ESG - Governance

Create long-term sustainable value supported by a strong and strategic corporate governance structure. We evolve while committed to the best corporate governance practices.

Our roadmap. Grifols 2030 Agenda

• Supplier assessments using ESG criteria
• Maintain claims ratio in Biopharma
• No critical deficiencies detected in external audits

Our priorities

• Ethics

• Transparency

• Human rights

• Honesty

• Sustainability

• Safety and
  quality

• Integrity

• Independence

• Legal
  compliance

Alignment with the UN Global Compact

Grifols adheres to several principles

Principle 1. We support and respect the protection of internationally proclaimed human rights in our sphere of influence.

Principle 2. We ensure we are not complicit in any human rights abuses.

Principle 10. We work against corruption in all its forms, including extortion and bribery.

Solid governance

The General Shareholders’ Meeting is Grifols’ sovereign governing body. The company encourages all shareholders to attend, with no minimum share capital requirements. Grifols held its 2023 Ordinary General Shareholders’ Meeting on June 16, with 75.5% of voting capital represented. Grifols’ shareholders approved all the proposals submitted to a vote.

The Board of Directors is Grifols’ highest decision-making body, comprised by 11 members as of February 2023. However, there is one vacancy on the Board.

After the close of the fiscal year, Grifols has announced the addition of a new board member on February 26, 2024, who will hold the category of executive director as of April 1, 2024.

Board members serve their term for a period of four years, without prejudice to their indefinite reelection for such periods.

The board includes a Lead Independent Director, and all committees and commissions are comprised by non-executive directors, at least two of whom are independent. This applies to the Appointments and Remuneration Committee, the Audit Committee and the Sustainability Committee.

Grifols publishes its Annual Corporate Governance Report following its approval by the Board of Directors. The report discloses information on its ownership and management structures, among other issues.

Performance and compensation

Grifols is committed to fostering a culture of performance with a laser-focus on execution, efficiency, effectiveness and accountability. Last year, the company implemented short- and long-term incentive strategies to advance this aim.

The Long-Term Incentive Plan is based on the granting of stock options to approximately 220 Grifols employees, including the CCO and COO, and the unique granting of stock options to the executive chairperson, Thomas Glanzmann.

In order to vest the options awarded, beneficiaries must have been continuously employed by Grifols on each vesting date and also meet the following conditions:

• Achievement of 90% on average over the preceding two years of the following two core metrics, required to collect their short-term annual compensation: (i) economic metrics linked to Grifols’ overall performance as measured by EBITDA (90% weight) and (ii) ESG metrics (10% weight).
• Successful validation of an individual performance evaluation.

Beneficiaries who serve on the Board of Directors must pass an annual evaluation led by the Appointments and Remuneration Committee. In the remaining cases, beneficiaries must achieve a performance rating of 3 or more on a scale of 1 to 5, being 5 the highest possible score.

Assessments are carried out through the Grifols Performance System (GPS), a standardized tool to assess employees’ effectiveness and potential, as well as provide relevant feedback.

This plan was voted on and approved at this years’ Ordinary General Shareholders’ Meeting.

Long-term variable remuneration

Review and update of Grifols’ Remuneration Policy

The remuneration policy for Grifols’ directors was last approved at the Ordinary General Shareholders’ Meeting on June 10, 2022, effective for fiscal years 2022, 2023 and 2024. In 2023, the Appointments and Remuneration Committee conducted in-depth reviews of the organization’s remuneration systems based on feedback from shareholders, investors and other stakeholders, as well as the consultative vote on the annual remuneration report at each General Shareholders’ Meeting.

Following this review and analysis and advice from the independent external advisor Mercer LLC, the Appointments and Remuneration Committee deemed changes were necessary to Grifols’ remuneration policy. Therefore, reinforcing the firm’s business strategy and long-term sustainability and alignment with its strategic plan, shareholder interests and corporate values, while ensuring prudent risk management and no potential conflicts of interest.

The most salient changes regarding the previous remuneration policy include:

• Short-term variable in cash remuneration to be paid to Grifols’ executive directors: updated metrics and weighting to promote the company’s overall objectives, with each variable tied to the Group’s financial and non-financial results and subject to appropriate and prudent risk management strategies. This remuneration is now fully paid in cash.
• As a novelty, it also includes a long-term incentive plan for Grifols’ Chief Operating Officer (COO) and Chief Corporate Officer (CCO), both executive directors. It consists in the award of Class A stock options. Subject to separate terms and conditions, it also includes the award of Class A stock options to the Executive Chairperson to incentivize the attainment of Grifols’ long-term strategic priorities, the sustainability of results over time and the creation of sustainable shareholder value.
• Establishment of the main contractual conditions of Grifols’ Executive Chairperson agreement.
• Remuneration of Grifols’ Chairperson of Honor.

More information on Grifols’ remuneration system:
Directors’ Remuneration Policy
Annual Report on Directors’ Remunerations..

Cybersecurity, privacy and data protection

Cybersecurity

The Audit Committee on Grifols’ Board of Directors is charged with supervising and evaluating the efficiency of the company’s cybersecurity management and control measures. In this endeavor, the Committee is supported by the Internal Audit and Corporate Risk Management Division, whose director provides updates at least twice a year on cybersecurity management issues.

Grifols’ primary cybersecurity governance and commitments are outlined in the Cybersecurity Policy, approved in 2023 by the Board of Directors.

The head of the Information Security Office (ISEC) reports to the Chief Digital Information Officer and oversees the development and implementation of the company’s cybersecurity policies, standards and procedures, as well as the rollout and effectiveness of its information security management system.

To support the ISEC, Grifols will establish the Global Cybersecurity Committee, composed of representatives from Grifols business units, information technology, legal, operations and services areas. The committee’s goal will be to facilitate the alignment of cybersecurity initiatives with business objectives and strategy; to ensure the global coverage of the information security management system; collaborating in the prioritization and execution of security initiatives and projects; and promoting a culture of protection against cybersecurity threats.

Grifols has the necessary resources to ensure a cyber-environment that supports its business priorities while complying with established cybersecurity objectives.

All of Grifols’ cybersecurity initiatives align with the international framework of the U.S. National Institute of Standards and Technology (NIST) and ISO27001.

In 2023, Grifols recorded no relevant cyberattacks, cyber-related thefts, loss of sensitive data or physical damages that affected the normal development of its operations.

Major actions in 2023:

Identification and protection

Grifols’ information security strategy is grounded on a risk-based approach, and is implemented through the procedures and tools necessary to ensure that cybersecurity risks are identified, monitored and managed appropriately.

The ISEC identifies the security initiatives and projects that must be implemented to achieve the company’s approved risk levels. These initiatives are identified and defined in the Security Master Plan, which is updated on a regular basis.

Detection

Grifols’ Security Operations Center (SOC) operates 24/7, providing robust coverage for security events in its data centers, perimeters and workstations. These services respond after receiving alerts from the security information and event management (SIEM) system, defined by the Information Security Office. Grifols’ cyber-intelligence capabilities provide information on threat actors and their techniques and tools, enabling the rapid deployment of controls to thwart successful attacks.

Response and recovery

The incident response team intervenes when events detected by the SOC are likely to become security incidents, using digital forensic analysis and incident response (DFIR) capabilities to analyze, contain and mitigate their risk, as well as prevent recurrences. Grifols conducts regular tests to evaluate the response and recovery capabilities of tools, procedures and equipment.

Additional controls

Grifols has an annual training and cybercommunication plan to bolster its information security management system and promote organization-wide awareness.

This plan is updated to reflect new threats and the specific needs of Grifols’ business areas. Training sessions are mandatory, and, in addition, phishing simulation exercises are carried out, among others, to test employees’ knowledge.

In 2023, 95% of users registered in the Grifols Training Platform (GTP) have completed the global cybersecurity training.

The company’s security certifications include ISO27001 and the National Security Scheme (ENS) for certain activities and group companies.

Right to privacy and data protection

Grifols aspires to forge trust-based relationships when processing stakeholder data as part of its daily objectives, with two clear objectives: preserving their privacy and preventing data breaches. The company complies with all applicable data-protection laws and regulations, and works with suppliers that provide adequate guarantees and privacy measures. The Global Privacy and Data Protection Policy, mandatory for all employees, includes a robust framework for the processing of personal data, as well as outlines all pertinent data protection and security principles.

All employees receive training on this policy, since training and awareness are critical to protecting privacy. Additional training is also imparted to team members who process personal data as part of the regular job duties. In 2023, Grifols offered privacy training and awareness sessions to over 70% of employees whose roles include the treatment of personal data.

Grifols has rigorous safety, technical and organizational measures to safeguard its organizational assets and users in a cyber-environment, and protect the confidentiality of stakeholders’ personal data, including medical information collected in plasma donor centers and clinical trials.

More information on privacy measures in clinical trials: “Innovation”

More information on privacy measures for donors: “Commitment to Donors and Patients”

We are transparent

Interactions with healthcare professionals and organizations

Grifols’ interactions with global healthcare professionals and organizations enrich its knowledge and awareness of patient behavior and disease management, which are critical to improving the quality of patient care and expanding treatment options. Conducted with maximum integrity and transparency, these relations are regulated by Grifols’ Global Compliance Program.

The company’s Gifts and Hospitality Policy informs employees of the appropriate standards and established limits for managing transfers of value and hospitality to healthcare professionals, public officials and other individuals.

United States

The U.S. Sunshine Act (PPS Act) requires manufacturers and group purchasing organizations (GPO) of pharmaceuticals, biologicals, medical devices and medical supplies to itemize all information relating to payments and transfers of value to specific professionals and healthcare organizations, including physicians, mid-level practitioners and teaching hospitals. The Centers for Medicare and Medicaid Services (CMS) publishes information extracted from these reports every year in the month of June.

Grifols has a policy and procedure regarding its transparency program and its compliance with reporting obligations defined by federal and state agencies.

The company adheres to the Pharmaceutical Research and Manufacturers of America (PhRMA) and the Advanced Medical Technology Association (AdvaMed) Codes on Interactions with Healthcare Providers, and continues to develop compliance systems to reflect the latest code updates (AdvaMed in June 2023 and PhRMA in January 2022). Both codes aspire to bolster the ethical norms and principles in interactions with the healthcare community.

In accordance with these principles, healthcare companies like Grifols can hire external consultants or advisors under the following conditions: the selection process is based on qualifications and experience and for a specific need; financial compensation reflects fair market value established for these services; and the relationship is formalized through a written contract.

Grifols imparts a transparency-training program for all employees whose roles require them to interact regularly with U.S. healthcare organizations and professionals. In total, 78 U.S.-based employees took part in these sessions.

Europe

In Europe1, Grifols voluntarily adopted practices outlined in Chapter 5 of the European Federation of Pharmaceutical Industries and Associations (EFPIA) Code, making them extensive to all corporate divisions and operations.

In 2023, for the eighth consecutive year, Grifols disclosed all payments and transfers of value to healthcare organizations and professionals in the various European countries defined by the EFPIA Code. The company’s transparency program includes procedures and processes to ensure compliance with this initiative.

As a member of MedTech Europe, Grifols’ Code of Ethical Business Practice likewise reflects these transparency guidelines, including the disclosure of Training Grants carried out in 2022. In addition, the company discloses all information related to country-specific transfers of value in compliance with local regulations.

1. The EFPIA Code includes the following countries: Austria, Belgium, Bosnia-Herzegovina, Bulgaria, Croatia, Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Ireland, Iceland, Italy, Latvia, Lithuania, Luxemburgo, Malta, North Macedonia, Norway, the Netherlands, Poland, Portugal, Romania, Russia, Serbia, Slovakia, Slovenia, Spain, Sweden, Switzerland, Turkey, Ukraine and United Kingdom.

Grifols’ corporate website includes a methodology note and specific reports on transfers of value to healthcare professionals and organizations in concrete countries. This information is publicly available.

1. Transfers of value in Europe as defined by the EPFIA Disclosure Code. ToVs included with one-year intervals.
2. Includes research grants. Research data as defined by the EPFIA Disclosure Code do not reflect the company’s entire R&D investment.
Biotest data includes information from the Biotest AG group under Biotest Compliance supervision.

Public affairs management

Advocacy is a legitimate and fundamental part of the democratic process, providing a channel for people to share their viewpoints and concerns with public officials. Grifols’ advocacy entails interacting with policymakers and political circles to raise awareness on the vital importance of plasma-derived medicines and the need for unrestricted access in healthcare centers. The Code of Conduct and Anti-Corruption Policy offers guidelines and standards of interaction between Grifols employees and public officials.

Grifols follows the highest ethical standards in its dealings with public officials, acting with the utmost integrity and transparency. In the U.S., Grifols complies with all federal, state and local regulations, regularly submitting transparency reports on its lobbying-related expenses to the U.S. Congress in compliance with the Lobbying Disclosure Act (LDA).

Grifols’ lobbying disclosure reporting requirements are governed by standard operating procedures and encompass all of its activities in the U.S. and European Union. The company does not make campaign contributions to political candidates or government officials, either directly or indirectly.

Grifols joined the European Union’s Lobby Transparency Register in 2019, adhering to the rules of conduct governing relations with European Union institutions as articulated in its code of conduct. Through this register, the company has a platform to disclose its interactions with EU institutions and share its activity and positions on public consultations. The company also takes an active role in public consultations related to health and industrial policies.

Grifols is a member of three other EU organizations: Plasma Protein Therapeutics Association (PPTA), European Confederation of Pharmaceutical Entrepreneurs (EUCOPE) and MedTech Europe.

2020 and 2021 data includes US contributions at federal level only. Data for 2022 also includes state contributions.

Highlights in 2023

Grifols’ European involvement

Grifols participates in health policy discussions with a broad network of EU stakeholders to help improve people’s access to health care. In 2023, the company actively participated in the following public consultations:

• Draft regulation on Substances of Human Origin (SoHO)
• Draft regulation and directive on Pharmaceutical Legislation

Review of EU pharmaceutical legislation

In 2023, the European Commission released a proposal to update general pharmaceutical legislation which must be followed by its applicable legislative process in the EU Parliament and Council. In this regard, Grifols has collaborated with diverse institutions to make sure the proposal advances access to healthcare and R&D investments in the European pharmaceutical space, while recognizing the unique nature and qualities of plasma-based medicines.

SoHO: new legislation on substances of human origin

On December 14, 2023, the European Parliament and the Council reached an agreement to further increase the safety and quality of substances of human origin (SoHO) following the Commission’s July 2022 proposal. The new SoHO rules lation aims to increase citizens’ protection when donating or receiving such substances as blood, tissues or cells or the products derived from them. In the case of plasma, it also seeks to contribute to ensuring its availability, as it is an essential substance for the production of plasma medicines on which nearly 300,000 European citizens depend.

The next steps include the formal adoption of the SoHO regulation by the Parliament and the Council, from which point EU member countries will have 3 years to implement it. Once adopted and implemented in all countries, the regulation will replace the safety and quality standards set out in two directives (2002/98/EC on blood and blood components and 2004/23/EC on tissues and cells) and their implementing acts.

More information:

• Proposal for a Regulation on substances of human origin
• Substances of human origin - ECDC
• Substances of human origin - European Directorate for the Quality of Medicines & HealthCare

Risk management and control

Risk management in Grifols

The Risk Control and Management Policy establishes the basic principles and the general framework of action for the identification, evaluation, control and management of the risks, of all kinds, that Grifols faces. Its objective is to provide greater confidence in the achievement of Grifols objectives and strategy to patients, donors, employees, shareholders, customers, vendors and other stakeholders, through the anticipation, control and management of the risks to which Grifols is exposed.

This policy is implemented through a comprehensive risk control and management system based on the principles outlined by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) which includes: governance and culture, strategy and objective-setting, performance, review and revision, information, communication and reporting.

Governance

The Board of Directors of Grifols proposes the Risk Control and Management Policy to ensure that the company achieves its objectives and meets the expectations of its stakeholders, delegating the supervision of the effectiveness of the risk management system to the Audit Committee in coordination with the Corporate Risk Committee

The Audit Committee includes independent directors who oversee the effectiveness of Grifols’ risk management system by ensuring its main risks are adequately identified, managed and communicated. In this role, the Audit Committee receives support from the independent functions of Internal Audit and Enterprise Risk Managemen (ERM), which reports to the Chief Internal Audit and Enterprise Risk Management.

Both the Board of Directors and the Audit Committee meet periodically with the heads of the company’s business areas, assurance functions, external legal advisors and external auditor to discuss issues related to the company’s risk management.

The Corporate Risk Committee is composed of a multidisciplinary and multifunctional team, which includes members of the management team and other senior executives, as well as the secretary of the Audit Committee. The Corporate Risk Committee is responsible for overseeing the assessment, management and monitoring of risks, and for ensuring the integration of risk management into business processes.

The Enterprise Risk Management department assists the Corporate Risk Committee in developing and implementing risk-management policies and procedures.

Internal management framework

• Risk control and management policy
• Risk management procedure
• Emerging risks procedure
• Risk valuation model

Risk management procedures in Grifols

Grifols has a comprehensive and continuous risk control and management process to identify, evaluate and manage all relevant risks that Grifols faces or may face, as well as assure that risk considerations are integrated throughout the organization.

The procedure applies to Grifols, S.A., and its subsidiaries, and covers all risk categories defined in the Risk Control and Management Policy.

Grifols’ Risk Management Procedure includes the following recurring activities:

Risk identification and assessment

Quarterly, the ERM department conducts regular risk scans to identify emerging risks affecting Grifols through reviews of credible external sources of information (e.g., Gartner’s quarterly emerging risk report, World Economic Forum’s global risk report, etc.); and through one-on-one discussions with internal stakeholders, as needed; and monitors top risks based on the evolution of the metrics selected as risk indicators.

Twice a year, the ERM department also surveys a group of employees (risk liaisons) selected based on their position and expertise, to assess the Company’s top risks and emerging risks, and to identify response plans and potential opportunities. These surveys, along with other internal and external risk scans are used by ERM to update the company’s risk map.

Risks are evaluated in terms of impact and likelihood of occurrence, following the ERM’s Risk Valuation Model. To rank risk for prioritization, ERM completes the risk scoring by considering risk velocity and risk interdependencies.

The risk classification proposed by ERM undergoes review and approval by the Corporate Risk Committee, which prioritizes those risks requiring immediate response and/or enhanced oversight

Grifols’ risk classification and prioritization

The full description of the risks of Grifols is public and is available in the last 20F for the year 2022, submitted and approved in April 2023.

Risk 1: Debt leverage ratio

A high level of indebtedness could have significant adverse effects on Grifols’ business, making the company more vulnerable to economic downturns and restricting its ability to make strategic acquisitions or exploit other business opportunities (among other impacts).

To this end, Grifols implemented an operational improvement plan to reinforce its competitiveness and build a more efficient and cost-effective organization. The plan focuses on three major areas: optimizing plasma costs and operations, streamlining corporate functions, and enhancing other efficiencies across the organization.

Risk 2: Cybersecurity

Information security risks have been on the rise in recent years, due to an increase of cyber-attacks and data breaches perpetrated by cybercriminals, insiders, or affected third parties, leading to business interruptions and exposure of sensitive data.

To this end, the company has implemented a comprehensive information security management system, aligned with international standards and best practices, that sets out clear objectives, roles and responsibilities, as well as policies and procedures to: (i) identify and assess cybersecurity threats; (ii) protect critical assets; (iii) detect and respond to cybersecurity threats; and (iv) recover business processes affected by a cybersecurity incident.

Risk 3: Competition and technological changes

Grifols faces significant market competition. Its current and future competitors may increase their sales, lower their prices, change their distribution model or improve their products, undermining Grifols’ product sales and market share.

Risk 4: Research and development of products

Research and development represents a significant aspect of Grifols’ business, whose core R&D objectives are to (i) discover and develop new products, (ii) research new applications for existing products and (iii) improve manufacturing processes to improve yields, safety and efficiency.

The company faces various obstacles to successfully converting these efforts into profitable products, including, but not limited to, the successful development of an experimental product for use in clinical trials; the design of clinical study protocols acceptable to the FDA and other regulatory agencies; the successful outcome of clinical trials or its ability to scale its manufacturing processes to produce commercial quantities.

Risk 5: Talent attraction and retention

Grifols’ future success depends on its ability to retain members of its senior management and capacity to attract, retain and motivate qualified personnel. The company is highly dependent on the core members of its executive and scientific teams. For this reason, the recruitment and retention of qualified operations, finance and accounting, scientific, clinical and sales and marketing personnel will be critical to its success.

Risk 6: Ethics and integrity

Grifols’ business is subject to extensive government regulation and oversight in its numerous markets of operation. The promotion, the marketing and sale of pharmaceutical products and medical devices is highly regulated and subject to increasing governmental supervision around the world. This regulatory and oversight trend is expected to continue.

Risk 7: Supply chain

A significant disruption in the company’s supply of plasma could have a material adverse effect on Grifols’ business and growth plans. Most of its revenue relies on its access to U.S. source plasma (plasma obtained through plasmapheresis), the main raw material for Grifols’ plasma derivative products.

Risk 8: Innovation and digital transformation

Grifols’ investment in new technologies, processes, and business models entails navigating various obstacles and risks, including discrepancies with its vision and objectives, cultural barriers, skill deficiencies, resource limitations, and external disruptions. These challenges have the potential to undermine the anticipated benefits of digital transformation and diminish the company’s competitiveness within the industry.

Risk 9: U.S. biopharma market

The existence of direct and indirect price controls and pressures over Grifols’ products has affected, and may continue to affect, the company’s ability to maintain or increase gross margins.

Proposed U.S. federal and state legislation have targeted drug pricing, including direct negotiations with manufacturers over price, reimbursement and discounts. Plasma protein therapeutics have been excluded from certain aspects of the several legislations. However, there is a continuing risk that Grifols’ products may be subject to new pricing restrictions.

Risk 10: Product safety and quality

Non compliance with quality and safety regulations could potentially harm the health and safety of patients, donors and/or participants in clinical trials, lead to product liability claims or product recalls, resulting in significant financial losses and negative reputation impacts.

Summary of main risks according to 20F of the year closed to 2022 public and accessible through this link.

Emerging Risks

Grifols’ risk management process includes the identification and evaluation of emerging risks, understood as new risks or risks which, although known, arise in a new or unfamiliar context and could wield a potential long-term impact on the company’s activity.

Risk 1: Geopolitical instability

Risk description:

The risk of potential disruptions and uncertainties arising from political decisions, events or conditions in specific regions or countries has increased in recent times, increasing the possibility of adverse impacts on the company’s operations, supply chain, regulatory environment and market access as a result of geopolitical tensions, policy changes, trade disputes and other geopolitical factors.

Potential impacts:

• Market access limitations: Geopolitical developments, such as changes in diplomatic relations or trade agreements, could limit the company’s access to key markets, impacting sales and revenue growth.
• Supply chain disruptions: Geopolitical instability, such as regional conflicts or political unrest, or the escalation of trade tensions between regions or blocks leading to increased tariffs or trade barriers, may disrupt the global supply chain, affecting the cost structure and competitiveness of the company.
• Regulatory challenges: Changes in pharmaceutical regulations or shifts in regulatory enforcement practices in key markets such as the United States and China could create hurdles in terms of product approvals, manufacturing compliance, and market access.

Mitigation action plans:

• Monitoring and analysis of geopolitical developments.
• Diversification of manufacturing and supply chain across different regions, reducing reliance on any single country or region and enhancing resilience against supply chain disruptions.
• Comprehensive regulatory compliance monitoring to closely monitor and adapt to changes in pharmaceutical regulations in key markets.

Risk 2: Cybercrime Sophistication

Risk description:

The risk that the level of complexity, advancement and innovation of cyberattacks exploit vulnerabilities in the company’s digital infrastructure. The convergence of artificial intelligence (AI) and quantum computing with traditional cyber threats can significantly amply the potential for highly sophisticated and disruptive attacks.

Potential impacts:

• Disruption of critical business operations, including the compromise of interconnected systems and partners, can lead to cascading effects.
• Leakage of sensitive personal data, including health data from donors and patients.
• Deepfake threats to leadership and communications: AI-generated deepfake technology may be employed to create convincing fake videos or audio recordings, leading to damages, misinformation and distrust within the organization, and damaging the company’s credibility and reputation.

Mitigation action plans:

• Continuous identification and assessment of cybersecurity risks, including third-party risks.
• Security measures to protect the confidentiality, integrity and availability of information systems and associated processes (including information systems managed by third parties), and continuous monitoring of their effectiveness.
• Effective response and recovery programs, encompassing people, processes, information systems and technology.
• Highly qualified cybersecurity team, comprised of management, information technology and legal personnel.
• Training for employees, executives and directors regarding cybersecurity risks, and protection of sensitive and personal data.

Promoting a risk culture

A solid risk culture is essential for organizations to effectively identify, assess and manage the risks that could impact their operations. Grifols delivers training and awareness programs to encourage employees throughout the organization to identify risks and work to actively mitigate them, as well as promotes transparent communications among employees in risk-related functions.

Currently, three non-executive members of Grifols’ Board of Directors, in addition to the secretary of the Audit Committee, have proven experience in risk management and control and, from their leadership roles, contribute to fostering a risk management culture throughout the company.

Training: Grifols develops and imparts training and awareness-raising plans to ensure employees have a solid theoretical foundation and practical knowledge of environmental issues, health and safety, compliance, cybersecurity, crime prevention, pharmacovigilance and quality, among other areas.

Additionally, the ERM Department is updating the training plan on the general principles of risk management, methodologies, best practices of good governance and emerging risks, for the members of the Board of Directors, Audit Committee, Corporate Risk Committee and employees who participate in the semi-annual risk liaisons assessment.

Members of the Corporate Risk Committee receive regular training on new governance requirements and trends. Twice a year, they also participate in forums and workshops to assess risks, including emerging risks. Members of the Audit Committee (non-executive directors) also receive this training through yearly meetings.

Transparent communication: Grifols organizes regular meetings with risk managers and workshops and surveys with other employees to encourage transparent communication regarding its corporate risks.

Integration of risk criteria in product development: Grifols incorporates risk criteria into the intellectual property and quality requirements followed throughout the product development and approval processes.