Ferrexpo (FEX) Risk Analysis
Risk Overview Q4, 2021
Risk Change Over Time
No filing history is available.
- Cyber Security - Risk 1Risks relating to information technology and cybersecurity
Russia's invasion of Ukraine in early 2022 has created a significant risk related to cybersecurity at the Group's operations in Ukraine, with details of this risk and mitigation measures, presented on page 37. The Group is continually looking to modernise and digitise its operations, and is increasingly looking towards information technology ("IT") to operate its business model. The move towards increasing digitalisation presents an increasing exposure to parties that may wish to disrupt the Group's operations for financial gain, competitive advantage over the Group or to inflict other negative consequences on the Group for other reasons. Cybersecurity threats may take the form of, but not limited to, the following: malware, ransomware, phishing, denial-of-service attacks, and password attacks. Cyberattacks have been noted on a global scale in recent years, as well as similar attacks that have been specifically targeted against sovereign nations, such as the NotPetya ransomware first noted in 2017 that is believed to have been targeted at entities in Ukraine, or the Colonial Pipeline cyberattack in May 2021 that shut down 45% of the United States' East Coast fuel supply.[28] Such events appear to be becoming increasingly frequent, with increasing impact on the entities subjected to such attacks. Events such as cyberattacks are not necessarily targeted at specific companies or sovereign states, but often inflict additional damage to companies and governments not directly connected to the original targeted entity, and therefore such attacks may appear random in nature and difficult to predict as a consequence. Cyberattacks, such as malware and ransomware, are often unreported in the mainstream media by companies and governments to avoid the negative publicity associated with such events. It is therefore difficult to ascertain the full extent to which the Group is facing risks relating to cybersecurity. Published cyberattacks affecting companies and governments in the past have closed or limited a company's ability to produce, have withheld or disclosed confidential information, and have withheld access to key operational infrastructure, in addition to other attributes of such events. Risk mitigation Ferrexpo conducts regular reviews of the different information systems and technologies in use across its business, to ensure that information systems and technologies are regularly maintained and up-to-date in terms of security protocols. The Group's IT department conducts regular reviews of the general IT landscape and provides regular cyber awareness training for employees as well as ad hoc notification when new threats are identified. The Group also regularly reviews requirements on data protection, with email security bulletins circulated to ensure internal users of IT are provided with up-to-date information on cybersecurity. The Group has also implemented a dynamic approach to anti-malware policies, to ensure an adaptive approach for new threats as they emerge. Efforts in 2021 have centred around the procurement and installation of a dedicated on-site data centre at Ferrexpo's operations with backup power, with elevated security protocols to ensure the Group's continued access to its data and IT systems in the event of a cyberattack. Further to existing practices and protocols, the Group regularly updates the software and hardware in use throughout its business, to remove the Group's exposure to known weaknesses in cybersecurity. Responsibility Chief Executive Officer Risk appetite Low Link to strategy 1, 2 and 3 Change: Increased
Risk Highlights Q4, 2021
Risk Word Cloud
Risk Factors Full Breakdown - Total Risks 14
- Manufacturing - Risk 1ChangedRisks relating to health and safety
Russia's invasion of Ukraine in early 2022 has created a significant risk related to the health and safety of the Group's workforce in Ukraine, with details of this risk and mitigation measures, presented on page 37. The extraction and processing of large volumes of rock has historically been associated with hazardous working environments. Hazards in open pit mining include hazards relating to drilling and blasting of rock, the presence of operators on and around large pieces of equipment such as excavators and haul trucks, and the creation of deep open pit mines with steep inclines. In processing, operators are in close proximity to large pieces of equipment such as crushers and ball mills, all of which carry significant electrical currents, weigh a significant number of tonnes and are constantly moving when under operation. Maintainers are often required to place themselves within equipment to access and repair equipment, and are often required to use lifting equipment to raise machinery weighing several tonnes. The risks to operators conducting these activities, or in close proximity to those conducting these activities, can be high if the correct risk mitigation measures are not enforced. There are inherent risks with materials handling throughout the Group's operations - from hazardous chemicals, flammable liquids and gases, and other dangerous goods. In logistics, the Group oversees the transfer of significant volumes of iron ore pellets loaded onto trains, dry bulk vessels and inland vessels, all of which carry inherent risks. The Group's logistics subsidiary, First-DDSG, transports pellets along the Danube River in all seasons, with specific safety hazards applicable to river transport throughout the year, including operating in freezing conditions and river safety around other vessels. In addition, the Group and its workforce have faced significant health and safety risks relating to the global Covid-19 pandemic. Details of the risks relating to this are provided on page 51 of the Principal Risks section, with risk mitigation measures also provided in the Case Study on page 8 of this report. Risk mitigation Risk mitigation in the Group's approach to health and safety begins with understanding the risks faced by operators when entering a place of work. This is achieved through risk assessments for each area and activity in which an operator is active, aiming to ensure that potential risks are understood before work takes place. Extensive safety training is provided to both operators and management, to provide the necessary level of understanding of the risks faced and the high level of safety standards expected by the Group. Training is provided to both employees and contractors, since safety hazards do not distinguish between an individual's contract status. The Group uses leading and lagging safety indicators to better understand where safety risks may exist. An example of a leading indicator of safety is the number of safety audits conducted by the Group's safety department, which correlates to the degree of safety improvements made in each working area, and therefore reducing the potential for future incidents to occur. Lagging indicators of safety relate to safety incidents that have already occurred, such as near miss events, and the Group monitors these closely to learn and improve for the future, to reduce the number of these events occurring. Increases in a lagging indicator are often an aspect of encouraging employees to register incidents correctly and to promote an open and understanding culture when it comes to safety. In relation to the safety and wellbeing measures implemented in response to the global Covid-19 pandemic, the Group has sought to protect both its workforce and its local communities, with details of these measures provided on pages 8 and 32 of this report. In 2021, through implementation of the above safety measures, the Group was able to report on a fatality-free year and a record-low full year lost time injury frequency rate since IPO of 0.41 (2020: 0.79). Responsibility Chief Executive Officer, Chief Operating Officer and Chief Marketing Officer Risk appetite Low Link to strategy 1, 2, 3, 4 and 5 Change: Increased
See a full breakdown of risk according to category and subcategory. The list starts with the category with the most risk. Click on subcategories to read relevant extracts from the most recent report.