Rio Tinto (RIO) Risk Analysis

Nothing is more important than the safety and wellbeing of our employees, contractors and communities where we operate. The mining industry is inherently hazardous, with the potential to cause fatalities, illness or injury, damage to the environment, disruption to communities or major loss of production or revenues. Our objective is to have zero fatalities or permanent disablements. We believe all fatalities are preventable, so our focus is on identifying, managing and, where possible, eliminating hazards. Safe and stable operations are critical to delivery of our objective to be Best Operator, and maintaining close control of our operating assets ensures reliable productive outputs. Risks (threats) Our operational environment is exposed to major hazards, including processing, underground mining, slope geotechnical, functional safety (eg sinking shafts and autonomous operations) and tailings management. Inability to manage these hazards could result in a catastrophic event or other long-term damage to the Group or the environment and communities where we operate. Loss of technical capability at complex operations poses increased risk. In addition to major hazards, our operations are exposed to safety risks which could result in single or multiple fatalities. These include risks from vehicles and driving, aviation, falling objects, electricity and explosives.Key exposuresUnderground risks at Oyu Tolgoi, Kennecott, Diavik and Resolution. Slope geotechnical risk at Kennecott and QIT Madagascar Minerals (QMM). Tailings and water storage facilities at our Aluminium, Iron Ore and Closure assets. Process safety at Copper and Aluminium smelters and refineries. Functional safety at Oyu Tolgoi and across our Iron Ore assets. Mass passenger transport at Oyu Tolgoi, Simandou and Rincon. Risk oversight: Major Hazards Steering Committee, Safety and Operations Committee, Risk Management Committee, Sustainability Committee.

Our ability to achieve our business strategy depends on attracting, developing and retaining a wide range of internal and external skilled and experienced people. Risks (threats)Business interruption or underperformance may arise from a lack of access to capability. Tight labour markets, and entry into new countries where mining capabilities are in limited supply or the Rio Tinto brand is less established, can lead to heightened competition for diverse talent and critical skills. This may include skills in climate, energy, decarbonisation, technical mining and processing, licence to operate, and new commodities and projects. Changing societal expectations are placing pressure on our corporate and employer brand in terms of who we are and what we stand for. Since the pandemic, talent is less inclined to relocate, forcing the reliance on local or national recruitment, which significantly reduces the market size for sourcing talent. Key exposures: Turnover rate in process safety management and technology roles. Risk oversight: Risk Management Committee, People & Remuneration Committee.

Our relationships with Indigenous Peoples play a material role in delivering our operational and strategic goals and in our ability to operate. A breakdown in these critical relationships may have a significant impact on our business. We aim to build respectful and enduring relationships with Indigenous partners and communities, enabling them to realise their goals and aspirations and to create long-term shared benefits. Risks (threats)Mining activities may strain relationships with Indigenous Peoples, particularly where actual or perceived damage of significant cultural values (cumulative or acute) occurs without appropriate consultation and consent. This may result in loss of trust with Indigenous Peoples, impacting our social licence to operate.Key exposuresIndigenous Peoples near Resolution, in the Pilbara, Cape York (Weipa), Canada (Quebec, Labrador, British Columbia), and Argentina.Risk oversight: Risk Management Committee, Sustainability Committee.

Our determination to become Best Operator and have impeccable ESG credentials is underpinned by our commitment to ensure compliance with our operational procedures, laws and our obligations. These expectations are outlined in our Group policies, standards and procedures, published on our website. Risks (threats)A serious breach in our operations or in our value chain of anti-corruption legislation or sanctions, data privacy, human rights, anti-trust rules, or inappropriate business conduct, could result in serious harm to people and significant reputational, legal and financial damage. Key exposuresExposures exist in Argentina (Rincon), Guinea (Simandou) and Mongolia (Oyu Tolgoi).Risk oversight: Group Ethics & Compliance Committee, Risk Management Committee, Board.

Producing the materials the world needs means we have an impact on the environment. Our operations and projects require proactive management to minimise potential impact to water resources or biodiversity in new asset developments, existing operations and closures. Our assets, infrastructure, communities and broader value chains are exposed to the impacts of extreme weather events, and climate change is expected to impact the frequency, intensity and likelihood of extreme events across different regions globally. Risks (threats)A number of our operations and future development opportunities exist within, or close to, sensitive biodiverse regions. Our licence to operate and develop requires us to demonstrate our capability to protect ecosystems through improved practices and technological solutions. Natural hazards or extreme weather events can endanger our employees and communities, damage our assets or cause significant operational interruption. A direct impact of a Category 5 cyclone could lead to a significant disruption to Pilbara port operations. Longer-dated exposure to chronic changes in climate is less well understood given the inherent uncertainty in future climate projections. Key exposures Our operations in the Pilbara and Saguenay–Lac-Saint-Jean regions, QIT Madagascar Minerals and the Simandou project.Risk oversight: Risk Management Committee, Sustainability Committee.

Ensuring our ability to deliver longer-term strategic objectives encompasses our ability to achieve our Scope 1 and 2 targets between now and 2050, and deliver on our focus area of striving for impeccable ESG credentials, while balancing the need to invest for growth, deliver superior shareholder returns and remain competitive. Risks (threats)Delays in priority initiatives will threaten our Scope 1 and 2 target delivery and ability to respond proactively and competitively. A key uncertainty is our ability to successfully engage, and partner where appropriate, with governments and other external parties to progress grid decarbonisation in a timely manner, with large scale grid solutions in Australia planned for final delivery very late this decade already. Furthermore, our 2030 targets remain achievable through a mix of renewable penetration, biodiesel, small process heat modifications and use of offsets. Successful research and development investment in areas such as electric fleets, hydrogen calcination, ELYSISTM, and BlueSmeltingTM is required to support the decarbonisation pipeline post 2030. Adhering to our social and human rights standards during implementation of decarbonisation projects will be critical to avoid adversely impacting people and stakeholder relationships. However, this may limit our available sourcing options and lead to delays in meeting our targets. Key exposuresOur Aluminium group’s Pacific Operations smelter repowering and alumina processing. Risk oversight: Decarbonisation Investment Forum, Risk Management Committee, Board.

Decarbonisation of iron and steelmaking may affect the future relative values of our iron ore products. We have the opportunity to unlock business value through optimising our iron ore product strategy, partnering with technology providers and universities, and innovating with our customers to position ourselves favourably for the future demand for low-carbon steel. Risks (threats)Uncertainty remains around the pace of transition across the steel value chain, and the implications for the quality of iron ore products required to support future low-carbon technologies. While the market is expected to continue to require Pilbara iron ores, decarbonisation of the steel value chain will require the development and proliferation of economic low-carbon technologies suited to low-medium grade ores. Key exposuresPilbara low-medium grade ores.Risk oversight: Steel Decarbonisation Steering Committee, Risk Management Committee, Board.

Managing cyber security events allows us to avoid disruption to our operations, comply with data privacy requirements and keep sensitive information related to customers, contractors or suppliers safe Risks (threats)Cyber incidents can occur due to malicious external or internal attacks, but also inadvertently through human error. Although the extent and frequency of cyber security threats remain in line with growth expectations, the external threat landscape continues to evolve at a rapid pace. The rise of digitisation has driven greater convergence and connectivity between our information technology (IT), and industrial and operational environments. The increased use of emerging or disruptive technologies to inform and automate decisions also amplifies the threat of loss of control systems or autonomous functions. Key exposuresOur greatest exposures continue to be through our global ecosystem of third-party suppliers, and the rapid development of new projects, with an increasing reliance on technology.Risk oversight: Cyber Security Steering Committee, Risk Management Committee, Audit & Risk Committee