RAI Amsterdam risk attitude

Organisation in accordance with 'three lines of defence' model

In setting up its risk management system, RAI Amsterdam applied the 'three lines of defence' model, a structure of measures comprised of an operational line, risk management function and internal audit function.

The rst line of defence is primarily responsible for the operational management and takes ownership of controlling related risks This is realised via a proper set-up of the organisation, which involves both structure and processes as well as culture.

The second line of defence consists of the risk & compliance function that supervises the set-up and functioning of the risk management system The second line reports to the Board and line management

The third line of defence comprises an independent internal audit function. Based on an internal audit plan that is updated annually, the function supervises the set-up, existence and functioning of the administrative organisation, internal audit and control measures At this time, RAI Amsterdam has an internal audit approach that is limited to ISO certications We aim to further broaden this approach during 2022, something which was not possible in 2021 due to the COVID related suspension of events.

Supervision

The Supervisory Board monitors the operational management of RAI Amsterdam, among others. It approves (changes to) the risk management policy, and risk management is regularly included on the agendas of meetings of the audit committee and Supervisory Board The Supervisory Board employs the external accountant and approves its audit plan on an annual basis

The external accountant also acts as supervisor and monitors the set-up, existence and functioning of the administrative organisation and internal supervision based on an annually updated audit plan The external accountant reports to the Supervisory Board via a management letter and an accountant statement in the annual report.

Risks

An update of the risk assessment was implemented during 2021 in light of the cyclical assessment of current developments & the adjusted goals of the organisation Due to the explicit link to the goals of RAI Amsterdam, risk management strengthens the performance management. In total there are 17 risks which are considered most relevant The uncertainty caused by the COVID situation is described in this chapter under ‘changing environmental factors’

Evaluating the actual risks for RAI Amsterdam involves assessing both the current risk of an incident occurring and the current consequences (measured in nancial terms) this might have on RAI Amsterdam.

The combination of the current risk and current consequences determines whether the current risk level is seen as low, medium or high The evaluation explicitly takes into account the monitoring procedures and measures taken to mitigate the relevant risk. The determination of risk and consequence is indicated in the matrix table. The letters in the matrix indicate the type of risk, with S representing strategic risks, O operational risks, and F nancial/administrative risks The associated numbers refer to the specic risks as described above The colours represent the following risk levels: low (green), medium (yellow) and high (red).

Main risks and mitigating measures

Market and competition

The commercial playing eld and competitive position of RAI Amsterdam can be aected by activities or developments by competitive parties and potential market partners. With this in mind, the RAI has developed a strategic portfolio policy and keeps a close eye on the market position of its portfolio The merits of and conditions related to potential partners are identied and we proactively assess the options available in this eld This is translated into a market strategy for each domain, with changing client preferences taken into account. The new business process is aimed at developing new propositions with or without partnerships.

Changing environmental factors

The pandemic hit the RAI very hard and is therefore still the most relevant external environmental factor, one which is having enormous consequences. How the crisis will develop in the future remains uncertain, but the impact on the RAI is clearly long term While it remains uncertain how and when restrictions related to travel and event visits will be lifted, the RAI continues to believe in the strength of personal meetings The highly successful, temporary resumption of the events in the autumn of 2021 is seen as encouraging in this framework. To get through the COVID crisis the RAI will continue to aim for the fast reopening of the RAI, securing nancial continuity, the accelerated development of new revenue models, and the further modernisation of the venue into an attractive multifunctional location Concretely, this was translated into ensuring the availability of COVID protocols, a focus on digital and hybrid events, and optimising the post-COVID event calendar.

Strategy execution and change management

Strategic and operational manoeuvrability are crucial in turbulent times A newly enhanced strategy was translated into a Masterplan RAI 2030 that will be realised programmatically and makes use of external expertise The risks and insecurities related to the programme were systematically mapped, and alignment with the various stakeholders (shareholders, Supervisory Board, municipality and works council) intensied With regard to change management, we are focusing on streamlining processes in a slimmed down organisation, the continued development of the logistics concept for the RAI, and dening the desired and required investments in the modernisation and digitisation of the venue.

Financial risks

Financial risks usually originate from underlying strategic, operational or compliance risks, and the related control measures take place within the spectrum of nancial management and treasury From 2020, the RAI responded to the COVID crisis via a savings programme, a nancing programme and with a maximum focus on cashows. We are consulting closely with clients about how to deal with advance payments related to cancelled events The majority of these advance payments have been kept for postponed events rather than remunerated No dividend was paid over 2020, and tax payments were phased over time.

Investments were reduced to a bare minimum level during the pandemic crisis. The intensive cash management was strengthened via scenario-based planning and helps support the organisation through these turbulent times.

Cybercrime

Cybercrime is one of the greatest threats to businesses worldwide, and RAI Amsterdam is not immune We have therefore dened a cyber security policy and are taking organisational and physical measures to mitigate this risk as much as possible It is also intended to reduce consequential risks such as operational disruptions and the loss of privacy-sensitive information A periodical external audit of the soundness of these measures is part of this approach

Reputation

Any damage to the reputation of the RAI can have major long-term consequences so a range of instruments have been deployed to mitigate these A compliance management system has been set up to ensure that laws and regulations are closely observed. An integrity policy helps prevent undesirable or dishonest behaviour. Intensive stakeholder management is partly focused on consolidating the good reputation of the RAI, while a corporate communication policy ensures eective communication to all stakeholders

Safety and security

RAI Amsterdam is a multifunctional venue where in normal times lots of people come together. This implies health & safety risks for visitors and employees and the risk of damage to or theft of their property The RAI has therefore developed an integrated safety management system that involves a risk-based focus on strategic and operational safety management issues. It also mitigates as much as possible the risk of business interruption caused by calamities. The eective functioning of these measures is monitored. COVID protocols for safely visiting the RAI venue were logically a major focal point throughout the year and proved their worth in the autumn