Description of material fields of risk

The material fields of risk and associated preventive measures that were presented in the previous business year’s Consolidated Management Report remain valid.

GEOPOLITICAL CONFLICTS AND THEIR IMPACT

The past business year continued to be characterized by geopolitical conflicts and tensions. Geopolitical developments—particularly the war in Ukraine—were and continue to be monitored on an ongoing basis in order to identify any future effects on the voestalpine Group at an early stage and to proactively counteract potential risks in a constantly changing geopolitical environment in the best possible way with a robust and sustainable organization. The activities initiated or adapted at the beginning of the war in Ukraine to maintain and secure the supply of relevant raw materials and natural gas continue to apply and are listed in the section “Availability of Raw Materials and Energy Supplies.”

RISKS OF DECARBONIZATION/CLIMATE PROTECTION PROGRAM greentec steel

voestalpine AG is committed to the Paris Climate Agreement, which aims to keep the increase in the average global temperature well below 2°C above pre-industrial levels and to make efforts to limit the temperature increase to 1.5°C above pre-industrial levels. Building on this, the European Union has set itself the binding target of achieving climate neutrality by 2050 as part of the European Green Deal, laid out in the European Climate Law. This requires a significant reduction of current greenhouse gas emissions over the next few decades. With greentec steel, the voestalpine Group is gradually implementing an ambitious step-by-step plan. greentec steel involves all of voestalpine’s activities and innovations on the path to steel production with net zero emissions. As part of the Science Based Targets initiative (SBTi), the voestalpine Group is committed to reducing the sum of Scope 1 and Scope 2 emissions by 30% and Scope 3 emissions by 25% by 2029 compared to the reference year 2019. Target achievement in 2029 is also subject to external factors and influencing variables such as raw materials, energy, and the economy.

voestalpine’s long-term concept for producing steel at net zero by 2050 at the latest, in line with the EU emissions trading target path, consists of several modular technology steps and options. These are based equally on the greatest possible CO₂ reduction effect and the actual feasibility (e.g., due to the respective political and legal framework, the availability of raw and input materials, and renewable energies as well as the availability of the necessary infrastructures) as well as the economic feasibility. Here is an overview of the key elements of the greentec steel climate protection program (reference year 2019 for Scope 1 and Scope 2):

• By 2029: Phase 1 with a target of minus 30%
  • greentec steel comprises an investment volume of around EUR 1.5 billion in the first stage. This will initially involve installing two green electricity-based electric arc furnaces at the Linz and Donawitz sites and decommissioning two coal-based blast furnace units. Depending on the quality requirements, a mix of input materials consisting of scrap, liquid pig iron, and HBI (hot briquetted iron) will be used. voestalpine obtains the required HBI primarily from the direct reduction plant in Texas/USA, which has been majority-owned by a global steel producer since 2022; 20% is owned by voestalpine with corresponding long-term purchase agreements.
  • Following the granting of EUR 90 million by the Austrian federal government as part of the “Transformation of Industry” program funded by environmental subsidies in Austria and the plant and supplier decisions, construction has now begun. The environmental impact assessment procedure for the necessary upgrading of the electricity grid has been completed at the Donawitz site and at the time of writing has almost been completed at the Linz site. After the planned completion in 2027 and following a successful ramp-up, 2.5 million tons of CO₂-reduced steel will be produced annually.
• From 2030 to 2035: Phase 2 with a target of minus 50%
  • Focus on direct CO₂ avoidance through further replacement of fossil pig iron production capacities and likely supplementary use of CO₂ capture and utilization technologies (carbon capture utilization and storage).
• By 2050 at the latest: Phase 3 with a target of net zero emissions
  • Focus on replacing the remaining fossil pig iron capacities using fossil-free energy sources, e.g., “green” hydrogen and bioenergy, as well as CO₂ capture (CCUS) with the aim of achieving the greatest possible flexibility while ensuring that the net-zero strategy is actually economically feasible. The final decisions on these options will not be made until a later date and they will be in line with investment cycles and in accordance with the foreseeable conditions.

For the forward-looking greentec steel climate protection program, which extends over several years and comprises investments of around EUR 1.5 billion in the first stage, possible risks of varying degrees cannot be ruled out due to the complexity of the overall project, possible changes to the schedule and with regard to internal and external financing options. Experienced plant engineers are always used for important sub-projects such as the construction of the electric arc furnaces. In particular, detailed risk analyses of anticipated cost increases are continuously documented in a project organization and measures are developed and evaluated. Regular reports are submitted to the Management Board and Supervisory Board of voestalpine AG. voestalpine currently considers a financial burden beyond the estimated investment volume as unlikely. The greentec steel project management organization that has been installed also monitors the basic assumptions underlying the investment decision, such as sales expectations, raw material and energy price assumptions as well as their availability, and regulatory changes. The developments are constantly compared with the current situation and the progress of the project. greentec steel offers various technological options (such as electrification, hydrogen technologies, use of biogenic energy sources, etc.) with high CO₂ reduction potential. The phased plan thus allows voestalpine a certain degree of flexibility in achieving its targets in order to be able to react to changing framework conditions and at the same time keep the business risk at a manageable level.

The largest climate protection program in Austria was launched with the greentec steel phased plan for the transformation of steel production. However, successful implementation for Phase 2 and Phase 3 still requires appropriate framework conditions to ensure that no disadvantages arise compared to other markets. A basic prerequisite for the transformation is the sufficient availability of energy from renewable sources at economically viable, competitive prices.

Further risks associated with greentec steel (such as the availability of raw materials and energy, project management, uncertainties in legislation, availability of qualified staff) will be discussed in the following chapters.

CO₂-reduced steel is already being supplied to almost 40 customers in the form of the greentec steel edition. This means that voestalpine is already meeting the increasing demand for innovative product solutions.

AVAILABILITY OF RAW MATERIALS AND ENERGY SUPPLIES

In order to ensure the long-term supply of raw materials and energy in the required qualities and quantities, the voestalpine Group has for many years been pursuing a diversified procurement strategy in line with the heightened political and economic risks of this globalized market. This is also reinforced by the various decarbonization activities and geopolitical developments (such as the Ukraine conflict).

• For example, since the beginning of the war in Ukraine, alternative suppliers and transport routes have been activated to ensure the supply of relevant raw materials (such as iron ore, iron ore pellets, pulverized coal injection (PCI) coal, alloys) to the Group’s production plants (especially the steelworks in Austria). The short-term holding of inventories of critical raw materials (such as iron ore and coal) also helps to bridge short-term supply bottlenecks.
• In addition, the voestalpine Group has contractually secured its own natural gas storage facilities in order to secure the natural gas supply (particularly for heat treatment and for the rolling mills at the Austrian sites). With an existing reserve of 1.5 TWh of natural gas, full operation can be maintained for three months or, depending on the respective production mode, partial operation for a correspondingly longer period in the event of a complete loss of the external supply. In addition, work has been and continues to be carried out with existing and new suppliers to continuously expand sources of natural gas supply. For example, natural gas supplies from non-Russian sources are increasingly being transported to Austria off the conventional Russian-Ukrainian transport routes and used for ongoing operations. In the event of a potential natural gas bottleneck, contingency plans would also come into effect in which production could be gradually adjusted to the available energy volumes. Last but not least, the Group’s international orientation with 500 companies and locations worldwide—and therefore numerous unaffected locations outside Europe—would also make it possible to compensate for production bottlenecks to some extent. Bottlenecks could be avoided by quickly adapting the supply and logistics processes to the new challenges.
• Long-term supply relationships, long-term supply contracts, the further expansion of the supplier portfolio, and the optimization of both the Group’s self-sufficiency and the circular economy (for example, in the area of scrap, the opportunities for a circular economy along the entire value chain will be further intensified by expanding or establishing supply options with customers, suppliers, and process partners) form the core elements of a diversified procurement strategy. This strategy has become even more important in view of geopolitical events and the given volatility on the raw materials markets (for more details, see the “Raw materials” chapter of this Management Report).

Developments in the supply of energy and, in particular, natural gas and raw materials supplies are constantly monitored, especially on the basis of geopolitical developments, and evaluated in regular discussions between experts and the Management Board.

In the area of energy supply, the development of alternative energy resources is constantly being investigated and driven forward. This is motivated not only by the aforementioned war in Ukraine and the associated activities to strengthen resilience, but also in particular by the changes in energy requirements resulting from decarbonization activities. In addition to the systematic expansion of our own renewable energy capacities and the purchase of renewable energy based on long-term PPAs (Power Purchase Agreements), the focus here remains on numerous research and demonstration projects in the areas of hydrogen, biogas and biomass as well as projects in alternative iron and steel production technologies (such as “H2FUTURE” [hydrogen pilot plant], “HYFOR” [Hydrogen-Based Fine-Ore Reduction], and smelter as well as “SuSteel” [Sustainable Steelmaking]). Research activities in the field of CO₂ capture, utilization, and storage (CCUS) complete the overall picture.

HEDGING THE PRICE OF RAW MATERIALS AND ENERGY

Objectives, principles, responsibilities, and accountabilities as well as methods, procedures, and decision-making processes for dealing with commodity and energy price risks are set out in an internal guideline. Based on this and taking into account the individual characteristics of the business model of the respective Group company, prices are hedged by means of short-term supply contracts with a fixed price agreement or by means of derivative financial instruments. PPAs (power purchase agreements) are a new instrument used for long-term hedging of electricity price fluctuations. Depending on the business model of the Group company concerned, changes in energy and commodity prices can for the most part be passed on to customers, sometimes with a time delay. In this case, the aim of risk management is to secure the previously determined contribution margins under the sales contracts. Iron ore, coke, coking coal, zinc, nickel, CO₂, cobalt, and energy (electricity, natural gas) are subject to raw materials risk and energy risk management. The goal is to reduce the fluctuation in earnings from the volatility of raw material and energy prices to a level that is consistent with the principle of conservative financial policy as defined in the voestalpine Group’s financial constitution. The underlying guideline was updated in the current business year, with the topic of energy in particular being adapted to new circumstances. The issue of security of supply (procurement risk) has already been addressed under “Availability of raw materials, energy supply.” The comprehensive measures help to ensure financial stability and strengthen the company’s resilience to volatile markets and effectively manage relevant risks with the necessary flexibility.

DISRUPTIONS IN LOGISTICS AND SUPPLY CHAINS

In general, global supply chains can be disrupted by geopolitical conflicts (such as the current war in Ukraine) or other events (such as a pandemic). This can lead to restrictions on the part of suppliers, customers, disruptions to transport routes, and potential sanctions or embargoes. The focus on less vulnerable supply chains and the simultaneous broadening of logistics options have already significantly increased the resilience of our logistics and supply chains in the past (e.g., when transporting raw materials). Diversified procurement strategies and supply chains serve to provide the best possible protection and resilience against unforeseen events.

EFFECTS OF A PANDEMIC

The Group crisis management initiated in the course of the COVID-19 pandemic was put on hold by the end of the 2022/23 business year. The applied crisis management, defined measures and lessons learned were evaluated and compiled in a general pandemic guide in order to be able to counteract the effects of such an incident (e.g., general pandemic) in the best possible way. Developments relating to any pandemics are monitored so that the Group’s crisis management system can be adapted and implemented if necessary.

FAILURE OF PRODUCTION FACILITIES

Targeted and comprehensive investments serving to optimize sensitive units technologically have been and are being carried out to minimize the risk of failure of critical facilities. Necessary investments in modernization and replacements are also planned for the long term. Additional supplementary measures include consistent, systematic and preventive maintenance, risk-oriented storage of critical spare parts, and appropriate employee training, to continuously improve the performance and reliability of the systems and further minimize the risk of failure. In addition, appropriate emergency plans have been defined for key plants to minimize any effects and to enable a controlled restart.

Emergency generators are available to protect critical facilities and processes at key plants in case of sudden, unplanned power interruptions (i.e., blackouts). These generators can be used to power limited partial operations, emergency operations, and, in extreme cases, controlled plant shutdowns. Furthermore, the Linz facility, for example, has a captive power plant with black start capacity and special internal grids (i.e., self-contained, segregated areas). Regular run-throughs of a range of scenarios are carried out (e.g., tests of the emergency generators and the emergency and communications plans for different failure scenarios) to ensure that the facilities are ideally prepared for adverse events.

Existing emergency plans are regularly evaluated by the respective experts and adapted to new or changed circumstances if necessary.

IT, FAILURE OF IT SYSTEMS

Services for business and production processes, which are mainly based on complex IT systems, are provided at most Group sites by IT subsidiaries wholly owned by voestalpine AG (voestalpine group-IT GmbH in Austria and its sister companies in Germany, Brazil, and China). Due to the great importance of IT security and IT availability and in order to further minimize potential IT failure and IT security risks, minimum IT security standards, including business continuity management requirements, are available. They are regularly adapted to new circumstances and compliance with the relevant requirements is reviewed annually in the form of internal and external audits. The highly qualified voestalpine Security Operation Center (SOC) ensures that security-relevant incidents are identified and rectified on an ongoing basis, thereby also contributing to prevention. Penetration tests are carried out regularly to reduce the risk of unauthorized access to IT systems and applications. Extensive online campaigns were also initiated in the past business year to raise employee awareness of security issues, particularly the dangers of phishing attacks. An internal working group collects information on possible cyber fraud attacks (e.g., social engineering, CEO fraud, payment/delivery detours, phishing) and develops preventive measures that are reviewed for their effectiveness and adjusted if necessary. All of these measures are aimed at reducing the risk and downtime of IT systems due to cyber attacks, human error, manipulation, hardware defects, and similar causes as much as possible or keeping them as low as possible.

PERSONNEL RISKS

In the voestalpine Group, employees and their expertise and dedication are a key success factor. The positioning of voestalpine AG as an attractive employer on the one hand and measures to retain employees on the other are intended to ensure the availability of qualified specialists to the required extent. Ongoing training and continuing education, fair working conditions and terms, a modern working environment, and a wide range of training and development opportunities are individual aspects in this regard. Internal apprentice training is another focal point.

KNOWLEDGE MANAGEMENT/PROJECT MANAGEMENT

Complex projects that were initiated in the past are consistently refined and/or adjusted in order to sustainably safeguard the Group’s knowledge—especially to prevent the loss of its expertise. Besides permanently documenting all available knowledge, new findings from key projects as well as lessons learned as a result of unplanned events are incorporated where appropriate. Detailed process documentation, especially in IT-supported areas, also contributes to securing the available knowledge.

Any risks arising from projects (e.g., from major projects, investments or project business) are countered by using a wide range of project management tools and appropriate project monitoring and, depending on the size of the project, by holding regular project oversight meetings with the involvement of top management. In particular, this also concerns any risks associated with ramp-ups and/or cost increases. Insights gained from earlier activities are also compiled in the sense of lessons learned and form the basis of ongoing enhancements of already available tools to ensure that they are consistently applied in future projects.

COMPLIANCE RISKS

Compliance violations (e.g., antitrust and corruption violations) represent a significant risk and may have adverse effects in that they may trigger financial losses and damage the Group’s reputation. A Group-wide compliance management system is designed to counteract these risks, particularly antitrust and corruption violations. In-person training focused on particular topics is part of this system, along with e-learning programs.

RISKS OF NONCOMPLIANCE WITH DATA PROTECTION REQUIREMENTS

Violations of requirements under data protection laws may have adverse financial effects and lead to reputational damage. A data protection unit was established pursuant to the data protection requirements that apply throughout the Group. It helps Group company managers carry out their responsibilities regarding compliance with statutory and intra-Group data protection requirements. Topic-focused e-learning is offered as a supplementary measure.

RISKS FROM NATURAL HAZARDS, PHYSICAL CLIMATE RISKS

The short- and medium-term physical risks associated with climate change from natural hazards (such as fire, flooding or low water as well as fluctuating water levels, snow load, drought, strong winds and storms, temperature fluctuations) were determined as part of the implementation of the EU Taxonomy Regulation. Detailed climate risk and vulnerability analyses were carried out for relevant operating sites. Physical climate risks were identified, quantified, and disclosed using a simulation-based software tool. Heavy rainfall, flooding, and mudslides are significant physical climate risks for the voestalpine Group. Based on this, appropriate precautionary measures have been taken. These include structural and technical measures such as flood protection, fire alarms, sprinkler systems, and logistics adjustments in the event of low water, for example. As part of regular drills, tests of existing emergency plans as well as inspections and risk surveys conducted with insurance companies, existing precautionary measures are checked to ensure they are up to date and complete and, if necessary, adapted or expanded to new circumstances. Existing insurance cover for natural hazards and other risks is regularly reviewed with our internal insurance company (voestalpine Insurance Broker GmbH) to ensure that it is up to date. Measures taken are regularly checked for effectiveness in order to manage risks and to counteract the progression of climate change in the best possible way. Further details can be found in the annual Corporate Responsibility Report (this report will be integrated into the Management Report in the coming business year).

OTHER SUSTAINABILITY RISKS

Potential risks pertaining to sustainability and associated issues such as climate action and environmental protection, social and personnel issues, respect for human rights, and the fight against corruption are considered in terms of their impact at all levels, in compliance with the Group’s sustainability strategy.

• For more information on the impact of the climate and energy policies on the voestalpine Group, including its decarbonization strategy, please see the disclosures in the Notes under item B “Summary of Accounting Policies” in the Notes.
• Sustainability issues—chief among them climate action and risk management—are also addressed in a separate Sustainability Report that is published annually. This Corporate Responsibility Report is prepared in accordance with the international standards of the Global Reporting Initiative (GRI). In addition, the “Environment” chapter of the Management Report contains greater detail on the CO₂ issue.

In addition, corresponding activities relating to the Supply Chain Due Diligence Act have been initiated and process guidelines have been rolled out or are being processed at the affected locations. Developments relating to supply chain due diligence laws continue to be monitored and evaluated on an ongoing basis.

RISKS FROM THE FINANCIAL SECTOR

Financial risk management is organized centrally with respect to policy-making power, strategy determination, and target definition. The existing policies include targets, principles, duties, and responsibilities that apply to both Group Treasury and the finance departments of individual Group companies. Financial risks are monitored continuously and hedged where feasible. Our strategy for managing foreign currency risks is aimed, in particular, at creating natural hedges. The management of other risks (interest rates and raw materials) serves to reduce fluctuations in both cash flows and income and to safeguard contribution margins. Market risks are largely hedged through derivative financial instruments that are used exclusively in connection with an underlying transaction.

Liquidity risk

Liquidity risks generally arise when a company is potentially unable to raise the funds necessary to meet its financial obligations. Existing liquidity reserves enable the company to meet its obligations when due, even in times of crisis. Over and above the liquidity reserve, a precise financial plan that is prepared on a revolving, quarterly basis is the Group’s primary instrument for controlling liquidity risk. Group Treasury centrally determines the need for new funding and bank credit lines based on the consolidated operating results. The intention is to ensure that the liquidity reserve covers the Group’s planned liquidity needs for the next 12 months. As far as banking policies are concerned, care is taken to avoid cluster risks by diversifying the financial partners. Particular attention was and still is paid to boosting the company’s internal funding capacity.

Credit risk

Credit risk refers to financial losses that may occur due to non-fulfillment of contractual obligations by individual business partners. The credit risk of the underlying transactions is minimized as far as possible through a large number of credit insurances and bankable securities (guarantees, letters of credit). The default risk related to the Group’s remaining own risk is managed by way of defined credit assessment, risk evaluation, risk classification, and credit monitoring processes. The current Ukraine war did not cause loan insurers to significantly tighten credit limits in individual customer segments in the past, nor have these events led to greater receivable charge-offs. Counterparty credit risk in financial contracts is managed through daily monitoring of the counterparties’ credit ratings and any changes in their credit default swap (CDS) levels. Investment limits weighted by the probability of default (PD) are allocated on that basis.

Foreign currency risk

Foreign currency risk management aims primarily to create a natural hedge (cross-currency netting) within the Group by combining the cash flows. In this respect, hedges are implemented centrally by Group Treasury based on derivative hedging instruments. voestalpine AG hedges the budgeted (net) foreign currency payment streams for up to 12 months. Longer-term hedging is carried out only in connection with contracted project business. While the hedging ratio is between 25% and 100% of the budgeted cash flows for the next 12 months, the amount of the hedging ratio depends on the business model of the respective Group company concerned. In addition, the hedging ratio generally decreases with maturity.

Interest rate risk

voestalpine AG conducts interest rate risk assessments centrally for the entire Group. In particular, this entails managing cash flow risks (i.e., the risk that interest expense or interest income may undergo an adverse change). As of the March 31, 2024, reporting date, any increase in the interest rate by one percentage point would decrease the net interest expense associated with bank loans and capital market indebtedness in the subsequent business year by EUR 0.5 million. However, this is a reporting date assessment that may be subject to fluctuations over time.

Price risk

voestalpine AG also assesses price risk. Mainly scenario analyses are used to quantify interest and currency risks.