Operating risks

Operating risks consist mainly of the malfunctioning and unforeseen interruption of the service determined by accidental events, including accidents, breakdowns or malfunctions of equipment or control systems, reduced output of plants, and extraordinary events such as explosions, fires, landslides or other similar events outside of Snam’s control. Such events could result in a reduction in revenue and could also cause significant damage to people, with potential compensation obligations. Although Snam has taken out specific insurance policies to cover some of these risks, the related insurance cover could be insufficient to meet all the losses incurred, compensation obligations or cost increases.

There is also the concrete possibility that Snam could incur delays in the progress of infrastructure construction programmes as a result of several unknowns linked to operating, economic, regulatory, authorisation and competition factors, regardless of its intentions. Snam is therefore unable to guarantee that the projects to upgrade and extend its network will be started, be completed or lead to the expected benefits in terms of tariffs. Additionally, the development projects may require greater investments or longer timeframes than those originally planned, affecting Snam’s financial position and results.

Investment projects may be stopped or delayed due to difficulties in obtaining environmental and/or administrative authorisations or to opposition from political forces or other organisations, or may be influenced by changes in the price of equipment, materials and workforce, by changes in the political or regulatory framework during construction, or by the inability to obtain financing at an acceptable interest rate. Such delays could have negative effects on the Snam Group’s operations, results, balance sheet and cash flow. In addition, changes in the prices of goods, equipment, materials and workforce could have an impact on Snam’s financial results.

Snam and the sites in which it operates are subject to laws and regulations relating to pollution, environmental protection, and the use and disposal of hazardous substances and waste. These laws and regulations expose Snam to potential costs and liabilities related to the operation and its assets. The costs of possible environmental remediation obligations are subject to uncertainty regarding the extent of contamination, appropriate corrective actions and shared responsibility and are therefore difficult to estimate.

In relation to the new global climate agreements (COP21 in Paris 2015, COP22 in Marrakech in 2017), aimed at encouraging the transition towards a more sustainable economy that favours zero emission energy sources, it may envisage regulatory and legislative risk related to the possible implementation of increasingly stringent regulations at European and national level.

Snam cannot predict if and how environmental regulations and laws may over time become more binding and cannot provide assurance that future costs to ensure compliance with environmental legislation will not increase or that these costs can be recovered within the mechanisms tariffs or the applicable regulation. Substantial increases in costs related to environmental compliance and other aspects related to it and the costs of possible sanctions could negatively impact the business, operating results and financial and reputational aspects.

Snam's ability to operate its business effectively depends on the skills and performance of its personnel. Loss of “key” personnel or inability to attract, train or retain qualified personnel (in particular for technical positions where the availability of appropriately qualified personnel may be limited), or situations in which the ability to implement long-term business strategy is negatively influenced due to significant disputes with employees, could have an adverse effect on the business, financial conditions and operating results.

Snam carries out its activities through a complex technological architecture relying on an integrated model of processes and solutions capable of promoting the efficient management of the entire country's gas system. The development of the business and recourse to innovative solutions capable of continuous improvement, however, requires increasing attention to be focused on aspects of cybersecurity.

For this reason Snam has developed its own cybersecurity strategy based on a framework defined in accordance with standard principles on the subject and focusing constant attention on Italian and European regulatory developments, especially as far as the world of critical infrastructures and essential services is concerned. First and foremost, this strategy involves adapting one's own processes to the provisions of standards ISO/IEC 27001 (Information Security Management Systems) and ISO 22301 (Business Continuity Management Systems) and the formal certification of conformity to the listed standards.

Alongside this and in accordance with technological developments, solutions aimed at protecting the Company from cyber threats and malware are assessed and, where deemed appropriate, implemented. More specifically, Snam has defined a model of cybersecurity incident management aimed at preventing and, when necessary, ensuring timely remediation in the event of events that could damage the confidentiality and integrity of the information processed and the IT systems used. At the base of the activity is a Security Incident Response Team which, using technologies that allow collecting and correlating all the security events recorded on the entire perimeter of the company's IT infrastructure, has the task of monitoring all the anomalous situations from which negative impacts may result for the company and to activate, where necessary, escalation plans suitable to guarantee the involvement of the various operating structures.

With reference to the management of information in support of the business processes, it is considered appropriate to stress that the company owns the asset (fibre) used for the transmission of data to and from the territory; this results in intrinsically greater security thanks to the lack of dependency on the service provided by third parties and the possibility of making exclusive use of the communication channel.

Lastly, as part of cyber incident management (preventive and reactive), information-sharing with national and European institutions and peers is used in order to improve the capacity and speed of response following various possible negative events.

A great deal of attention is also paid to increasing awareness and specialist training of personnel, in order to facilitate the identification of weak signals and raising consciousness about risks of a cyber nature that could occur during the course of normal work activities.