Risk

management

Risk management at BlueScope

BlueScope is committed to an integrated approach to managing known and emerging risks, both financial and non-financial. We aim to maintain a proactive risk culture that supports a balanced approach to managing uncertainty in the delivery of strategic objectives and commercial outcomes.

BlueScope’s Risk Policy articulates the approach and commitment to managing risk across the organisation. It establishes the principles and governance that support the effective identification, assessment and management of risk. This enables informed decision-making, operation within Board-approved risk appetite, and the achievement of strategic objectives. The Policy provides the foundation for the Risk Management Framework, through which risk management is embedded across BlueScope.

Our risk management framework – an overview

BlueScope's Risk Management Framework sets out the policies, processes, and responsibilities for identifying, assessing, managing and monitoring risk across the Group.

The Board-approved risk appetite settings provide guidance on the level and type of risk the Company is willing to accept in pursuing its strategy. Applied across the Group risk taxonomy, these settings support decision-making and guide the management, escalation, and oversight of risk. Performance against the risk appetite settings is reported quarterly to the Audit, Risk and Technology Committee.

The Framework is based on the Three Lines Model (depicted above), which clarifies roles and responsibilities for risk management, oversight and independent assurance. The Board retains overall oversight of risk management and is supported by the Audit, Risk and Technology Committee and other Committees in fulfilling its responsibilities.