Risk management
Epiroc has customers in around 150 countries, which implies both risks and opportunities. Effective risk management will help improve the performance of the organization and enhance Epiroc’s ability to achieve its objectives.
Responsibilities
The Board of Directors (Board) is responsible for internal control of Epiroc's operations and related risks. The risk management work follows Epiroc's decentralized structure. Local risk management is owned by entities, which is monitored and followed up regularly at local meetings. The Group functions for law, risk and insurance, financial management, governance, tax and accounting provide policies, guidelines and instructions for risk management including support with standards and templates to create uniform approach to risk management within Epiroc entities. The Board has adopted overall financial policies and monitors compliance with the policies.
The Group's Financial Risk Management Committee (FRMC) manages the Group's financial risks within mandates given by the Board. The members of FRMC are the President and CEO, CFO, Group Treasurer, Manager risk management and funding, and Manager Treasury Control. The FRMC meets once a quarter or more often if circumstances require. The Audit Committee receives reports from the FRMC at each meeting.
Group Treasury has the operational responsibility for financial risk management in the Group. Group Treasury manages and controls financial risk exposures, ensures that appropriate financing is provided through loans and committed credit facilities and manages the Group's liquidity. See note 29.
The implementation of policies, guidelines and instructions for financial reporting and financial risk management is regularly reviewed through internal audits.
The crisis management process is managed by the Chief Technology Officer. However, any disruptive or unexpected event should, as far as possible, be handled close to the incident's origin.
Epiroc has a communications policy to ensure that Epiroc complies with applicable laws and fulfills the regulations and recommendations issued by Nasdaq Stockholm as well as the Swedish Corporate Governance Code.
Insurance
Epiroc has global insurance programs to respond to risks transferable to insurance. These programs include property damage and business interruption insurance, cargo insurance, general liability and product liability insurance, cyber insurance, financial lines insurance to protect management liability and business travel insurance, to the extent and for amounts considered to be in line with industry practice. Insurance can never protect against all possible risks, including reputational impacts. Risk Management and insurance procurement therefore include a loss prevention standard for Epiroc global against which entities are measured to identify areas for improvements.
Sustainability reporting and the European Sustainability Reporting Standards (ESRS)
Assessment of risks arising from environmental, social or governance issues are included in the Enterprise Risk Management process and part of the double materiality assessment. Material risks are reported in the Sustainability statement in accordance with the European Sustainability Reporting Standards.
Compliance
Compliance with applicable legislation and other compliance obligations is fundamental for Epiroc and Epiroc is committed to adhering to all applicable and relevant compliance obligations in the countries in which it operates. Group Compliance identifies compliance risks at Group level, implements adequate policies, provides information about compliance through internal communication, and provides training and digital tools to ensure that Epiroc and its employees around the world have the appropriate knowledge for correct decision making.
Regional Compliance Officers have responsibility to support and control all entities in their specific region in relation to applicable legislation, entity specific compliance risks and Group Compliance programs.
Epiroc also has a forum called Legal and Compliance Board that provides strategic direction, oversight, and support to ensure that Epiroc’s Group Legal and Compliance functions align with business objectives, regulatory requirements, and ethical standards. Members of the Legal and Compliance Board: Senior Vice President General Counsel (Chair), Vice President Group Compliance, Vice President Head of Legal, Vice President Internal Audit & Assurance, Business Area President Equipment & Service and Business Area President Tools & Attachments.
Code of Conduct and Business Partner Code of Conduct
The Code of Conduct describes who we are as a company and what we stand for. It outlines the appropriate business conduct and expected behaviors we all must follow to live up to the high ethical standards and integrity we hold ourselves to. Financial results are important and a measurement of success, but just as important is how we achieve these results.
For Epiroc, conducting business in a responsible manner is of great importance. Epiroc chooses to work with business partners who stand behind the quality of the goods and services they provide and act in accordance with high ethical standards and integrity.
Enterprise Risk Management
Epiroc has a methodology for enterprise risk assessment covering all divisions. Risks are identified based on Epiroc Risk Universe within divisional ownership with the overall goal of evaluating risks and remove or mitigate their effects by researching, planning, and implementing control measures as the organization deems necessary.
The purpose is to identify, understand and visualize potential risks before they occur, provide a safer and healthier working environment for our staff, and reduce risk for the business to strengthen business continuity. In more detail, the purpose is to answer essential questions as to the probability of risks materializing, their impact, causes and possible consequences, the effectiveness of existing controls and any further actions needed.
Risks assessed are captured in four main risk areas:
- Strategic risks: Includes emerging and macro development risks.
- Business risks: Encompasses common industry risks and risks related to the Epiroc business model, including operational risks.
- Financial risks: Covers financial reporting risks.
- Compliance risks: Focuses on avoiding breaches of applicable legislation or regulations.
Additionally, Sustainability is addressed as a fifth area to capture potential risks not identified in the other areas. However, many sustainability risks and impacts are integrated within the other risk areas. More detailed information on sustainability risks is presented in Epiroc’s double materiality assessment under ESRS 2 in the Sustainability statement and in each topical section. The consolidated outcome of the risk assessment is reported to both Group Management and to the Board of Directors, who monitor risk management annually.
In the model below our key risks, as identified in Enterprise Risk Management assessment process, are presented. These have the greatest risk factor, by negative impact, and the closer to the middle they are, the more probable. Other risks, such as insurance, reputation as well as product quality and liability cover all four areas. Our mitigating actions and opportunity per key risk are described on the following pages.
Key risks, risk mitigation and opportunities
Strategic
Key risk and description
Risk mitigation
Opportunities
Geopolitical changes
Instability and geoeconomic conflicts, such as changes in government, military intervention, war or rising tensions between countries, may lead to regulatory changes and protectionist trade measures that affect Epiroc’s industry, supply chain and geographical markets. Pandemics and related political regulations and restrictions may also have significant impacts on Epiroc’s operations, including production, equipment deliveries and aftermarket services, as well as on customers and suppliers.
Regular discussions and updates on all business levels on geopolitical situations, footprint, targeted M&A, sales perspective, and responsive actions.
Planning for responding activities to identified geopolitical risks gives Epiroc a flexibility to adapt when circumstances change and improves Epiroc’s competitive position.
Industry and market developments
Demand for Epiroc’s equipment and services is influenced by shifts in customers’ investment plans and production levels. These shifts may occur due to economic downturns, geopolitical tensions, and volatility in mineral commodity prices. As a result, customer expectations and purchasing behavior can change significantly.
A significant aftermarket requirement over the equipment lifecycle creates a large and resilient service business.
A flexible manufacturing setup with a large share of components purchased from suppliers.
Opportunity to further develop the after-market business and increase customer satisfaction and retention.
Lean initiatives in manufacturing enable a more agile setup with enhanced flexibility.
Competition
The markets are highly competitive in terms of pricing, product design, service quality, development and launch timing, customer service, and financing terms. Epiroc faces strong competition from established players as well as, increasingly, from companies operating with lower costs and margins. Further consolidation among competitors, where Epiroc does not participate effectively, could weaken the company’s market position.
Continuous analysis and monitoring of market external factors and customer preferences to compete successfully and anticipate and respond to changes in evolving market demands, including demand for new products including a corresponding mergers and acquisitions strategy.
Development of high-quality solutions that are in line with customer demands such as increased productivity, lower total cost of ownership and reduced environmental impact.
Opportunities to continuously increase operational efficiency and lower costs of operations and improve competitive position.
Acquisitions and divestments
Failure to meet synergy effects as anticipated and failed integration affecting the business negatively.
Clear process for mergers and acquisitions and focused project management for integration.
Integration process enhanced, leading to speed and efficiency of integration and realization of synergies.
Business
Key risk and description
Risk mitigation
Opportunities
Cyber security and information
Epiroc faces potential business interruptions due to cybercrime, disruptions to critical IT services, or breaches of its information systems. These incidents may result in the loss of intellectual property, operational downtime, and reputational damage, leading to adverse effects on financial results. Some risk drivers are third party risk, expanding digital footprint and a fast-evolving threat landscape.
Epiroc’s cyber security program enhances risk management through security awareness training, strengthened data protection, identity & access management and improved monitoring, aligned with regulatory and legislative requirements, and improved resilience to adverse events. Group Information Security provides quarterly updates to Group Management and semi-annual briefings to the Board.
Enhancing cyber security and resilience supports Epiroc’s strategic growth by meeting rising customer expectations, enabling secure digitalization and automation, and reinforcing its competitive position.
Strong cyber security practices build trust, protect assets, ensure regulatory compliance, and reduce operational and financial risk, contributing to improved brand value, business continuity, and investor confidence.
Climate transition
Risks associated with the transition to a low-carbon economy include lack of compliance with new product requirements and environmental and climate-related legislation, and failure to develop, launch and market new products or respond to technological development and customer demand for sustainable products.
Continuously monitoring environmental and climate-related legislation and establishing relevant mechanisms.
Within innovation, improved environmental performance is always an important component.
The Board performs an annual oversight of risks, including environmental and climate-related risks.
Increasing demand for sustainable equipment is met by developing products and services and/or expanding offering with better environmental performance.
Battery technologies and connected equipment and other solutions can add value and help drive the transition to low-carbon solutions.
The 2030 sustainability goals lead the organization towards halving CO₂e emissions in Scope 1, 2 and 3.
Intellectual property risks
Intellectual property rights (IPR) grant the right to prevent others from using certain business rights. Epiroc may face freedom to operate (FTO) risks restricting design options during product creation and after product launch.
Additional risks include costs related to creation of our own IPR portfolio like challenges to rights or ownership and any restrictions on the use of our own IPR portfolio.
IPR strategies, processes and systems are structured to align with Epiroc’s business needs and product development requirements. Defined roles, responsibilities, and agile working methods are in place for IPR risk mitigation, portfolio creation, portfolio management and utilization. IPR due diligence is integrated into M&A activities. IPR awareness training is mandatory for R&D staff and available to all employees.
A targeted approach to IPR portfolio growth has led to an increase in enforceable patents. A robust IPR portfolio supports business stability and enhances Epiroc’s competitive position by providing unique solutions and increasing attractiveness as a business partner.
Recruit and retain key personnel
Failure to attract and retain key teams and employees imposes a risk of losing the leading position on the market.
If Epiroc fails to monitor its need for employees or if it fails to continue to attract and retain highly qualified management and other skilled employees on acceptable terms, the company may experience difficulties in sustaining or further developing parts of its business.
Recruitment can take place both externally and internally.
Epiroc strives to maintain good relationships with unions and universities.
Allowing remote work (depending on position) and encouraging virtual cooperation.
Fostering internal mobility within the company through an internal job market. Training and development programs.
Parental leave policy granting a minimum of 12 weeks of paid parental leave across the global organization.
Proactive performance management and development of employees with their managers.
An employee survey is carried out every year and followed up actively.
Employer branding activities and solid onboarding programs.
Ambitious targets for employees and managers, aligned with business targets, with accountability for results and in an environment of trust and individual responsibility.
The 2030 sustainability goals lead and encourage the organization towards improved safety and increased inclusion and diversity.
Supply chain
Incorrect deliveries, failure to fulfill delivery obligations or inadequate capacity at suppliers could cause delays or failures in deliveries, which in turn may cause reduced sales and a decline in customer confidence.
Supply disruptions could arise from shortages of raw materials, labor disputes, weather conditions, transportation disruptions or other factors beyond Epiroc’s control.
Risk that Epiroc’s business partners do not share the same values as expressed in Epiroc Business Partner Code of Conduct. US tariffs and other trade wars have a negative impact on profitability.
Select and evaluate business partners based on objective factors including quality, delivery, price, and reliability, as well as commitment to environmental and social performance.
Screening of selected business partners. Inventory control and establishment of regional networks of sub-suppliers, to prevent supplier dependency.
Providing suppliers with timely and sufficient information to manage changes in volumes. Business partners to sign the Business Partner Code of Conduct.
Continue the process to investigate and remove the potential presence of conflict minerals in the value chain.
Increase business agility and reduce costs by improving supplier inventory management in response to changes in demand.
Continue to be a preferred business partner and promote efficiency, sustainability, and safety.
Reducing the risk of corruption and conflicts by promoting human rights and working towards improving labor conditions.
Leverage our global supply footprint to gain competitive advantage in an age of tariffs and trade wars.
Implementation of the 2030 sustainability goals leads towards halving CO₂e emissions for relevant suppliers and ensuring compliance with the CoC.
Product development and quality
Several markets are characterized by technological advances and changes in customer preferences. Risks arise from failure to develop, launch and market new products in response to customer demand for productivity, circularity and sustainability.
Product development is affected by legislation on matters such as emissions, noise, vibrations, pollution and recycling. This may increase the risk of competition in emerging markets where such legislation is sometimes less strict.
There is also a risk of substitution of existing Epiroc products and services with lower-emission options from competitors. Any defective products will impose a risk of product liability and damage to third party property or causing bodily injury.
Continuous investments in research and development to develop products in line with customer demand and expectations.
Design of products with a lifecycle and circular perspective.
Design of products with reduced emissions, vibrations or noise and increased recycling potential to meet legislative requirements.
Ongoing standardization of process for quality control (test, verification and validation).
Ensuring that supplier management has the same level of quality assurance on vendors and suppliers.
Substantial opportunities to strengthen competitive edge by innovating high quality, sustainable products and creating an integrated value proposition for customers as well as meeting external environmental risks.
Implementation of the 2030 sustainability goals leads the organization towards halving CO₂e emissions in operations, transport and use of products.
Promotion of the integration of the Sustainable Development Goals into operations.
Targeted activities contribute to limiting Epiroc’s exposures.
In addition, quality-assured products can increase customer retention, improve reputation and increase people safety.
Safety and health
Failure to comply with safety and health standards can result in accidents that harm individuals, disrupt productivity, and damage Epiroc’s reputation.
Additionally, health and safety regulations are becoming more complex and potentially costly.
Safety and health risks are routinely assessed and managed as part of standard operation procedures.
Employees working in areas with exposure to safety risks are equipped with appropriate personal protective equipment. Wide range of trainings for employees and customers are provided.
Epiroc’s Safety Management System ensures consistent practices across the organization.
All major units are certified according to the ISO45001 standard. Building a strong safety-first culture is a key priority.
Initiatives such as Dare to Speak Up, Epiroc Safety Day and Stop Work Authority, along with strong safety leadership, promote awareness and engagement.
Enhancing safety and health not only boosts productivity but also strengthens the satisfaction and well-being of employees and business partners.
Actively striving towards an injury free workplace, also with the implementation of the 2030 sustainability goals. lead the organization toward a safer, healthier, and more resilient work environment.
Inclusion and diversity
Improper inclusion can lead to lack of innovation, poor efficiency, and loss of business opportunity.
Also leading to safety and health issues, potential claims depending on region and a bad reputation.
Ensuring a diverse talent pool in Epiroc by having professional recruitment processes with talent acquisition specialists, onboarding and training and development programs.
Promoting a culture towards safety leadership.
Epiroc’s whistleblowing function Speak Up and compliance processes support transparency in matters where advice is sought, or concerns are raised about a potential ethical or legal violation by employees or business partners.
Varied perspectives foster creativity and innovation.
Better problem-solving and decision-making due to varied experiences and viewpoints.
Higher employee satisfaction and engagement, leading to better performance.
Easier to attract talent from a wider range of backgrounds, enhancing competitive edge.
Production
Epiroc’s entities can face disturbances caused by, for example weather extremes, machinery breakdown or a major fire leading to interrupted business and loss of business income as well as causing reputational risks.
Global implementation of Epiroc's Loss Prevention Standard focusing on people safety and business continuity.
Entities, including newly acquired companies, are measured against our standard. The outcome provides an overview of improvement areas and recommended actions in order of priority.
Business continuity planning prepares managers and the Epiroc business on how to act in response to disruptions.
Recovery is an essential factor in the case of disruption to keep commitments to suppliers, customers and employees and limit our exposure to financial loss.
Compliance
Key risk and description
Risk mitigation
Opportunities
Compliance risks: data privacy, trade compliance, fraud and corruption
Violation of laws on anti-bribery and corruption, trade compliance, anti-trust and competition and data privacy may result in fines, claims for compensation and other financial damages as well as impairing Epiroc's reputation.
Inadequate internal controls could result in Epiroc becoming more vulnerable in relation to individual employees acting in breach of the applicable legal framework, either by mistake or intentionally.
Deficiencies in internal control could also cause investors and other third parties to lose confidence in Epiroc’s reported financial information.
Mandatory training in Epiroc's CoC for all employees with a requirement to sign a CoC statement, and advanced training for certain employee categories.
Support for entities from Regional Compliance Officers and in-house lawyers providing advice on applicable laws and regulations.
Epiroc’s internal policies and guidelines are published in the Epiroc Way.
Training and digital tools to ensure that Epiroc and its employees around the world have the right knowledge for correct decision making.
The Legal and Compliance Board provides strategic direction, oversight, and support. The Compliance Board´s mission is to ensure that Epiroc’s CoC is implemented and complied with.
The CoC and Group policies on how companies should conduct business responsibly will help ensure the trust of our stakeholders.
Compliance with legal norms and laws minimizes costs. Implementation of the 2030 sustainability goals supports compliance with the CoC.
Financial
Key risk and description
Risk mitigation
Opportunities
Currency, financial reporting and accounts receivables
Risk areas such as currency, credit and counterparty, hedging, commodity price, tax reporting, and the risk of Epiroc encountering difficulties in repaying its debts and financing its operations.
Reporting risks are risks that financial reports will not give a fair view of Epiroc’s financial position and results.
There is also a risk that impairment of goodwill or other intangible assets will adversely affect the financial results.
Epiroc's policies are available on the Epiroc way.
The Group manages the risks via Financial Risk Management Committee (FRMC) with a mandate given by the Board.
Group Treasury has an operational responsibility for financial risk management in the Group and reports to FRMC who reports to the Audit Committee.
A proven process for risk management for financial risks contributes to compliance with financial laws, agility and trust and hence strengthens the position for Epiroc as a trusted business partner.
Other
Key risk and description
Risk mitigation
Opportunities
Insurance
Epiroc's insurance policies may provide insufficient protection.
Global insurance programs, arranged by Group Risk Management and Insurance, lead to adequacy and cost-efficiency via optimization of risk transfer levels and supporting the business to understand insurance applicability.
Cost-efficiency and control, enabling business and to meet customer and supplier commitments.
Reputation
Harm to Epiroc’s reputation and negative impact on business results can be the result of various reasons; if customers lose confidence in the safety and quality of the products and services provided, if the quality of the products and services offered by Epiroc deteriorates, including timing of delivery or quality and availability of products, whether due to a mistake by Epiroc or a third party, if Epiroc fails including via business partners or customers to comply with laws, regulations, ethical, social, product, labor, health and safety, environmental or other standards, or related political considerations.
Epiroc may be subject to complaints and lawsuits from customers, employees, suppliers and other third parties, alleging product damage, health, environment, safety, data protection, antitrust, corruption, money laundering, export restrictions or operational concerns, nuisance, negligence or failure to comply with applicable laws and regulations.
All products are tested and quality assured.
Monitoring product labeling and regular communications training. Epiroc has a clear well-known brand.
The Group actively engages in stakeholder dialogue.
The mandatory CoC training includes annual signing of a CoC Compliance Statement.
Reporting of ethical and legal violations via the whistleblower system (or functions),
Speak Up, is encouraged via various communication channels including physical posters at our locations.
Stakeholder engagement can increase the awareness and credibility of Epiroc’s brand through collaboration and adoptability.
Quality assured products improve customer satisfaction and promote recurring business.
Increased access to new and emerging markets.
The CoC with principles for how companies should conduct business responsibly helps Epiroc to safeguard its reputation and the trust of stakeholders.
A high social and environmental profile is particularly important since Epiroc is present in many regions where the impacts from climate change may be severe and resilience low.
Implementation of the 2030 sustainability goals helps to ensure compliance with applicable legislation.
Product quality and product liability
Any defective products will pose a risk of product liability and damage to third party property or causing bodily injury.
Ongoing standardization of process for quality control (test, verification and validation).
Ensuring that supplier management has the same level of quality assurance on vendors and suppliers.
Targeted activities contribute to limiting Epiroc’s exposures.
Furthermore, quality-assured products can increase customer retention, improve reputation as well as people safety.