Description of material fields of risk

      Ukraine war

      The final weeks of the business year 2021/22 were marked by the Ukraine war and its associated human, social, geopolitical, and economic ramifications, some of which are still not fully foreseeable. voestalpine AG has been monitoring the looming deterioration in the situation in Ukraine for quite some time and started early on to prepare emergency measures. The safety of the company’s employees at its (temporarily closed) sales office in Kyiv, Ukraine, was and is the Group’s main concern. The team and their families were evacuated from the areas most at risk. Both sales and customer services are being provided through our Polish sales office.

      Alternative suppliers and transport routes were identified and activated to ensure that relevant supplies of raw materials (e.g., iron ore, iron ore pellets, pulverized coal injection (PCI) coal, alloys, and natural gas) to our production plants (especially the steelworks in Austria) are not interrupted. Inventories—particularly of the raw materials, iron ore, and coal—have also been built up, with the result that relevant supplies are assured through the Northern fall of 2022. voestalpine consumes about six terawatt hours (TWh) of natural gas per year at its Austrian facilities; a natural gas storage capacity of one terawatt hour (TWh) was put in place at the start of the current (i.e., 2022/23) business year. We are in the process of feeding natural gas into this storage facility. Moreover, voestalpine has entered into a contract for the delivery of non-Russian liquified natural gas (LNG) at market prices for the second quarter of the business year 2022/23. Production activities at the affected voestalpine facilities were proceeding as planned at the time this Report was prepared. An internal task force continuously monitors and assesses both the overall situation and current developments so that it can initiate all necessary countermeasures as quickly as possible.

      Developments regarding natural gas supplies are also monitored throughout. At the time this Report was prepared, natural gas was still being delivered as planned, but the pressure to enact an EU-wide embargo on Russian energy was growing. Given the close interdependence of value chains and energy flows, any suspension of natural gas deliveries—which could also be triggered by the Russian side and/or by the destruction of pipelines—would likely lead to massive restrictions in the entire European Economic Area (EEA), with wide-ranging ramifications that are very difficult or impossible to predict. To prepare for the eventuality of governments deciding to impose energy allotments, voestalpine AG in its capacity as a major consumer of natural gas has put in place emergency plans at its affected Austrian and German facilities in order to maintain minimum production levels at those plants and to prevent any damage to equipment, should an emergency scenario come to pass. Due to its additional capacity as a supplier of direct heating in Austria, the voestalpine Group also plays an important role in maintaining basic public energy supplies, which would have to be taken into account in case of natural gas allotments. The company is in constant contact with the relevant government agencies so that it is duly prepared for all conceivable scenarios. We are also continuously monitoring and assessing developments and/or follow-on effects of a potential EU embargo on Russian crude oil deliveries, but crude oil is of secondary importance to the energy supplies of our production facilities.

      In March 2022, the European Commission released “RePowerEU,” a set of proposals that aims to solve the current crisis in due course and bring about Europe’s independence from Russian fossil fuels in the medium and/or long term. Besides support for energy customers, the proposals also entail minimum quotas for the storage of natural gas in view of maintaining the security of energy supplies as well as measures intended to accelerate the expansion of renewable energy and the diversification of natural gas supplies. The goal is to reduce Europe’s reliance on Russian natural gas by two thirds through to the end of 2022 and to achieve complete independence from Russian fossil fuels “well before 2030.” This will trigger enormous challenges especially for Eastern and Central European countries, because they are more likely to rely to a greater extent on Russian natural gas and/or do not possess the grid infrastructure required for diversifying their natural gas supplies at all or only to an insufficient degree. In its capacity as a systemically relevant, major consumer of natural gas, the voestalpine Group participates proactively and constructively, both at the European and at the national level, in discussions of energy policies and issues. In the Group’s view, the current situation confirms its repeated demands to accelerate the expansion of renewable energy.

      Over and above the foregoing, the material fields of risk and the associated preventive measures that were presented in the previous business year’s Annual Report remain valid.

      COVID-19 Pandemic

      The Group-wide crisis management, which consists of crisis teams at three decision-making levels (Group, divisions, companies), took and continues to take effective steps to counteract the COVID-19 pandemic and its ramifications. The maintenance or situational adjustment of the precautionary measures that were already put in place at the onset of the pandemic (e.g., hygienic and protective measures, teleworking) as well as of the activities initiated to supplement them (e.g., regular exchanges of information with key customers and suppliers, adjustment of production activities in line with existent supply chains, securing liquidity) also helped during the business year ended to ensure the organization’s stability as best as possible. We continue to monitor developments related to the pandemic. Emergency and crisis plans that were implemented along with additional measures are evaluated at regular intervals and are adjusted and/or expanded as necessary in the light of new information.

      Availability of raw materials and energy supplies

      To ensure the supply of raw materials and energy in the required quantities and quality over the long term, the voestalpine Group has for some years already pursued a diversified procurement strategy appropriate to the heightened political and economic risks of this globalized market. The core elements of this strategy—long-term supply relationships, continued expansion of the supplier portfolio, and development of the Group’s energy self-sufficiency—have become yet more important, given the current geopolitical events as well as the ongoing volatility of the raw materials markets (for details, see the “Raw Materials” chapter of this Annual Report).

      As far as energy supplies are concerned, the Group continually examines and pursues alternative energy resources, particularly in the light of both the Ukraine war (as described above) and numerous decarbonization activities.

      Hedging raw materials prices

      An internal guideline defines objectives, principles, and responsibilities as well as methodologies, procedures, and decision-making processes in connection with the management of raw materials price risks. Based thereon and taking into account individual specificities of the respective Group company’s business model, prices are hedged by means of delivery contracts containing fixed price agreements or by means of derivative financial instruments. Depending on the respective Group company’s approach, changes in the prices of energy and raw materials may be passed on to customers in part. In this case, risk management aims to secure the previously determined contribution margins under the sales contracts. Iron ore, coke, coking coal, zinc, nickel, CO2, cobalt, and all sources of energy are subject to raw materials risk management. The section titled, “Availability of Raw Materials and Energy Supplies,” already addresses issues related to the security of supplies (procurement risk).

      Logistics and supply chains

      Generally, global supply chains may be undermined, even interrupted, by events such as the pandemic and, in particular, the Ukraine war. This may trigger restrictions that arise from suppliers, from customers, from disrupted transportation routes, and from potential sanctions and/or embargoes. Both our focus on less vulnerable supply chains and our work to expand logistical options have substantially boosted the reliability of raw materials deliveries in the past as well as during the current crises.

      Failure of production facilities

      Continual targeted and comprehensive investments that optimize sensitive units technologically serve to minimize the risk of critical facilities breaking down. Supplementary measures encompass consistent preventive maintenance, risk-oriented storage of critical spare parts as well as appropriate employee training.

      Failure of it systems

      At most of the Group’s facilities, business and production processes that are largely based on complex information technology (IT) systems are serviced by voestalpine group-IT GmbH, a wholly-owned subsidiary of voestalpine AG specialized in IT. Given the major significance of IT security and in order to continue mitigating possible IT breakdown and security risks, minimum IT security standards that include guidance on business continuity management are available. They are regularly adapted to current events, and compliance with the relevant requirements is reviewed annually by means of internal and external audits. voestalpine’s highly qualified Security Operation Center (SOC) continuously ensures avoidance, identification, and mitigation of security-related events. Additional periodic penetration tests are carried out to further reduce the risk of unauthorized access to IT systems and IT applications. Broad online campaigns aimed at sensitizing the Group’s employees to and furthering their awareness of security issues—especially potential risks in connection with teleworking—were carried out yet again in the business year ended. Evidence of cyber fraud attacks (e.g., social engineering, CEO fraud, and man-in-the-middle attacks related to payments and deliveries) is compiled by an internal working group, preventive measures are developed, and existent measures are reviewed as to their efficacy and adjusted as necessary. To avert potential cyber fraud attacks, appropriate online campaigns (including simulated phishing awareness programs) were conducted on these issues, too, and special e-learning modules that also help to sensitize employees at regular intervals to the given issues, were completed.

      Knowledge management/project management

      Complex projects that were initiated in the past are consistently refined in order to sustainably safeguard the Group’s knowledge—especially to prevent the loss of its know-how. Besides permanently documenting all available knowledge, new findings from key projects as well as lessons learned as the result of unplanned events are incorporated as appropriate. Detailed process documentation, especially in IT-supported areas, also contributes to securing the available knowledge.

      A diverse range of project management tools and suitable project monitoring are used to counteract any project risks (e.g., the project business and investments). In particular, this also concerns any risks associated with ramp-ups and/or cost increases. Insights gained from earlier activities are also compiled in the sense of lessons learned and form the basis of ongoing enhancements of already available tools to ensure that they are consistently applied in future projects.

      Compliance risks

      Compliance violations (e.g., antitrust and corruption violations) represent a significant risk and may have adverse effects in that they may trigger financial losses and damage the Group’s reputation. A Group-wide Compliance management system is designed to counteract these risks, particularly antitrust and corruption viola­tions.

      Risks of noncompliance with data protection requirements

      Violations of requirements under data protection laws may have adverse financial effects and lead to reputational damage. A data protection unit was established pursuant to the data protection requirements that apply throughout the Group. It helps Group company managers carry out their responsibilities regarding compliance with statutory and intra-Group data protection requirements.

      Risks from natural disasters

      Comprehensive proactive measures to deal with risks, if any, from natural disasters such as fires, floods or low water levels, heavy snowfall, droughts, storms, or fluctuations in temperatures have been put in place. Among other things, this includes appropriate construction measures, fire alarms, sprinkler systems, flood protection, regular safety drills including tests of existent emergency plans as well as inspections and risk surveys conducted with insurance companies. The Group’s existing insurance policies for natural disasters and other risks are regularly reviewed as to their current appropriateness in cooperation with voestalpine Insurance Services GmbH (the Group’s internal insurer).

      Sustainability risks

      Potential risks pertaining to sustainability and associated issues (including the ramifications thereof)—e.g., climate action and environmental protection (particularly CO2-related topics such as decarbonization), social and personnel issues, respect for human rights, and the fight against corruption—are taken into account, including their impact at all levels. As for the ramifications of climate and energy policies on the voestalpine Group, including its decarbonization strategy, please see the explanations in the Notes, Item B. Summary of Accounting Policies. Sustainability issues—among them the chapters on climate action and risk management—are also addressed in a separate, annually published sustainability report (specifically, the Group’s Corporate Responsibility (CR) Report). In addition, the “Environment” chapter of the Group Management Report contains greater detail on the CO2 issue.

      Risks from the financial sector

      Financial risk management is organized centrally with respect to policy-making power, strategy determination, and target definition. The existing policies include targets, principles, duties, and responsibilities that apply to both Group Treasury and the finance departments of individual Group companies. Financial risks are monitored continuously and hedged where feasible. Our strategy for managing foreign currency risks is aimed, in particular, at creating natural hedges. The management of other risks (interest rates and raw materials) serves to reduce fluctuations in both cash flows and income and to safeguard contribution margins. Market risks are largely hedged through derivative financial instruments that are used exclusively in connection with an underlying transaction.

      Specifically, financing risks are hedged using the following measures:

      Liquidity risk

      Liquidity risks generally arise when a company is potentially unable to raise the funds necessary to meet its financial obligations. Existing liquidity reserves enable the company to meet its obligations when due, even in times of crisis. Over and above the liquidity reserve, a precise financial plan that is prepared on a revolving, quarterly basis is the Group’s primary instrument for controlling liquidity risk. Group Treasury centrally determines the need for new funding and bank credit lines based on the consolidated operating results. This is intended to ensure that the liquidity reserve covers the Group’s planned liquidity needs for the next 12 months. As far as banking policies are concerned, care is taken to avoid cluster risks by diversifying the financial partners. Given the additional risks arising from the COVID-19 pandemic, particular attention was paid, for example, to boosting the company’s internal funding capacity.

      Credit risk

      Credit risk refers to financial losses that may occur due to non-fulfillment of contractual obligations by individual business partners. The credit risk of the underlying transactions is mitigated to the extent possible through a large number of credit insurance policies and bankable securities (guarantees, letters of credit). The default risk related to the Group’s remaining own risk is managed by way of defined credit assessment, risk evaluation, risk classification, and credit monitoring processes. To date, the COVID-19 pandemic has not caused loan insurers to significantly tighten credit limits in individual customer segments, nor did it lead to greater receivable charge-offs. Counterparty credit risk in financial contracts is managed through daily monitoring of the counterparties’ ratings and any changes in their credit default swap (CDS) levels. Investment limits weighted by the probability of default (PD) are allocated on that basis.

      Foreign currency risk

      Foreign currency risk management aims primarily to create a natural hedge (cross-currency netting) within the Group by combining the cash flows. In this connection, hedges are implemented centrally by Group Treasury based on derivative hedging instruments. voestalpine AG hedges the budgeted (net) foreign currency payments for the next nine to twelve months. Longer-term hedging is carried out only in connection with contracted project business. While the hedging ratio is between 25% and 100% of the budgeted cash flows for the next 12 months, it declines through to maturity.

      Interest rate risk

      voestalpine AG conducts interest rate risk assessments centrally for the entire Group. In particular, this entails managing cash flow risks (i.e., the risk that interest expense or interest income may undergo an adverse change). As of the March 31, 2022, reporting date, any increase in the interest rate by one percentage point would increase the net interest expense in the subsequent business year by EUR 5.5 million. However, this is a reporting date assessment that may be subject to fluctuations over time.

      Price risk

      voestalpine AG also assesses price risk. Mainly scenario analyses are used to quantify interest and currency risks.

      Cash flow
      • From investing activities: outflow/inflow of liquid assets from investments/disinvestments;
      • From operating activities: outflow/inflow of liquid assets not affected by investment, disinvestment, or financing activities.
      • From financing activities: outflow/inflow of liquid assets from capital expenditures and capital contributions.
      Rating
      An evaluation of the credit quality of a company recognized on international capital markets.
      Volatility
      The degree of fluctuation in stock prices and currency exchange rates or in prices of consumer goods in comparison to the market.