Corporate leadership

Effective governance, risk management, and oversight are also essential to delivering our sustainability commitments and ensuring compliance with evolving legal, regulatory, and ethical standards globally. They are critical to maintaining the trust and confidence of all our stakeholders – from customers and local communities to our value chain partners, investors, and employees.

Our sustainability governance and compliance framework is based on three pillars: our alignment with industry-leading international standards, clear internal governance structures and a focus on enterprise risk management. Together, these mechanisms ensure that our policies and commitments are not only defined and overseen at group level, but are also consistently implemented, monitored, and assured in practice across our operations.

Across the business we seek to align with evolving international sustainability standards and reporting guidelines including the UN Guiding Principles on Business and Human Rights, the EU’s Corporate Sustainability Reporting Directive and its Due Diligence Directive, together with the International Financial Reporting Standards/Sustainability Disclosure Standards, amongst others.

In particular, third-party certification through ResponsibleSteel^TM plays an important role in translating our governance and risk management systems into verified site-level performance, providing independent assurance that our policies, procedures, and controls are effectively embedded and delivering positive outcomes on the ground. The ResponsibleSteel^TM site certification is a rigorous, independent assurance process that evaluates a steel site’s operations against comprehensive environmental, social, and governance management criteria. Certification is awarded for a three-year period, and is subject to ongoing oversight, including regular surveillance audits, the timely resolution of any non-conformities, and clear evidence of continuous improvement in order to maintain certified status. Many of our sites have achieved the ResponsibleSteel^TM certification. The full list of our certified sites can be found on the ResponsibleSteel^TM website.

Our governance structure is based on three board committees - the Audit and Risk Committee, the Appointments, Remuneration, and Corporate Governance Committee (ARCG Committee) and Sustainability Committee.

Oversight on sustainability topics (including health and safety, climate change, environment, community relations, customer reassurance, innovation, and catastrophic risks such as tailings management) sits within the existing governance structure. The Sustainability Committee review strategy and progress, while implementation remains the responsibility of local leadership - chief executive officers (CEOs) - in line with operational accountability.

A series of management committees and panels operate below the board, covering management, corporate finance and tax, investment allocation, health and safety, climate change and sustainable development. Details of each committee, their remit and composition can be found below.

We apply a disciplined and forward-looking approach to the management of risk across the group to identify, assess, and manage potential threats to our people, assets, and operations. It is regarded as part of our wider corporate governance structure to protect and build the value of the business.

Corporate management is responsible for the establishment of internal controls and has defined on an ongoing basis a robust management and control system covering short-, medium-, and long-term risks, including ESG and climate-related risks. This is designed to ensure the business is focused on achieving its objectives and that potential significant risks, whether physical, economic or reputational, are identified and mitigated. Operational management (local leadership – CEOs) are responsible for implementing this system. The process consists of risk identification, risk analysis, inherent risk evaluation, risk treatment, and residual risk evaluation.

Risks are owned and monitored by operational management with risk officers designated by local CEOs to facilitate the conversations and help monitor action plans. Critical risks are escalated through existing reporting lines.

The Audit and Risk Committee assists the board with the oversight of risks to which the group is exposed and in monitoring and reviewing the risk management framework and process.