Repsol YPF

The control systems established to assess, mitigate, and reduce the main risks

Repsol YPF operates in numerous countries, under numerous regulatory frameworks and in all areas of the oil and gas business. Consequently, Repsol YPF is exposed to:

- Market risks, deriving from the price volatility of oil, natural gas and by-products, exchange rates and interest rates.  
-Counterparty risks, deriving from financial arrangements and commercial commitments with suppliers and clients. 
-Liquidity and solvency risks. 
-Legal and regulatory risks (including risks of changes in the tax regimes, sectorial and environmental regulations, exchange legislation, production constraints, limits on exports, etc.). 
-Operating risks (including the risk of accidents and natural disasters, uncertainties relating to the physical properties of crude oil and gas fields, safety and environment, and risks of reputation, such as those relating to ethics and social impact of its business). 
-Economic environment risks (deriving from the world business cycle of countries in which it operates, technological innovation in the sectors in which it operates, etc.).     

The company considers the most important risks to be those that could hamper it in achieving the goals established in its Strategic Plan, particularly the goal of maintaining its financial flexibility and long-term solvency. Repsol YPF manages its assets and businesses prudently. Nevertheless, many of the risks mentioned above are inherent in the activities it performs, are beyond the control of the company and cannot be entirely eliminated.

Repsol YPF has an organisation, procedures and systems that enable it to identify measure, assess, prioritize and control the risks to which the group is exposed, and decide to what extent those risks are to be assumed, managed, reduced or avoided. Risk analysis is an integral element in the group’s decision-making processes, both in the centralised governing bodies and in the management of the different businesses, paying special attention in all cases to the existence of several risks at the same time or the effects of diversification that may occur on an aggregate level.
The following independent analysis, supervision and control units specialise in different areas of risk management exist:

* Internal Audit Unit, focusing on the permanent assessment and improvement of existing controls to ensure that potential risks of whatsoever nature (control, business, reputation, etc...) that could hamper achievement of the strategic goals of the Repsol YPF Group are identified, measured and controlled at all times.

* Corporate Risk Management Unit, responsible for:

- Developing the corporate risk policy, consisting of structural rules and procedures linked to the Group’s financial and business strategy.
- Coordinating the development of specific rules and regulations concerning market and credit risks of the different business units and corporate areas of the Group, and the establishment of methods for measuring and assessing these risks according to best practices.  
- Monitoring and controlling the Group's market risk.
- Analysing and controlling the credit risk generated in the Group’s activities, including the establishment of individual credit risk limits for third parties. 
- Defining the criteria regarding the funding and use of provisions for insolvency, refinancing and judicial claiming of debts.

* Insurance Unit, responsible for:

- Analysing and assessing any accidental risks that could affect the assets and activities of the Group. 
- Defining the most efficient financing policy for these risks, through an optimum combination of self-insurance and risk transfer measures. 
- Taking out such insurance cover as may be considered convenient in each case. 
- Negotiating the compensations deriving from insured accidents. 

* Safety and Environment Unit, responsable for: :

- Defining the company’s objectives and strategic lines for safety and the environment, and following up in this. 
- Establishing corporate regulations (policies, rules, procedures, manuals and guides) for safety and the environment on a worldwide, general level for the company, and the mechanisms needed for its diffusion. 
-Identifying and heading up corporate safety and environment projects and assessing their implantation and coordinating follow-up in the Units. 
-Establishing key performance indicators, track the performance of the company's safety and environment and propose measures for improvement. 
-Promoting the establishment of working groups and the exchange of best practices on safety and environment -Coordinating safety and environment audits and following them up.     

* Corporate Reputation Unit, responsible for directing and coordinating with the relevant organisational units the management and assessment of corporate reputation risks and values, according to the guidelines and policies of the Corporate Reputation Committee and the Corporate Division Communication and Head of the Chairman’s Office, to guarantee application of the Repsol YPF corporate reputation model and strategy.

* Financial Reporting Internal Control Unit, responsible for monitoring and management of the internal economic and financial reporting control system, currently being introduced to comply with the requirements of section 404 of the Sarbanes-Oxley Act. The system applied by Repsol YPF is based on the conceptual framework defined in the COSO model issued by the Committee of Sponsoring Organizations of the Treadway Commission.

* Reserves Control Unit, which aims to make sure that the estimates of Repsol YPF proved reserves comply with prevailing legislation on the different Securities Markets on which the company is listed. It also makes internal audits of reserves, coordinates certification of reserves by external auditors and assesses the quality controls on reserve reporting, making the appropriate suggestions within a process of continuous improvement and application of best practices.

There are also several functional and business committees responsible for the oversight of the risk management activities performed within their respective areas of responsibility.