Page 15 - Parmalat 2017 Consolidated Statement

Main risks of non-financial nature

The Parmalat Group has been using for some years an Enterprise Risk Management (ERM) model. Through this
model, called RiSA (Risk Self-Assessment), the main risk inherent in the exercise of business activities can be
mapped, assessed and managed transversally; they can then be monitored and mitigation plans can be defined.
This risk management model also provides support for management’s strategic choices and the decision-making
process and fosters the creation of value for the stakeholders over the long term.

Risk and uncertainties are mapped at the country level through a self-assessment process that calls for their
assessment based on the probability of occurrence and impact. Risk events are mapped taking into account the
Group’s strategic objectives and, based on their nature, are classified into four categories: strategic, operational,
compliance and reporting. Subsequent to the assessment activity, when necessary, risk mitigating measured are
introduced, followed by the definition of action plans, the implementation progress of which is monitored by the
Internal Auditing function.

In addition to the ERM process, the Parmalat Group relies on specific safeguards developed within its business
management systems. In that regard, the Group adopted a series of protocols/management system that provide
protections against specific risks regarding various topics including: the environment, occupational health and
safety, food safety, quality and fight against corruption (by way of example: OHSAS 18001, ISO 14001, ISO 22000,
ISO 9000, ISO 22005, IFS, BRC, HACCP and the Organization, Management and Control Model pursuant to
Legislative Decree No. 231/01). With regard to each topic, the Group engages in continuous improvement
activities that facilitate an effective management of non-financial risks.

The main risks of a non-financial nature identified through the activities pursued by the Parmalat Group that are
related to the topics expressly mentioned in Legislative Decree No. 254/2016 include the following:

• risks related to personnel management and human rights (e.g., risks related to the loss of ability to attract
talented resources, risk of non-compliance with regulations);
• risks related to occupational health and safety;
• risks related to the health and safety of consumers (e.g., the risk deriving from an alleged non-conformity
of a product);
• environmental risks;
• risks related to the engagement with local communities (e.g., reputational risk);
• risks related to supply chain management (e.g., risk of excessive harmful emissions caused by transport
vehicles, market unpredictability);
• risks related to active and passive corruption (e.g., risk of fraud and corruption related to the
procurement process and risk of fraud and corruption in the sales and marketing process).

The risks listed above and the mitigation activities and management policies for the corresponding topics are
reviewed in the paragraphs that follow.

Consolidated Non-financial Statement at December 31, 2017 Pursuant to Legislative Decree No. 254/2016 15