101

2021 INTEGRATED MANAGEMENT REPORT

REGISTRATION AND APPROVAL

In this phase, we establish the aspects that the supplier must fulfil to ensure that the level of associated risk is acceptable. Suppliers are required to complete a questionnaire that includes environmental, social and governance aspects and are assigned an ESG score that is taken into account in decision-making. As a result, 100% of the approved suppliers on our platform have an ESG rating. We have also launched a supplier development meeting project to verify ESG performance and identify opportunities for improvement, spanning a total of 17 suppliers this year.

RISK SEGMENTATION AND CONTROL

We identify our critical suppliers through segmentation. They comprise the main segments I, II and III, segment IV suppliers showing some degree of high risk and conditional suppliers, which are the only source of a supply. We also consider the suppliers of the ge- neral contractors that access our facilities to be critical (Tier 2).

In this phase, risk relating to active suppliers is continuously assessed factoring in operational, economic, ESG, country, information security or counterparty (KYC, Know Your Counterparty) risk, among other aspects. The findings of this assessment are made avai- lable to all buyers for use in decision-making.

In 2021, a total of 2,659 active suppliers had been risk assessed. 974 suppliers underwent an additional compliance analysis in which international lists were checked to meet the objectives set by the corporate counterparty integrity analysis procedure (KYC). Cepsa has not identified any supplier showing high or very high risk, the average being medium-low risk.

PERFORMANCE EVALUATION

Cepsa has an active supplier evaluation plan that takes into account quality, execution and ESG aspects.

In 2021, 1,032 evaluations were carried out on 881 Cepsa suppliers, 609 of which due to their criticality, meaning that 100% of criti- cal suppliers have undergone at least one performance evaluation, in line with Cepsa's target that at least 99% of critical suppliers must be assessed, including ESG aspects.

AUDITS

Finally, we complete these evaluations by implementing an audit plan following a protocol to assure compliance with internationally accepted ESG standards.

We conducted a total of 110 on-site audits in 2021. At the end of this year, a total of 155 active suppliers have been audited. The audit findings are valid for 24 months, during which time we help suppliers to close any 'Non-Conformities' that may have been detected. Action plans are drawn up and must be followed and evidenced for closure. This year we have exceeded our target of closing at least 80% of 'Non-conformities' from 2019 and 20204.

4 92% of major Non-conformities and 80% of minor Non-conformities were closed, so an average of 86% were closed.