Climate Change Management in Shareholdings

In addition to our operating units, we participate in companies and partnerships involving other projects. Our governance accompanies these participations, seeking excellence in management and strategic alignment.

The controlled companies whose assets are operated or whose operational activities are coordinated by us are directly subject to our goals, initiatives, and governance.

Subsidiaries holding assets with their own operation have specific metrics and initiatives to reduce GHG emissions in line with our net zero ambition.

For other holdings in which Petrobras is not the controlling shareholder, we are developing a plan to engage and disseminate good practices in governance and climate change management, in line with our ambition to neutralize operational emissions.

Risk Management Process

We have a risk management policy that establishes guidelines and responsibilities based on the following principles:

> Respect for Life and Diversity

> Alignment with the Strategic Plan

> Ethical Behavior and Compliance with Legal and Regulatory Requirements

> Integrated Risk Management

> Risk response actions consider possible long-term cumulative consequences, impacts on stakeholders, and are oriented towards preserving and adding value and business continuity

Risks (threats and opportunities) are identified by each organizational unit, considering the specificities of its processes, operations and objectives. Risks are classified into three groups according to their possible origin: Operational, Financial, and Compliance. Risks are assessed, considering the probability of occurrence and impacts on the financial, image and reputation, legal and compliance, environmental, and life dimensions.

Risk Classification

> Operational Risk: Includes risks arising from our core activities, in addition to risks arising from failures, deficiencies or inadequacies in internal processes, provision of goods and services, systems, as well as natural disasters and/or actions by third parties.

> Financial Risk: Includes risks arising from market fluctuations, counterparty defaults and mismatches between assets and liabilities.

> Compliance Risk: Includes risks arising from laws and regulations applicable to our business, our Code of Ethical Conduct and other internal rules and procedures.

Identified risks must have one or more associated actions corresponding to the risk response. Actions can be of the following types: avoid, reduce, transfer, accept, or exploit (applicable to opportunities). Risks with a very high and high severity or medium degree of severity with a high impact should not be accepted. Response plans with deadlines and responsible persons are established for these risks.

Annually, the Risks Executive Committee (CE-Riscos) and the Executive Board define the strategic risks, according to their importance for the implementation of the company’s Strategic Plan, their scope, degree of severity, and resources required for their treatment. These risks must be monitored quarterly by the Executive Board and presented to the advisory committees related to corporate risk management: Statutory Audit Committee (CAE) and the CE-Riscos, being subsequently presented to the Board of Directors.

In addition to strategic risks, other relevant risks, such as those of very high and high severity, are also monitored by senior management.

The set of risks related to climate change and energy transition is evaluated with a very high degree of severity and is currently considered a strategic risk, being monitored according to the described governance.