The Group Internal Control and Sox Compliance Function is responsible for the risks mitigation and related findings, and they periodically report updates and potential findings to the relevant management and supervisory bodies, in particular the FLT and the Audit Committee respectively.

To determine the disclosures in our Sustainability Statement, we followed a Double materiality assessment process with four main steps: 1. Analysis of the internal and external context 2. Identification of potential sustainability impacts, risks and opportunities 3. Impacts, risks and opportunity evaluation 4. Validation of the impacts, risks and opportunities. The process to identify risks and to assess which are material is integrated in the Risk Management system (ERM). In particular, sustainability-related risks are identified through a specific classification.

The process involves four main steps: 1. Analysis of the internal and external context 2. Identification of potential sustainability impacts, risks and opportunities 3. Impacts, risks and opportunity evaluation 4. Validation of the impacts, risks and opportunities. The process to identify risks and to assess which are material is integrated in the Risk Management system (ERM). In particular, sustainability-related risks are identified through a specific classification.

The process involves four main steps: 1. Analysis of the internal and external context 2. Identification of potential sustainability impacts, risks and opportunities 3. Impacts, risks and opportunity evaluation 4. Validation of the impacts, risks and opportunities. The process to identify risks and to assess which are material is integrated in the Risk Management system (ERM). In particular, sustainability-related risks are identified through a specific classification.

The process involves four main steps: 1. Analysis of the internal and external context 2. Identification of potential sustainability impacts, risks and opportunities 3. Impacts, risks and opportunity evaluation 4. Validation of the impacts, risks and opportunities. The process to identify risks and to assess which are material is integrated in the Risk Management system (ERM). In particular, sustainability-related risks are identified through a specific classification.

The impact evaluation process has included consultation with our key stakeholders. Since 2018, Ferrari engages with key stakeholders (clients, dealers, universities, schools and enthusiasts) to assess severity and likelihood of impacts that are relevant for stakeholders and validate the impacts that have been assessed by Ferrari as material. In particular in 2024, we carried out a stakeholder engagement with investors through a perception study and dedicated ESG meetings, as well as with employees and MUNER students through in person workshops. The results were included into the Double materiality assessment.

In this phase, we defined the criteria and scales to assess the IROs. In particular, we assessed our impact (inside-out perspective) taking into account their severity and likelihood. The severity was assessed using 1 (small) to 5 (extreme) scoring, considering scale, scope and for negative impact irremediability. The likelihood was assessed using 1 (unlikely) to 5 (very likely) scoring. Both negative and positive impacts were evaluated gross (before any mitigating actions). For the financial materiality analysis (outside-in perspective), risks were assessed according to the ERM methodology involving residual evaluation by severity and likelihood. Whereas opportunities were assessed according to criteria and metrics defined on the basis of the ERM methodology, considering residual evaluation by severity and likelihood. For risks, three variables (likelihood, impact and preparedness) are assessed independently on the basis of company metrics; these elements are then multiplied and the product obtained through this operation, defined overall risk exposure, is the input for placing risks on a heat map that has four different risk areas (Tier 1, Tier 2, Watching Area, Residual Area). The severity was assessed using 1 (very low) to 5 (very high) scoring, considering four different drivers of evaluation: strategic/market, economic/financial, operational and reputational. Additionally, the final score of severity resulted also from considering the preparedness, which is the degree of control, protection and readiness that Ferrari ensures thanks to the current actions, processes and levers, and their effectiveness. The likelihood was assessed using 1 (very low) to 5 (very high) scoring considering three different drivers: qualitative (uncertain contexts), quantitative (measurable contexts) and frequency (predictable contexts). During the evaluation process we assessed each IROs within the most relevant time horizon, considering short, medium and long term as described in ESRS 1 and considering the impact related both to our own operations and to our upstream and downstream value chain.

In this phase, we defined the criteria and scales to assess the IROs. In particular, we assessed our impact (inside-out perspective) taking into account their severity and likelihood. The severity was assessed using 1 (small) to 5 (extreme) scoring, considering scale, scope and for negative impact irremediability. The likelihood was assessed using 1 (unlikely) to 5 (very likely) scoring. Both negative and positive impacts were evaluated gross (before any mitigating actions). For the financial materiality analysis (outside-in perspective), risks were assessed according to the ERM methodology involving residual evaluation by severity and likelihood. Whereas opportunities were assessed according to criteria and metrics defined on the basis of the ERM methodology, considering residual evaluation by severity and likelihood. For risks, three variables (likelihood, impact and preparedness) are assessed independently on the basis of company metrics; these elements are then multiplied and the product obtained through this operation, defined overall risk exposure, is the input for placing risks on a heat map that has four different risk areas (Tier 1, Tier 2, Watching Area, Residual Area). The severity was assessed using 1 (very low) to 5 (very high) scoring, considering four different drivers of evaluation: strategic/market, economic/financial, operational and reputational. Additionally, the final score of severity resulted also from considering the preparedness, which is the degree of control, protection and readiness that Ferrari ensures thanks to the current actions, processes and levers, and their effectiveness. The likelihood was assessed using 1 (very low) to 5 (very high) scoring considering three different drivers: qualitative (uncertain contexts), quantitative (measurable contexts) and frequency (predictable contexts). During the evaluation process we assessed each IROs within the most relevant time horizon, considering short, medium and long term as described in ESRS 1 and considering the impact related both to our own operations and to our upstream and downstream value chain.

In this phase, we defined the criteria and scales to assess the IROs. In particular, we assessed our impact (inside-out perspective) taking into account their severity and likelihood. The severity was assessed using 1 (small) to 5 (extreme) scoring, considering scale, scope and for negative impact irremediability. The likelihood was assessed using 1 (unlikely) to 5 (very likely) scoring. Both negative and positive impacts were evaluated gross (before any mitigating actions). For the financial materiality analysis (outside-in perspective), risks were assessed according to the ERM methodology involving residual evaluation by severity and likelihood. Whereas opportunities were assessed according to criteria and metrics defined on the basis of the ERM methodology, considering residual evaluation by severity and likelihood. For risks, three variables (likelihood, impact and preparedness) are assessed independently on the basis of company metrics; these elements are then multiplied and the product obtained through this operation, defined overall risk exposure, is the input for placing risks on a heat map that has four different risk areas (Tier 1, Tier 2, Watching Area, Residual Area). The severity was assessed using 1 (very low) to 5 (very high) scoring, considering four different drivers of evaluation: strategic/market, economic/financial, operational and reputational. Additionally, the final score of severity resulted also from considering the preparedness, which is the degree of control, protection and readiness that Ferrari ensures thanks to the current actions, processes and levers, and their effectiveness. The likelihood was assessed using 1 (very low) to 5 (very high) scoring considering three different drivers: qualitative (uncertain contexts), quantitative (measurable contexts) and frequency (predictable contexts). During the evaluation process we assessed each IROs within the most relevant time horizon, considering short, medium and long term as described in ESRS 1 and considering the impact related both to our own operations and to our upstream and downstream value chain.

In this phase, we defined the criteria and scales to assess the IROs. In particular, we assessed our impact (inside-out perspective) taking into account their severity and likelihood. The severity was assessed using 1 (small) to 5 (extreme) scoring, considering scale, scope and for negative impact irremediability. The likelihood was assessed using 1 (unlikely) to 5 (very likely) scoring. Both negative and positive impacts were evaluated gross (before any mitigating actions). For the financial materiality analysis (outside-in perspective), risks were assessed according to the ERM methodology involving residual evaluation by severity and likelihood. Whereas opportunities were assessed according to criteria and metrics defined on the basis of the ERM methodology, considering residual evaluation by severity and likelihood. For risks, three variables (likelihood, impact and preparedness) are assessed independently on the basis of company metrics; these elements are then multiplied and the product obtained through this operation, defined overall risk exposure, is the input for placing risks on a heat map that has four different risk areas (Tier 1, Tier 2, Watching Area, Residual Area). The severity was assessed using 1 (very low) to 5 (very high) scoring, considering four different drivers of evaluation: strategic/market, economic/financial, operational and reputational. Additionally, the final score of severity resulted also from considering the preparedness, which is the degree of control, protection and readiness that Ferrari ensures thanks to the current actions, processes and levers, and their effectiveness. The likelihood was assessed using 1 (very low) to 5 (very high) scoring considering three different drivers: qualitative (uncertain contexts), quantitative (measurable contexts) and frequency (predictable contexts). During the evaluation process we assessed each IROs within the most relevant time horizon, considering short, medium and long term as described in ESRS 1 and considering the impact related both to our own operations and to our upstream and downstream value chain.