easyJet Regulatory News (EZJ)

Institutional investors and analysts:

Michael Barker

Investor Relations

+44 (0) 7985 890 939

Adrian Talbot

Investor Relations

+44 (0) 7971 592 373

Media:

Anna Knowles

Corporate Communications

+44 (0) 7985 873 313

Edward Simpkins

Finsbury

+44 (0) 7947 740 551 / (0) 207 251 3801

Dorothy Burwell

Finsbury

+44 (0) 7733 294 930 / (0) 207 251 3801

Risk

Significant Safety or Security Event

· The Safety Committee (a committee of the easyJet plc Board) provides oversight of the management of easyJet's safety processes and systems.

· The easyJet Safety Board, chaired by the CEO and including the Chief Operating Officer (deputy- Chair) and AOC Accountable Managers, is responsible for directing overall safety and security policy and governance. The Safety Board meets every month to review safety performance and any emerging security issues.

Risk Owner

· Chief Operating Officer

Commentary and areas of focus

· easyJet's number one priority is the safety and security of its customers, people, and contractors.

· Inactivity and managing the safety risks arising from it have been a focus during the recovery phase of the pandemic. Emphasis has been placed on identifying training needs amongst our people and third-party contractors.

· Enhancements have been made to operations and base risk management processes to improve reporting capabilities and feedback.

· This risk remains unchanged.

Potential causes

· Flight safety incident

· Health and safety incident

· Major security threat

Potential consequences

· Significant injury/loss of life

· Sustained adverse media coverage

· Reduction in future revenue

· Fines/regulatory sanctions

· Operational disruption

· Significant spike in costs

· Share price movement

Controls and mitigations to prevent or reduce the impact of the risks

· Functional Safety Action Groups from across the airline are chaired by the appropriate senior manager and are responsible for the identification, evaluation, and control of safety-related risks.

· The easyJet Safety Board meets quarterly to review safety, security and compliance performance across all Air Operator Certificates (AOCs). Chaired by the CEO and attended by the three AOC accountable managers.

· Safety Review Boards are held monthly by each AOC, chaired by the AOC accountable manager and are often attended by the local regulator.

· A Safety Policy is published that promotes the incident reporting process and supports this safety culture.

· easyJet operates a Safety Management System that includes leading software systems to:

· report incidents and identify events;

· identify hazards and threats and take appropriate risk-mitigating actions;

· collect and analyse safety data (enabling potential areas of risk to be projected); and

· enable learning from easyJet and industry events/incidents to be captured and embedded into future risk mitigations.

· Timely, credible, and reliable information upon which to base operational decisions.

· easyJet has a Crisis Management framework that provides emergency response and crisis management capabilities, supported by trained personnel and regular exercises.

· Hull (all risks) and liabilities insurance (including spares) is held.

· Security cleared specialists continually review geopolitical developments across the easyJet network in particular those countries deemed to be higher risk and report back to the Board any areas of concern.

· easyJet maintains an inspection regime of all our airports to ensure the security elements are being effectively managed.

· easyJet continually reviews and develops its safety management processes.

Risk

Significant Operational Disruption

· Non-cancellation disruption events reduced significantly in 2021 due to reduced air traffic control and airport congestion.

Risk Owner

· Chief Operating Officer

Commentary and areas of focus

· Pandemic related reduced traffic demand resulted in the European air traffic control system seeing significant reduction in Air Traffic Management delays.

· Climate change related weather disruption is increasing but managed in part through a partnership with the Met Office, which supports with weather prediction.

· Significant work has been undertaken to improve easyJet's preparedness, including a move to exception management and improved decision-making tools.

· Phase 1 of a Self-Service Disruption Management tool was launched in summer 2021 that provides greater control to customers in the event of disruption.

· Increased use of the Crisis Policy due to the pandemic has resulted in improvements and greater understanding. The result is easyJet is better prepared to deal with significant disruption events should they occur, which will limit the financial and customer impact.

· easyJet continues to face disruption challenges but the pre- and post-event preparedness has positioned the operation well and reduced this risk.

Potential causes

· Adverse weather

· Physical impacts of climate change

· Industrial action

· Technology failure

· Destructive cyber-attack (i.e. ransomware)

· Supplier failure

· Infrastructure failure

· Airspace/airport restrictions/closure

· Increasing passenger disruption due to Covid-19

Potential consequences

· Customer dissatisfaction

· Compensation and welfare payable to customers

· Inefficient use of crew/aircraft

· Adverse media coverage

· Share price movement

Controls and mitigations to prevent or reduce the impact of the risks

· Maintaining operational resilience through:

· appropriate resilience into the flying schedule;

· aircraft and crew standby;

· reporting on the day of operations, including customer communication;

· airport performance and strategic supply chain;

· air traffic control system lobbying and flight planning enhancements; and

· the use of data across the operation to predict and manage events and aid decision support.

· Liquidity buffer to better manage the impact of downturns in business or temporary curtailment of activities.

· Business interruption insurance which provides some cover for very significant shock events such as extreme weather, air traffic management issues and loss of access to key airports. The policy would allow us to claim in the event of a very substantial number of cancellations. This is included within our definition of liquidity.

· Significant focus on risk mitigation of and preparedness for a destructive cyber-attack, including running a cyber crisis exercise for senior Crisis Team and AMB.

Risk

Pandemic

· The risk associated with a pandemic is among the most significant in terms of severity. Covid-19 represents a paradigm shift in both severity and likelihood.

· Countries' legislation affects airlines' business with decisions to reopen borders without restrictions.

· Vaccine availability, efficacy and people's perception of risk are all factors that must be considered.

· The presence of virus variants is an example of high predictive volatility.

Risk Owner

· Chief Financial Officer

Commentary and areas of focus

· Prior to the Covid-19 pandemic, at least four infectious diseases occurred in recent years: SARS, Avian Flu, H1N1, and Ebola. The most significant differences between these epidemics and Covid-19 are they were short-lived, local, epidemiologically less severe, and with a much lower transmission index.

· Previous epidemics did not result in severe restrictions (lockdowns or route closures) and so Covid-19 has created a new benchmark in responding to epidemics and pandemics.

· easyJet responded quickly and decisively on customer, people and third-party contract health and financial perspective.

· easyJet follows guidance from WHO and the International Civil Aviation Organisation (ICAO), which provides standards and recommended practices for civil aviation authorities and national governments, as well as the European Aviation Safety Agency, the European Centre for Disease Prevention and Control and country specific health authorities such as Public Health England.

· We developed a Pandemic Playbook, that ensured a collaborative response and management of operational, financial, business continuity and recovery factors.

· Financial resilience was maintained through the raising of circa £7 billion of liquidity from a diverse range of sources, including a 5x oversubscribed Euro Bond at competitive pricing and a sale and lease back programme.

· Through the Covid-19 pandemic, we became adept at responding to rapidly changing market conditions and now have industry-leading agility to add new capacity and pivoting our schedule to capitalise on shifts in demand in future epidemic and pandemic events.

The likelihood of another epidemic and pandemic event occurring has increased but, through the actions we have taken to manage the impacts of Covid-19 and increase preparedness, easyJet is better prepared for future events.

Potential causes

· Global travel and physical connectivity

· Urbanisation

· Climate change

· Increased human/animal contact

· Health worker shortages

Potential consequences

· Suppressed customer demand

· Sustained adverse media coverage

· Reduction in future revenue

· Increased regulatory requirements and scrutiny

· Operational disruption

· Significant spike in costs

· Share price movement

Controls and mitigations to prevent or reduce the impact of the risks

· A Biosecurity Standards Group is in place and includes safety and security experts including our company doctor and representatives from across the airline. The Group is responsible for developing and maintaining our single set of easyJet biosecurity standards, which set out the

· requirements to ensure a safe and healthy environment for our people, customers, and contractors. Standards are translated into our Standard Operating Procedures (SOPs) and Communications.

· The Pandemic Playbook, which acts in partnership with our Incident & Crisis Management Playbook and Communicable Disease Action Group, led by the Head of Safety and with representation from key functions, is responsible for detection, assessment, and treatment of pandemic and epidemic events. Treatment includes appropriate escalation.

· A Communicable Disease Policy, that promotes the incident reporting process, supports this safety culture.

· Governance structure including a Steering Committee (SteerCo) involving the Chief Financial Officer, Chief Operating Officer, Chief Commercial Officer and Director of Strategy, to manage pandemic and epidemic events. The SteerCo is responsible for strategic oversight and communication with the Board. It maintains focus on long-term recovery.

· Maintaining balance sheet strength.

· Dynamic planning and capacity management process to manage supply and demand fluctuations.

Risk

Cyber Attack

· The aviation sector is facing into an increasingly sophisticated and persistent cyber threat and easyJet is continually defending its operation against disruption from attackers. The risk from a human operated ransomware attack and/ or data breach has increased exponentially. Ransomware is a type of malware that holds computers or files to ransom. To regain access, the victim is required to pay a large fee. Double exploitation (where ransomware is coupled with a data breach) is a growing threat. Prevention of ransomware is a strategic priority for easyJet.

· A data breach involves the unauthorised access to customer or employee data. Protecting that data and its privacy remains a priority for easyJet.

Risk Owner

· General Counsel and Company Secretary

Commentary and areas of focus

· easyJet is continually defending its operation against disruption from sophisticated attackers. The risk from a human operated ransomware attack and/ or double exploitation ransomware has increased exponentially.

· Given easyJet's position we remain an attractive target. This results in us needing to continually mature and enhance our controls, intelligence gathering and protection methods and testing our defences regularly using industry experts. To help our people keep pace with the rapidly changing threats we face we regularly educate and raise awareness of cyber threats across our community.

· The external risk environment continues to increase, however easyJet continues to invest in, and test, our cyber defences:

· attacks were well defended - known aviation attacking group attempts were blocked;

· we continue to educate and raise awareness of cyber threats across our community.

· We operate a risk-based improvement process leveraging the NIST framework as our aligned industry standard.

· We continuously invest in Digital Safety through our Digital Safety Programme, whereby we evolve with the threat landscape.

Potential causes

· Cyber attack

· Data breach

· Third-party incident

· User error

· Misconfigured systems

Potential consequences

· Sustained adverse media coverage

· Fines/regulatory sanctions

· Third-party liability/class actions

· Reduction in future revenue

· Operational disruption

· Significant spike in costs

· Share price movement

· Loss of colleague/customer trust

Controls and mitigations to prevent or reduce the impact of the risks

· A data and cyber risk governance structure exists to regularly review the data and cyber risk landscape and determine required action to take place to manage risk effectively.

· Dedicated Digital Safety team who provide assurance over third parties, proactively monitor threats, and respond to incidents.

· Employee education and awareness programme including a network of champions, online training, and awareness campaigns.

· External threat intelligence monitoring.

· Security logging and monitoring.

· Vulnerability scanning and penetration testing.

· Digital Safety programme to ensure compliance and ensure data control and protection.

· Credit card data is protected through PCI DSS compliance as a Level 1 Merchant. This is revalidated annually by an external body, to which we (and they) attest.

· Digital Safety is discussed monthly at our AMB and quarterly at our plc Board. Additionally, as part of our governance processes, the Digital Safety Board meets quarterly to discuss matters related to our Cyber security.

Risk

Failure of Critical Technology

· easyJet relies on several critical technologies that are key to the delivery of essential business processes.

Risk Owner

· Chief Information and Data Officer

Commentary and areas of focus

· Critical technologies include, but are not limited to, operational, commercial, and financial systems. A critical technology failure includes any technical failure which is sufficient to interrupt critical business operations (which may include one or more systems).

· System unavailability or a failure can also lead to loss or corruption of data.

· easyJet seized the opportunity during the period of reduced flying resulting from the Covid-19 pandemic to improve the IT environment e.g. airport network refresh and a data centre upgrade.

· The external environment does present an increase in risk; however, this has been managed through improvements to the IT environment.

Potential causes

· Destructive cyber-attack (i.e. ransomware)

· Hardware failure

· Aged infrastructure

· Data centre outage

· Third-party outage

· Technological dependency failure

· IT change

Potential consequences

· Sustained adverse media coverage

· Reduction in future revenue

· Fines/regulatory sanctions

· Operational disruption

· Significant spike in costs

· Share price movement

Controls and mitigations to prevent or reduce the impact of the risks

· Monitoring and alerting of availability of critical technologies and their inter-dependencies.

· Security logging and monitoring.

· Vulnerability scanning and penetration testing.

· Non-damage business interruption insurance in place to limit financial impact of operational disruption.

· IT Change Management Process embedded to assess risk of all changes to technology including changes made by third-party providers.

· Critical technologies are cloud hosted, hosted across two data centres or at third-party provider locations with necessary failover protocols and security perimeters in place.

· IT Major Incident Management team is in place to respond rapidly to any unforeseen critical technology incidents including those of a security nature.

· IT Supplier Relationship Management process to ensure that third-party services and associated risks are regularly reviewed and assessed.

· easyJet is progressing the delivery of a hosting and network programme that will further improve the resiliency of core infrastructure and cloud connectivity capabilities.

· IT and Digital Safety Policies and Standards that set out the technical and organisational measures for keeping our data and systems safe, as well as management of our IT assets.

· As an Operator of Essential Services under the Network and Information Systems regulation in the UK, we have to comply with the requirements laid out in the Cyber Assessment Framework for Aviation which focuses on critical systems availability.

Risk

Carbon Trading Scheme

· Adverse changes to carbon trading schemes, including the existence and/or cost of the scheme

Risk Owner

· Chief Financial Officer

Commentary and areas of focus

· Changes to carbon trading schemes, including the existence and/or cost of the scheme, have the potential to create financial consequences by changes to existing cap and trade schemes (e.g. EU ETS) i.e. the reduction of free allocations, would translate into an increase in the cost of compliance for our business.

· easyJet continues to develop its climate change agenda and has taken industry leading positions with both its carbon offsetting programme and use of the New Engine Option (neo), which produces 15% fuel saving compared to the Current Engine Option (ceo). easyJet has identified carbon pricing mechanisms as a transition risk.

· However, based on the external environment easyJet sees the potential for carbon credit pricing to increase depending on how quickly governments wish to meet emissions targets, which will result in additional cost.

Potential causes

· Political change

· Uncertainty driven by Brexit

· International alignment

· External pressure groups

Potential consequences

· Closure of existing scheme

· Loss of free allocations, leading to significant cost impact

· Introduction of new schemes

· Inability to hedge in line with fuel policy

Controls and mitigations to prevent or reduce the impact of the risks

· easyJet influences future and existing policy and regulations which affect the airline industry through several different channels, including working with relevant industry bodies to assist in this.

· easyJet looks to optimise fuel usage to reduce emissions and therefore reduce the potential impact of those schemes, for example ensuring optimal routings as well as using climb, descent and landing techniques to improve efficiency.

· easyJet has an appropriate hedging strategy.

Risk

Increased Taxation

· Future policy measures and regulation to tackle the impact of aviation on climate change could impact easyJet's business if they impose limitations and cost on how easyJet operates and the services it can provide.

Risk Owner

· Chief Financial Officer

Commentary and areas of focus

· Fuel is one of the biggest direct costs for easyJet. The business maintains a focus on operational efficiency to save fuel and CO2. Increased taxation has been included as part of our Climate Change transition risk portfolio.

· Expansion of other aviation-based taxes e.g. for departing passengers, could translate into greater compliance costs.

· The financial impact of this risk is increasing due to external pressures applied by various countries across our network.

Potential causes

· Political change

· External pressure groups

· Customer demand

Potential consequences

· Significant increase in cost of existing aviation taxes/levies

· Future expansion of taxes/levies

· Policies to constrain growth/capacity

· Increasing noise curfews

· Pressure on margins

Controls and mitigations to prevent or reduce the impact of the risks

· By engaging with key stakeholders, easyJet seeks to reach a common understanding on the drive to impose policy measures and regulation to address the impact of aviation on climate change. This includes advocating for fair and proportionate measures which incentivise airlines to be efficient and which cover all sources of aviation emissions.

· easyJet continues to explain its environmental performance, and the further action it is taking, to its customers and other stakeholders. For example, this has included highlighting the introduction of the A320neo and A321neo aircraft and their reduced emissions compared to previous generation aircraft, and work with partners regarding new technologies to radically reduce the carbon footprint of flying.

· easyJet can operate flexible routings in the event of constraints being brought in.

· The new generation Airbus A320neo and A321neo aircraft are 50% quieter during take-off and landing than the equivalent previous generation aircraft.

Risk

Airport Infrastructure

· Flying to primary airports is an important element of our customer proposition. The airports to which we fly may already be or may become congested.

Risk Owner

· Chief Commercial Officer

Commentary and areas of focus

· Due to lower volumes of traffic across the European air traffic network, congestion did not play a significant part in the day to day operation. However due to changing travel restrictions, traffic flows moved at relative short notice, which in some cases caused more localised traffic issues at major destination airports.

· With flying volumes expected to increase throughout 2022, easyJet is anticipating congestion to return to pre-pandemic levels and will rely on the existing controls and mitigations to manage the risk.

Potential causes

· Increased competitor capacity

· Environmental restrictions/pressure restricting airport expansions

· Delays in airport infrastructure expansion

· Increase in airport charges

· Changes in regulation

· Ineffective slot management

· Ineffective management of the airport operational environment

Potential consequences

· Weakened customer proposition

· Loss of market share

· Inefficient use of crew/aircraft

· Significant increase in costs

Controls and mitigations to prevent or reduce the impact of the risks

· Where easyJet is affected by industrial action or other service interruption by a key supplier, resources are deployed to manage this as effectively as possible.

· Sophisticated processes and systems to ensure slot transactions are made in an efficient and effective manner.

· Effective cross-functional governance to ensure optimal business decisions are made.

· easyJet closely monitors airport capacity through a dedicated airport development team. The team works with airports to ensure the development of appropriate capacity for easyJet in a cost efficient and timely manner.

· Managing aircraft gauge to improve our ability to grow.

Risk

Continuity of Services

· easyJet is dependent on a mixture of critical technology and processes, employees, buildings/ facilities and third-party suppliers. A loss of one or more of the above components could lead to significant disruption to operations and could have an adverse reputational, financial or legal impact.

Risk Owner

· Chief Operating Officer

Commentary and areas of focus

· During 2021, significant enhancements were made to our Crisis Framework and our approach to dealing with service continuity risks.

· The Crisis Policy was developed to operate in a hybrid working environment, so Crisis Team members can manage crises remotely. In addition, the Crisis Centre was upgraded to support our hybrid working environment.

· Our Safety Risk team reviewed all critical suppliers ahead of the restart to flying to ensure they were prepared, and the inactivity risk was well managed by identifying and addressing training requirements.

· Our Procurement Process was enhanced to include specific questions on suppliers' business continuity plans and to identify and assign appropriate ownership.

· With the enhancements made, increased use of the Crisis Policy and Procedure and a more flexible approach available, easyJet is better positioned to respond to continuity risks during 2022 and beyond.

Potential causes

· Failure of critical technology

· Destructive cyber-attack (i.e. ransomware)

· Significant external incident (weather, activism, terrorism)

· Failure of third party

· Industrial action

Potential consequences

· System unavailability for customers and/or staff

· Inability to access key buildings/facilities

· Sustained adverse media coverage

· Unavailability of critical staff

· Reliance on inadequate supplier recovery plans

· Brand/reputation impact

· Operational disruption

Controls and mitigations to prevent or reduce the impact of the risks

· The four key areas of business resilience (IT and processes, people, premises, and suppliers) all form part of easyJet's functional business and airport Business Continuity Plans.

· Critical IT systems are identified with ongoing efforts to match the business needs with recovery capabilities. The risk of system unavailability is now mitigated further, thanks to the adoption

· of the cloud and the select use of externally hosted systems, in addition to easyJet's two data centres.

· Incident Management Teams are in place 24/7 to manage low level IT incidents. If there is a major incident or an escalation of an incident that has a wider impact on other parts of the business and stakeholders, then it can be escalated into the Crisis Management framework via the Network Duty Manager.

· Time-critical staff have been identified via Business Impact Assessments and Business Continuity Plans, with regularly tested recovery desks allocated at alternate locations, should the usual place of work be unavailable. An increased provision of laptops and tablets also enables greater mobility and remote ways of working.

· Procurement processes include risk assessments aligned with business objectives. These require relevant third parties to have their own Business Continuity/ Disaster Recovery plans and we are implementing a process to review a sample of these each year.

· Maintain close working relationships with key stakeholders including, but not limited to, airport authorities and slot coordinators, lobbying where appropriate.

Risk

Non-Delivery of Strategic Initiatives

· The business continues to undertake several initiatives to support its strategy.

Risk Owner

· Chief Data and Information Officer

Commentary and areas of focus

· Market volatility arising from Covid-19 and its impacts, the external environment and organisational priority changes are having a negative effect on delivery of strategy initiatives. However, internally we have improved the control environment through greater ownership, improved business planning, reporting and involvement of subject matter experts.

· This risk remains stable.

Potential causes

· Inappropriate resource dedicated to change delivery and oversight

· Changes in organisation's priorities (may be driven by internal or external factors)

· Scope change/time available

· Approach and methodology for complex programmes

Potential consequences

· Business benefits not realised

· Financial underperformance

· Inefficient use of resource

Controls and mitigations to prevent or reduce the impact of the risks

· Complex, large-scale programmes have been initiated and prioritised through the Enterprise Project Management Office.

· The Enterprise Project Management Office oversees delivery of projects and programmes ensuring dependencies are managed across the portfolio.

· A project management framework, which sets out approval processes, governance requirements, and key ongoing processes and controls, is followed by all projects and programmes, and reviews are undertaken to ensure continuous improvement in this approach.

· Each strategic initiative has an executive sponsor and a Leadership 50 lead assigned and its own steering group, which provides oversight and challenge to the project, monitors progress against programme objectives (including budget, benefit realisation and appropriate resource) and ensures that decisions are made at the appropriate level.

· Key strategic initiatives are managed by dedicated programme management resource with the right skills and behaviours, complemented by subject matter specialist resource where appropriate.

· The executive sponsor provides routine updates to the Airline Management Board and can use this as an escalation channel for any issue resolution.

· The Board also receives updates on key strategic initiatives including any risks or issues to achieving the key milestones that enable the achievement of the five-year plan.

· The Internal Audit function provides independent programme assurance over our most significant initiatives, drawing upon independent subject matter expertise where appropriate.

Risk

Single Aircraft Type Operation

· easyJet is dependent on Airbus as its sole supplier for aircraft. The Board considers that the efficiencies achieved by operating a single fleet type outweigh the risks associated with easyJet's single fleet strategy.

Risk Owner

· Chief Financial Officer

Commentary and areas of focus

· easyJet continues to operate a single type aircraft fleet.

· The operation is set up to manage the risks associated with a single aircraft operation, with maintenance and fleet management reviewed each year to minimise the potential impact.

· Both the internal and external environment around this risk remain stable.

Potential causes

· Delays in the delivery of new aircraft

· Technical/mechanical issues

· Fluctuating second-hand market

Potential consequences

· Schedule reductions/cancellations

· Grounding of all/part of the fleet

· Loss of customer confidence

· Financial impact when aircraft leave the fleet

Controls and mitigations to prevent or reduce the impact of the risks

· There are 9,032 A320 family (A319, A320, A321) aircraft operating, with a proven track record for safety and reliability.

· Introduction of the A320neo in part mitigates this single fleet supplier risk as the aircraft is equipped with a different engine type.

· easyJet continues to work closely with Airbus to ensure full visibility of the delivery schedule for new aircraft. If there are material delays, appropriate mitigation is put in place; for example, short-term wet lease arrangements are used to minimise any operational impact.

· easyJet operates a rigorous established aircraft maintenance programme. Maintenance schedules are approved by the relevant regulatory body.

· easyJet regularly reviews the second-hand market and has several different options when looking at fleet exit strategies. Sale and leasebacks facilitate the exit of aircraft from the fleet by transferring residual value risk and provides flexibility in managing the fleet size.

Risk

Brand Licence and Major Shareholder

· easyJet has two major shareholders (easyGroup Holdings Limited and Polys Holdings Limited) which, as a concert party, control approximately 15.27% of its ordinary shares.

· easyJet does not own its company name or branding, which is licensed from easyGroup Ltd. The licence includes certain minimum service levels that easyJet must meet to retain the right to use the name and brand.

Risk Owner

· General Counsel and Company Secretary

Commentary and areas of focus

· Given the size of the shareholding, our major shareholder can influence easyJet's business in relation to actions that require shareholder approval.

· Through regular communications, the risk associated with our major shareholders remains low and stable.

Potential causes

· Shareholder activism

· Actions of easyGroup or other easyGroup licensees

Potential consequences

· Eventual loss of the brand licence

Controls and mitigations to prevent or reduce the impact of the risks

· Active shareholder engagement programme.

· Regular engagement with easyGroup Holdings Limited alongside other major shareholders.

· Representatives from the Board and senior management take collective responsibility for addressing issues arising from any activist approach adopted by the major shareholder. The objective is to address issues when they arise and anticipate and plan for potential future activism.

· Quarterly meeting of senior representatives from easyJet and our major shareholders, attended by the Chief Financial Officer and the Group General Counsel & Company Secretary, to actively manage brand-related issues as they arise.

· easyJet makes contributions to the joint brand protection fund.

Risk

Changing Legal and Regulatory Landscape

· Failure to comply with legislation and regulation, such as local consumer laws, new case law or policy changes in relation to customer compensation, environmental or airport regulation, in the jurisdictions in which easyJet operates, or data protection/information protection regulations could have an adverse reputational and financial impact.

Risk Owner

· General Counsel and Company Secretary

Commentary and areas of focus

· The legal and regulatory landscape continues to develop in the areas in which easyJet operates.

· The speed of change has increased for both legislation and regulation.

· The easyJet General Counsel Office (GCO), that manages legal and regulatory risks, has developed over the last year to be more prepared for changes

· Notwithstanding the level of change increasing, this risk remains stable.

Potential causes

· New or changes to existing legislation/regulation

· Employee/agent ignorance

· Rogue employee/agent behaviour

Potential consequences

· Sustained adverse media coverage

· Fines/regulatory sanctions

· Reduction in future revenue

· Operational disruption

· Loss of operating licence

· Significant spike in costs

· Share price movement

· Loss of colleague/customer trust

Controls and mitigations to prevent or reduce the impact of the risks

· Compliance framework including, but not limited to, policies, procedures, and mandatory training programmes.

· easyJet has an in-house team of legal and regulatory experts to advise on legal issues and developments,

· and to assist the business in interpreting any formal regulatory requirements. Where appropriate, this expertise is supplemented with specialist external support relevant to a specific discipline

· or jurisdiction.

· Panel of external legal advisers, both in the UK and in key easyJet markets, is briefed to keep easyJet informed of any changes or new legislation and to assist easyJet in developing appropriate responses to such legislation.

· easyJet influences future and existing policy and regulations which affect the airline industry through several different channels, including working with relevant industry bodies to assist in this.

· easyJet adapts to new legislation and regulation, where possible adapting existing compliance frameworks (for example mandatory training programmes and clear policies and associated guidance).

Risk

Supply/Demand Imbalance

· easyJet's success in the highly competitive European short-haul aviation market is built on our key competitive advantages: our network, cost base, brand, digital innovation, and efficient and robust capital structure.

Risk Owner

· Chief Commercial Officer

Commentary and areas of focus

· Covid-19 has impacted the aviation sector by suppressing demand and creating opportunities for both existing and local start up operators.

· Consolidation creates a more challenging environment with fewer but stronger airlines.

· As the aviation sector emerges from the pandemic, customers may favour value and low fares over brand loyalty.

· easyJet has emerged as a stronger airline with the ability to respond to rapidly changing market conditions, having developed industry-leading agility to add new capacity and pivoting our schedule to capitalise on shifts in demand.

· Despite increased competition, our enhanced scheduling capabilities and developing product and ancillary offering results in this risk improving.

Potential causes

· Increased capacity

· Industry consolidation

· Increased competition from other airlines and transport providers

· Government interventions

· Fall in consumer demand (including but not limited to macro-economic conditions and environmental concerns)

· Internal growth plans

Potential consequences

· Loss of market positions (relative market share)

· Pressure on margins

· Adverse financial position

· Share price movement

Controls and mitigations to prevent or reduce the impact of the risks

· Enhancements to our commercial organisation to provide even further focus on existing and new initiatives to optimise the revenue position.

· Weekly trading meeting to review performance - attended by senior managers, including members of the AMB.

· Relentless focus on maintaining easyJet's competitive advantages through network positioning and brand.

· The Network Development Forum, a cross-functional panel of senior managers, including members of the AMB, approves the allocation of assets around the network in the context of expected market conditions.

· Competitor and consolidation activity is monitored in detail by the Network team, enabling strategic decision making on key market positions.

· Fleet framework arrangements, together with the Group's leasing policy, provide easyJet with significant flexibility in respect of scaling the fleet according to business requirements.

· Dynamic planning and capacity management process to manage supply and demand fluctuations.

Risk

Volatility in Financial Markets

· easyJet is exposed to a variety of financial markets, volatility in which could give rise to adverse pressure on the cash flows of the Group.

Risk Owner

· Chief Financial Officer

Commentary and areas of focus

· Through Covid-19 easyJet's operational exposures reduced. Hedging positions were managed through this time so that at any time hedges became more than 100% of exposures, the excess was closed out. Any new hedging activity was reduced due to uncertainty in exposures. This approach was approved by the Finance Committee.

· Due to the additional foreign currency debt brought onto balance sheet, easyJet has become more exposed to FX revaluation through the P&L. Hedging this full risk would have been costly and would have added more volatility to the liquidity position. It was therefore approved by the Finance Committee that easyJet would accept some P&L volatility, in exchange for a better managed liquidity position.

· Hedging positions are maintaining a stable position of jet fuel price. However balance sheet revaluations are increasing foreign exchange risk.

Potential causes

· Market price risk: volatility in jet fuel prices, foreign exchange rates, carbon prices, inflation rates or interest rates

· Counter-party risk: default of counter parties used for depositing surplus cash and hedging

· Liquidity risk: inability to raise funds when required

Potential consequences

· Insufficient cash to meet financial obligations as they fall due and/or the inability to fund the business when needed leading to insolvency

· Significant increase in costs

Controls and mitigations to prevent or reduce the impact of the risks

· The Finance Committee (a committee of the plc Board) oversees the Group's treasury and funding policies and activities.

· Treasury policy sets out plc Board approved strategies for market price risk management, counter-party credit risk management and liquidity risk management. Monthly reporting on all treasury activity including reporting on compliance with treasury policy.

· Maintaining a liquidity buffer supported by cash and a business interruption insurance policy.

· Ability to access diverse sources of funding to support liquidity requirements.

· Rolling hedging programmes on jet fuel and foreign exchange market price exposure.

Risk

Industrial Action

· easyJet, and the aviation industry in general, has a significant number of employees who are members of trade unions.

· Each of the European countries in which easyJet operates has localised employment terms and conditions. As such its pilots, crew and engineers are members of 21 trade unions across seven countries. There are also an additional seven consultative bodies including five Works Councils and a European Works Council.

Risk Owner

· Group People Director

Commentary and areas of focus

· Highly constructive relationships with our trade union partners, works councils, and our people have allowed the business to adapt throughout 2021 and position the business to emerge with strength from the pandemic.

· Productivity has increased by reducing the number of crew per aircraft.

· Sustainable improvements have been made using part-time and seasonable contracts, which were agreed with our union partners.

· Agreements with our union partners have been made throughout the last year, with routine seasonal recruitment taking place to ensure the operation is ready to meet demand. This risk remains stable.

Potential causes

· Adverse employee experience

· Changes to terms and conditions

· Political unrest

Potential consequences

· Sustained adverse media coverage

· Operational disruption

· Significant spike in costs

· Reduction in future revenue

· Share price movement

· Loss of colleague/customer trust

Controls and mitigations to prevent or reduce the impact of the risks

· easyJet seeks to maintain positive working relationships with all trade unions and other representative bodies and has a framework in place for consulting and engaging with trade unions and consultative bodies.

· In the event of industrial action or expected disruption, easyJet has processes to mitigate the impact to our operations. The Operations department also has specific procedures to deal with such events.

· Adoption of innovative part-time working patterns.

Risk

Talent Acquisition and Retention

· In today's shifting environment, we need to place even more focus on recruiting the right people and building the right talent.

Risk Owner

· Group People Director

Commentary and areas of focus

· Retention of critical talent continues to be a risk and is proactively managed, particularly given the continued uncertainty and challenge of our industry and our inability to offer compelling short-term financial reward.

Potential causes

· Uncompetitive remuneration packages

· Lack of career progression

· Outdated ways of working

Potential consequences

· Sustained inability to deliver key strategic initiatives

Controls and mitigations to prevent or reduce the impact of the risks

· Creation of retention programme for the 2022 financial year co-sponsored by HR Director, M&A and People Development and Reward Director.

· Projects making up the programme include:

o Leadership and Management Capability Development

o Talent Development Programme

o Inclusion & Diversity

o Employee Value Proposition

o Wellbeing Framework

o Recognition Principles and Platform

o Reward Approach

· Hybrid working across our office-based communities that support new ways of working with the right policies, processes, and technology to improve the employee experience.

· Quarterly engagement survey across all communities to gain insight on employee sentiment.