GOV-5 – Risk Management and Internal Controls Over Sustainability Reporting

Organizationally, responsibility for preparing the sustainability statement lies with the CFO, in particular with the Accounting department, in collaboration with Strategy, Corporate Development & Sustainability. Vonovia considers failure to meet legal sustainability reporting requirements to be a material risk associated with the sustainability statement. Appropriate measures have been taken to address this risk, which was identified as part of the Group-wide risk management process: as well as constantly monitoring the development of regulatory requirements and ensuring the associated dialogue in associations and working groups, the company places particular emphasis on implementing and establishing robust data collection processes. Controlling is responsible for identifying and preparing key sustainability figures. These include, in particular, key environmental and HR-related figures, as well as the key SPI figures relevant to management. Bundling responsibility within Controlling ensures that plausible, quality-assured data is available. This is supported by Strategy, Corporate Development & Sustainability. The risks identified are prioritized based on the risk categories they are assigned to, which depend on the loss amount and probability of occurrence. Additional details can be found in our Risk Report.

The accounting related internal control system (ICS) – and risk management system forms part of the Group-wide risk management system and is aimed at ensuring due and proper financial and sustainability reporting, as well as compliance with the relevant regulations. The sustainability-related impacts, risks and opportunities pursuant to the ESRS have been incorporated into the risk management system. A separate ICS process, including the associated key controls, is in place for sustainability reporting in line with the requirements that apply to the internal control system. This process is audited and validated annually by the respective department and the Internal Audit department. For information on the controls implemented for the risks identified, please refer to our Risk Report, in particular the details on the ICS. Risk mitigation strategies are also described in topic-specific standards.

Key processes and key indicator definitions are documented centrally using a data governance tool, as are the corresponding internal controls. This documentation illustrates the relevant process steps and data flows and is supplemented by our risk management tool, which is used to record the material risks and mitigating measures. These systems provide the binding basis for subsequent evaluations, audits and reporting to Vonovia’s executive bodies on the effectiveness of the ICS within the meaning of Section 107 (3) sentence 2 of the German Stock Corporation Act (AktG).

The Sustainability Statement is reviewed in the first instance by the Audit, Risk and Compliance Committee and then by the Supervisory Board based on the committee's recommendation. The Audit, Risk and Compliance Committee is continually involved in the establishment and refinement of the accounting-related internal control and risk management system.

The Internal Audit department reports annually to the Management Board on the audit process that has been completed, which includes the sustainability-related ICS process.