Van Oord’s Executive Committee is responsible for an effective risk management and internal control system, supported by our Integrated Risk Management framework that aligns risk activities across projects, business units and corporate functions and is built on standards such as ISO 31000 and COSO (Committee of Sponsoring Organisations of the Treadway Commission). This framework enables informed decision-making, promotes accountability and risk awareness, and embeds risk management throughout the organisation.

Risk management process

Van Oord’s risk profile is dynamic and shaped by periodic risk assessments at the corporate and business unit levels. These assessments consider likelihood, impact and mitigation effectiveness and inform the key risks disclosed in this report. Trends and forecasts are evaluated to examine how developments can influence overall performance and risk maturation.

Governance

Risk management is embedded throughout the organisation. Corporate and business unit risk committees meet quarterly to review risks, define and implement mitigating measures, and ensure cross-functional and inter-business unit alignment where appropriate.

Project risk management

A structured project risk process supports decision-making throughout the acquisition, tender and execution phases:

• Stage gate approach: All tenders and projects are categorised according to their risk profile to ensure early identification and appropriate management of key risks.

• Risk registers and mitigation: Mitigation planning and continuous improvement are informed by standardised risk registers, provisions informed by backtesting, scenario analyses and lessons learned.

• Risk tolerance model: The overall risk exposure is periodically assessed versus Van Oord’s risk tolerance based on a model that integrates historic data, risk capacity and tolerance indicators.

Digital enablement

Aligned with our Founding the Future programme, digital tools and data analytics increasingly support risk identification, monitoring and reporting, which improves the quality and consistency of risk insights. For example, automated dashboards and statistical analyses are being developed to detect emerging risk patterns and assess potential impacts, supporting timely and targeted mitigation actions.

Learning, change and communication

A culture of learning and shared responsibility underpins our approach to risk management. Training, communication and structured feedback loops reinforce awareness and capability across the organisation.

Policies and procedures

Policies are reviewed to reflect evolving standards and organisational needs. All policies and procedures are accessible through the Van Oord Management System.

Risk appetite

Van Oord accepts a certain degree of risk to achieve its objectives. We aim for a healthy balance between risk and return, recognising that investments are required to remain competitive and realise our long-term objectives. Risks are carefully considered, with proper controls in place. Our risk appetite per risk type is as follows:

• Strategic risks: We apply a balanced risk appetite. We pursue opportunities where possible while remaining realistic about what can be achieved in a volatile and complex international environment.

• Operational risks: We maintain a cautious to balanced risk appetite, limiting exposure through diversification, and structured project and portfolio management. For safety risks, we are cautious as safety always has the highest priority. For cybersecurity risks, we are averse due to the potentially severe impact on operations.

• Financial risks: These include currency, interest rate, liquidity, commodity and counterparty risks. We have a cautious risk appetite to safeguard our financial position, cash flow and compliance with banking covenants.

• Legal & compliance risks: We maintain an averse risk appetite and zero tolerance for non-compliance or behaviour that breaches integrity, reflecting our commitment to ethical and responsible business conduct.

Risk matrix

Van Oord monitors key risks through heatmaps reviewed by the Executive Committee and Supervisory Board. After considering mitigating measures, the overall risk profile has remained broadly consistent with the 2024 profile. The risks that could impede the achievement of our strategic objectives are displayed in the following graph and are outlined in the following table.