Help us improve
The Enagás Group has an advanced risk control and management model that, through a forward-looking approach, enables the company to anticipate and adapt to the complexity of an uncertain and volatile global environment.
This model not only identifies challenges and opportunities but also guides decision-making towards the achievement of corporate objectives and the dynamic updating of the Strategic Plan, ensuring predictable and balanced management with a medium-to-moderate risk profile across the company.
In its Risk Control and Management Policy, Enagás sets out its commitments to ensuring a clear governance structure, a proactive and comprehensive approach to risk management and control, and effective information management that enables risks to be identified, assessed, managed and communicated at the appropriate levels.
This model is based on five aspects:
Enagás has defined standard risk types based on their nature and has established a risk taxonomy structured into different categories.
Enagás has established a strong risk culture, supported by a governance structure with clearly defined responsibilities within the company's risk control and management process.
In order to continue reinforcing this organisational culture, Enagás carries out internal communication actions, as well as training actions for the Board of Directors and Enagás employees, in relation to the Risk Management Model, the methodology, and the integral security risk in information and communications systems (cybersecurity), which enables it to update knowledge in this sphere and continue to strengthen the risk culture at all levels of the organisation.
The model complies with internationally recognised best practices in risk control and management. Its primary benchmarks are ISO 31000 Risk Management and the COSO Enterprise Risk Management (ERM) Framework. In addition, it is aligned with the applicable Spanish regulatory framework, including the Spanish Companies Act, the recommendations set out in the Good Governance Code for Listed Companies, and CNMV Technical Guide 1/2024 on Audit Committees of Public Interest Entities.
The transparency of the information provided by Enagás to third parties reflects the company's commitment to reliability, accuracy, rigour and transparency, in line with the principles established in its Responsible Communication Policy. This commitment is implemented through measures such as the monitoring and verification of content across media and social networks, active partnerships with organisations committed to upholding the ethical principles of responsible information, awareness-raising and training initiatives in this area, and the establishment of a common framework for responsible communication. Together, these measures help strengthen the quality, accessibility, timeliness and integrity of the information disseminated through Enagás’ official communication channels.
In 2024, the Risk Control and Management Model was reviewed by an independent expert, whose assessment highlighted the high level of maturity and implementation achieved across the organisation. In 2025, Enagás obtained ISO 31000 certification for its Risk Control and Management Model. The certification report likewise recognised the robustness of the model, methodology and risk culture within the organisation, the strategic positioning of the risk management function, and the comprehensive nature of the continuous monitoring carried out on material risks.
Corporate risks are continuously monitored through different channels and a wide variety of reports. A quarterly monitoring report is submitted to the Executive Committee, the Audit and Compliance Committee and the company’s Board of Directors.
Below are the four phases of the risk management process:
The impact or exposure of risks is assessed in different dimensions, including ESG (environmental, social and governance) aspects, so that risk levels are determined from the perspective of relative importance, impact on the company's value and impact on the environment.
Enagás assesses risk by defining a range of forward-looking scenarios that could potentially have a negative impact on the company's interests. These scenarios are developed jointly with the owners of each business area, based on the projections contained in the budget and the Strategic Plan.
Risk levels are determined according to the impact or exposure and the likelihood of occurrence of each risk event. Risks are classified into four categories: acceptable, tolerable, significant, and critical.
The model is further enhanced through the performance of specific risk assessments, which support decision-making based on risk-return criteria for strategic initiatives undertaken by the Enagás Group, as well as for new products (such as CO₂ and ammonia), services, business activities and other opportunities.
The Risk Control and Management function carries out these assessments independently, consistently and across all risk categories, applying methodologies aligned with those used for enterprise-wide risk measurement. Specific risk thresholds are established for these types of initiatives, while remaining fully aligned with the methodology used for the rest of the company's risks. This approach enables identified risks to be monitored throughout their entire lifecycle, from the initial opportunity assessment phase through to the management of the activity once it has been integrated into the company's operations.
In 2025, the Enagás Risk Control and Management Model was certified in accordance with the international ISO 31000 standard, demonstrating compliance with the highest international standards in risk management. In addition, regular external audits of the Risk Control and Management Model are conducted within the framework of the company's ISO 55001 Asset Management, ISO 14001 Environmental Management Systems, and ISO 37001 Anti-Bribery Management Systems certifications, insofar as they relate to the requirements of these standards.
During 2025, Enagás carried out internal communication initiatives and training programmes for both the Board of Directors and Enagás professionals on the Risk Management Model, its methodology, and comprehensive security risks relating to information and communication systems (cybersecurity). These initiatives help keep knowledge up to date and further strengthen the risk culture across all levels of the organisation.
These are the main risk categories considered by Enagás.
Strategic uncertainties, economic cycles, changes in the regulatory framework, evolution of demand, changes in market dynamics, etc.
These are generally of a "one-off" nature (an external or internal factor that generates a potential negative impact for the company). The risk measurement exercise consists of determining possible scenarios of prospective risks, which could eventually have a negative impact on the Company's interests.
For further information, please refer to the ‘Risk Management’ section of Enagás’ Annual Report.
Occurring during the execution of activities due to failures in processes, physical equipment, IT systems, human resources or external factors.
Stochastic methodologies are used to measure these risks, simulating scenarios based on historical data, frequency and exposure.
For further information, please refer to the ‘Risk Management’ section of Enagás’ Annual Report.
Financial risks are caused by fluctuations in interest and exchange rates and market conditions affecting liquidity and financing.
Tax risks arise from changes in regulatory frameworks and/or possible differences in the interpretation of existing legislation.
Credit risk covers potential defaults on payment obligations by third parties in relation to services rendered and outstanding receivables.
Finally, counterparty risk covers any non-performance of obligations under medium- and long-term contracts.
The methodology for measuring counterparty risk consists mainly in monitoring the credit quality of the company's most important counterparties.
For further information, please refer to the ‘Risk Management’ section of Enagás’ Annual Report.
This category covers any non-compliance with legislation, internal regulations, as well as compliance with internal procedures.
We also consider within the category of criminal liability risks, any impact on the company arising from criminal offences committed by its directors or employees.
Enagás carries out an analysis based on qualitative criteria to determine the breaches or offences that may be committed in the various divisions and department of the company according to the activity they carry out, in order to determine the areas' exposure to the different criminal risks.
For further information, please refer to the ‘Risk Management’ section of Enagás’ Annual Report.
Enagás considers any unfavourable perception or opinion held by stakeholders that may have an impact on the company to constitute a reputational risk.
Within this framework, reputational risks include those associated with the dissemination, amplification or interpretation of incorrect, inaccurate, incomplete or unverified information about the company. Among these is the risk of misinformation, which has been monitored as an emerging risk since 2024 and was incorporated into the company's risk inventory in 2025.
In an increasingly complex and dynamic digital environment, further intensified by the widespread use of social media, algorithms and Artificial Intelligence, such situations may negatively affect the company's reputation and stakeholder trust, particularly when corporate information is not sufficiently visible, accessible, up to date, or presented in a transparent and comprehensive manner.
To address these challenges, Enagás has a Responsible Communication Policy that establishes guidelines on how to communicate both company and third-party information, as well as how to respond to potentially inaccurate or misleading content.
Enagás performs a qualitative assessment of reputational risk based on the estimated level of exposure and the likelihood of dissemination of the risk event. To assess exposure, the company applies a predefined scale that takes into account the reach of the media channels reporting the event, its potential impact on the perceptions of affected stakeholders, and the duration of the event's visibility and dissemination.
For further information, please refer to the "Risk Management" section of the Enagás Annual Report.
The control and management of sustainability risks are integrated across the organisation in the company's Risk Control and Management Model.
Enagás considers sustainability risks to be a cross-cutting risk, which does not involve a specific risk category, it being understood that some of the risks included in our inventory have a cross-organisational component in one of the three areas of sustainability: environmental, social and governance (ESG).
In relation to these three areas, Enagás has adapted this methodology to the CSRD Directive, identifying, through the double materiality calculation exercise and the IRO matrix, the new ESG issues to ensure the company's sustainability through the management of these aspects:
| ESG Topic | ||
|---|---|---|
| Environmental | Social | Governance |
| Climate action and energy efficiency | People | Good Corporate Governance |
| Pollution | Human rights | Ethics and integrity |
| Water and marine resources management | Sustainable value chain | Operational excellence |
| Biodiversity | Local communities | |
| Circular Economy | Customers | |
At Enagás, the processes for identifying and assessing climate risks are integrated into the corporate risk control and management model, aimed at ensuring that the company's objectives are achieved in a predictable manner and with an average profile for all its risks.
This model makes it possible to identify and quantify the financial impact of climate change risks, which are risks framed within the company's risk taxonomy (essentially, physical risks are "operational and technological" risks and transition risks are "strategic and business" risks). The quantification of these risks enables their integration into corporate strategy and the setting of objectives in order to minimise risks and maximise opportunities.
Enagás follows the recommendations of the Task Force on Climate-Related Financial Disclosures (TCFD) in its management of climate risks and has a methodology for their identification, prioritisation and economic quantification that it began to apply in 2016. Physical risks (extreme weather events, sea level rise) and transitional risks (regulatory, technological, market and reputational) are identified and assessed according to the classification provided by the TCFD standard.
During 2025, Enagás has reinforced its methodology for measuring physical risk in gas pipelines and taxonomic projects, considering for each of the threats included in the CSRD, the probability of occurrence and economic impacts in the following dimensions: material damage, gas leaks, health and safety, interruption of service and environmental damage, under the TCFD temperature scenarios RCP.4.5 and RCP 8.5 and different time horizons, up to 2100.
For further information, please refer to the ‘Climate Change’ section of Enagás’ Annual Report.
Within its Corporate Risk Management Model, Enagás places particular emphasis on identifying changes in its operating environment in order to capture external events and megatrends that may have a significant long-term impact on the company’s business or the energy sector. This enables the company to identify the most significant threats, anticipate their potential effects, and implement appropriate mitigation measures.
Emerging risks are characterised by their unpredictability and uncertainty. They are risks that have not previously been encountered and for which there is limited knowledge or preparedness, making it difficult to quantify their potential impact through long-term forward-looking scenarios. The proactive management of these risks is essential to prevent possible adverse effects and deviations from established objectives, and, where necessary, to mitigate their impact through preventive, control and response measures.
Emerging risks are identified by the business areas (the first line of defence) during the risk assessment exercises carried out across the organisation.
During 2025, the operating environment continued to be marked by high levels of volatility and uncertainty, driven by a complex geopolitical context characterised by the escalation of armed conflicts, increasing tensions between countries, the adoption of protectionist policies, the transformation of business models, and the accelerated deployment of new technologies such as Artificial Intelligence. These developments have resulted in exposure to new and evolving risks.
Beyond the risks currently reflected in the Risk Map of the 2025-2030 Strategic Plan, Enagás has identified additional risks that may become significant in the future. Further details are available in the “Emerging Risks” section of the Enagás Annual Report.
Furthermore, as part of the 2025 annual risk assessment process, Enagás incorporated four of the five risks previously reported as emerging risks in 2024 into its corporate risk inventory:
In the latter case, the risk includes an ESG component and has also been incorporated into the company’s double materiality assessment.
You may also be interested in...
Help us improve