The company does not mention any specific risk assessment method.

pg. 2

"The Audit function:

• assesses risks and update the Audit risk assessment, jointly with the relevant process owners;

• prepares the yearly risk based audit plan."

pg. 7

"In relation to the Human Rights risks, following the Human Rights Policy, it is necessary also to highlight that a specific of Operating Procedure (n. 847) has been also issued in order to have a common operational framework among the countries of Enel Group to perform a Due diligence on the management system of the country. This process is also fully described in the Sustainability Report of Enel Group. The procedure provides a country risk assessment in order to understand the perceptions of the local human rights risks by the main stakeholders categories, to evaluate any gap in processes and procedures and to address them in specific improvement plans."