Canacol's risk management framework is entrusted to the executive team, who are accountable for consistently reviewing policies and processes to identify, evaluate, and diligently govern Canacol's risk profile. To ensure effective risk management, Canacol's Board of Directors provides oversight through its Audit and ESG Committees. These committees play a crucial role in monitoring and guiding the company's risk management efforts.

Canacol acknowledges the paramount importance of risk management in ensuring the protection of the environment, stakeholder interests, long term value creation, and the sustainability of our business. We undertake a comprehensive review of our risk management, business continuity, and disaster recovery plans on an annual basis. This includes conducting training sessions and simulated incidents to enhance preparedness.

Our risk management process adheres to the ISO 31000 standard and follows a well-defined five-step cyclical process. We closely monitor and consistently communicate this process with our stakeholders. Regular risk reviews are conducted, in conjunction with both internal and external audits of our risk management process. Additionally, Canacol performs an annual assessment to identify and disclose potential risks that may impact our business, thereby ensuring a thorough understanding of our risk exposure.

Canacol conducts two actions framed in our risk management process:

• Sensitivity analysis: procedure that tests the particular outcome of any given set of inputs under a given set of assumptions. It is important in risk analysis because it is a useful tool for gauging the outcome of all kinds of scenarios and events. Analysts conducting sensitivity analysis will ultimately be concerned with determining how changes in one or more inputs could affect the output of interest.
• Stress testing: simulation technique used on assets, portfolios, or positions of interest to determine their reactions to different events that are not usually captured in more traditional value or risk analysis. Stress tests are used to gauge how certain stressors (events, risks, megatrends) or extreme circumstances could affect a company or industry.

The identification, planning, evaluation, and mitigation of long term and emerging risks are crucial for investors and stakeholders to gauge Canacol's capacity to understand long term risks, recognize their potential impacts on the business, and effectively plan and execute mitigation actions in response to identified risks. 

For further information, please refer to the following Emerging Risks Statement.

We are committed to fostering a robust risk culture by providing regular and ongoing training to our employees on risk management practices. This includes integrating risk criteria into our product development and approval processes, as well as establishing risk management Key Performance Indicators (KPIs) for all employees.

In addition, we engage in company-wide initiatives to promote effective risk management. This includes quarterly dissemination of risk management updates on our website, conducting reviews and assessments of potential risks that may impact business continuity and field operations. We also establish and adhere to multi-year work plans, categorized by area, which align with the risks identified in our ESG priorities. Furthermore, we prioritize the identification and treatment of potential risks to our operations.

Canacol promotes measures where employees are immersed in risk management processes. On a quarterly basis, each area of the Company must perform an internal analysis of the specific risks involved in the area's procedures. Subsequently, the Company's risk leader performs an evaluation of these risks and plans for their treatment and mitigation actions. On the other hand, in the event of changes in the risk matrix and/or in any other risk management process, all Canacol personnel are trained to ensure the proper development of the risk management process. 

Risk management is linked to Canacol's ESG strategy, which is why employee participation is a priority, and has an impact on financial incentives associated with employee performance on an annual basis.