Operational risks

The risk of the malfunctioning and unforeseen interruption of the service is determined by accidental events, including accidents, breakdowns or malfunctions of equipment or control systems, reduced output of plants, and extraordinary events such as explosions, fires, landslides or other similar events outside of Snam’s control. Such events could result in a reduction in revenue and could also cause significant damage to people, with potential compensation obligations. Although Snam has taken out specific insurance policies to cover some of these risks, the related insurance cover could be insufficient to meet all the losses incurred, compensation obligations or cost increases.

There is also the concrete possibility that Snam could incur delays in the progress of infrastructure construction programmes as a result of several unknowns linked to operating, economic, regulatory, authorisation, competition and social factors, regardless of its intentions. Snam is therefore unable to guarantee that the projects to upgrade and extend its network will be started, be completed or lead to the expected benefits in terms of tariffs. Additionally, the development projects may require greater investments or longer timeframes than those originally planned, affecting Snam’s financial position and results.

Investment projects may be stopped or delayed due to difficulties in obtaining environmental and/or administrative authorisations or to opposition from political forces or other organisations or may be influenced by changes in the price of equipment, materials and workforce, by changes in the political or regulatory framework during construction, or by the inability to obtain financing at an acceptable interest rate. Such delays could have negative effects on the Snam Group’s operations, results, balance sheet and cash flow. In addition, changes in the prices of goods, equipment, materials and workforce could have an impact on Snam’s financial results.

Snam and the sites in which it operates are subject to laws and regulations relating to pollution, environmental protection, and the use and disposal of hazardous substances and waste. These laws and regulations expose Snam to potential costs and liabilities related to the operation and its assets. The costs of possible environmental restoration obligations are subject to uncertainty regarding the extent of contamination, appropriate corrective actions and shared responsibility and are therefore difficult to estimate.

Snam cannot predict if and how environmental regulations and laws may over time become more binding and cannot provide assurance that future costs to ensure compliance with environmental legislation will not increase or that these costs can be recovered within the mechanism’s tariffs or the applicable regulation. Substantial increases in costs related to environmental compliance and other aspects related to it and the costs of possible sanctions could negatively impact the business, operating results and financial and reputational aspects.

Snam’s ability to operate its business effectively depends on the skills and performance of its personnel. The loss of “key” personnel or the inability to attract, train or retain qualified personnel (particularly for technical positions in which the availability of appropriately qualified personnel may be limited) or situations in which the capacity to implement the long-term business strategy is influenced negatively due to significant disputes with employees could trigger an adverse effect on the business, financial conditions and operating results.

Snam carries out its activities through a complex technological architecture relying on an integrated model of processes and solutions capable of promoting the efficient management of the entire country’s gas system. The development of the business and recourse to innovative solutions capable of continuous improvement, however, requires increasing attention to be focused on aspects of cyber security. For this reason, Snam has developed its own cyber security strategy based on a framework defined in accordance with standard principles on the subject and focusing constant attention on Italian and European regulatory developments, especially as far as the world of critical infrastructures and essential services is concerned. First and foremost, this strategy involves adapting one’s own processes to the provisions of standards ISO/IEC 27001 (Information Security Management Systems) and ISO 22301 (Business Continuity Management Systems) and the formal certification of conformity to the listed standards. Alongside this and in accordance with technological developments, solutions aimed at protecting the Company from the cyber threats and malware are assessed and, where deemed appropriate, implemented.

More specifically, Snam has defined a cyber security incident management model intended to prevent and, when necessary, guarantee prompt remediation against events potentially capable of harming the confidentiality, integrity and availability of information processed and the IT systems used. At the basis of these activities is a Security Incident Response Team which, by relying on technologies that make it possible to collect and correlate all security events recorded throughout the company’s IT infrastructure, has the task of monitoring all anomalous situations that could have negative impacts for the company and activate, when necessary, suitable escalation plans to guarantee the involvement of the various operating structures.

With reference to the management of information supporting business processes, it is worth highlighting that the company owns (fibre) assets used for data transmission to and from the country; this gives greater intrinsic security thanks to not being dependent on the service provided by third-parties and the possibility of using the communication channel exclusively. Lastly, as part of the cyber incident management activities (preventive and reactive) information-sharing with national and European institutions and peers is used in order to improve the capacity and speed of response following various possible negative events. A great deal of attention is also paid to increasing awareness and specialist training of personnel, in order to facilitate the identification of weak signals and raising consciousness about risks of a cyber nature that could occur during normal work activities.