current relevance in cooperation with voestalpine Insurance Services GmbH (the Group’s internal insurer).
In addition to the steps taken within the company, regular information sharing with internal and external insurance companies helps to minimize the fallout from any such risks for the Group as much as possible.
With regard to the supply of raw materials (e.g., deliveries by ship at the Linz site), any climate-related fluctuations in water levels and the resulting difficulties in navigating rivers (e.g., the Danube) are taken into account in the number of ships used and the freight volumes.
Risk of rising GHG emission costs
A potential cost risk from increases in the price of emission allowances will continue to exist due to a possible shortage of allowances and the implementation of the EU climate targets by 2030. voestalpine makes use of needs-based hedges with a term of up to 12 months in order to hedge short-term price fluctuations.
The three-year trial phase of the Carbon Border Adjustment Mechanism (CBAM) and the associated reporting obligation began in October 2023. The CBAM is part of the European Union’s “Fit for 55” package. The main political objective is the comparable treatment of imports of certain products into the EU with regard to climate protection standards and the reduction of net greenhouse gas emissions by at least 55% by 2030 compared to 1990. This is accompanied by a gradual abolition of the free allocation of CO2 allowances in the steel and other industries, which is increasingly taking place towards the end of the current emissions trading period.
“Live operation” of the world’s first such border adjustment from 2026 means that the gradual phasing out of the free allocation of emissions trading certificates is planned by 2034.
voestalpine counters this risk with its ambitious greentec steel climate protection program (see the chapter “Climate Action” for more information). The greentec steel phased plan encompasses all activities and innovations of the voestalpine Group on the journey towards steel production with net zero emissions. In a first step, around EUR 1.5 billion will be invested to reduce CO2 emissions from Scope 1 and Scope 2 by 30% by 2029.
Risk in connection with the greentec steel climate protection program
For the forward-looking greentec steel climate protection program, which extends over several years, risks of varying degrees cannot be ruled out due to the complexity of the overall project, changes to the schedule, and with regard to internal and external financing options. The company generally relies on experienced plant engineers for important sub-projects, such as the construction of electric arc furnaces, in order to minimize technology and implementation risks. In particular, detailed risk analyses of anticipated cost increases are continuously documented in a project organization and measures are developed and evaluated. Regular reports are submitted to the Management Board and Supervisory Board of voestalpine AG for this purpose. voestalpine currently considers a financial burden beyond the estimated investment volume to be unlikely. The project management organization that has been installed for greentec steel also monitors the basic assumptions underlying the investment decision, such as sales expectations, raw material and energy price assumptions as well as their availability, and regulatory changes. The developments are continuously compared with the current situation and the progress of the project. greentec steel offers various technological options (such as electrification, hydrogen technologies, use of biogenic energy sources, etc.) with high CO2 reduction potential. The phased plan thus allows voestalpine a certain degree of flexibility in achieving its targets in order to be able to react to changing framework conditions and at the same time keep the business risk at a manageable level.
Environmental risks
The risk of negative environmental impacts, e.g., with regard to wastewater, waste, soil contamination, air emissions or future site-specific heat, wind, or water stress, is minimized through strict compliance with statutory and regulatory requirements. Compliance with these requirements is ensured and continuously monitored by environmental management systems implemented on a wide scale. A total of 76% of the production plants, which account for 96% of the Group’s entire production volume, have implemented an environmental management system pursuant to ISO 14001 or the EU’s Eco-Management and Audit Scheme (EMAS). A total of 28% of the entities are subject to certified energy management pursuant to ISO 50001, which ensures continuous improvement in terms of energy efficiency.
Human Rights Risks
Risks for voestalpine that may arise in connection with potential human rights violations are explicitly addressed in the risk management questionnaire. Analyses of any human rights violations by customers or suppliers, for instance, form part of market monitoring efforts. Attention is also paid to compliance with international standards relating to occupational safety, respect for diversity, and the protection of human rights. voestalpine pays particular attention to ensuring that there is no child or forced labor or incidents of discrimination within the Group or among its business partners.
Other Material Sustainability Risks
Risks that may arise in connection with employee matters, corruption, or competition law violations are covered by voestalpine’s risk management and are also minimized by the company’s corporate governance and compliance management. Further information can be found in the relevant sections of this CR-Report.
Risk of pandemic
The Group-wide crisis management initiated in the wake of the COVID-19 pandemic had already been put on hold by the end of the 2022/23 business year. The crisis management measures were evaluated and the findings compiled as general pandemic guidelines. These serve as instructions for action in order to ensure that relevant parties are prepared in the event of an epidemic or renewed pandemic, and to counteract risks to employees and negative effects on the company as effectively as possible.
In the event that epidemics occur in countries in which the Group operates, or if pandemics also emerge elsewhere, voestalpine will monitor developments closely. The crisis management system will be reinstated in an adapted form if necessary.