MAIN RISKS ASSOCIATED WITH THE ACTIVITIES OF THE IBERDROLA GROUP

The IBERDROLA Group is subject to various inherent risks in the different countries, sectors and markets where it operates and in its activities, which they might not achieve its objectives and implement their strategies successfully.

The Board of Directors of the Company aware of the importance of this aspect, promises to develop all its capacities in order that the relevant risks of all the activities and business of IBERDROLA Group are identified adequately, measured, managed and controlled, through the overall political control and risk management, basic principles and mechanisms for proper risk-management team with a chance level of risk that allows:

- Achieving the objectives of the Strategic Plan with a controlled volatility.

- Provide the highest level of assurance to shareholders.

- Protect the performance and reputation of the IBERDROLA Group.

- Defend the interests of customers, shareholders and society.

- Ensure corporate stability and financial soundness in the short and long term.

In order to implement this commitment, the Audit and Compliance Committee, as a consultative body, aids the Board of Directors and the Executive Committee by supervising and reporting on the suitability of the risk evaluation and internal control system, based on the following principles:

- INTEGRATE the risk/opportunity outlook into management of the Company by defining the risk strategy and appetite and incorporating this variable in strategic and operating decisions.

- SEPARATE operating-level duties of risk-taking areas and the areas responsible for analysing, controlling and supervising risks, thereby guaranteeing an adequate level of independence.

- GUARANTEE the correct use of the risk hedge instruments and its registration according to the requirements under the applicable rules.

- REPORT, with utmost transparency, the risks to which the IBERDROLA Group is exposed and the performance of risk control systems to regulating bodies and main external agencies, maintaining the proper communication channels.

- ALIGN the specific risk policies of the different businesses and companies controlled by the IBERDROLA Group with the general risk policy.

- ADOPT benchmark international best practices in transparency and good governance in respect of control, management and supervision of risks, in particular the Enterprise Risk Management (ERM) framework designed by the Committee of Sponsoring Organisations of the Treadway Commission (COSO), in order to ensure ongoing improvements to the integrated control and risk management systems.

- ACT at all times in accordance with prevailing legislation and regulations and the values laid out in the IBERDROLA Group Professional Code of Conduct.

The risk policy and the underlying principles thereof are the basis for the Company’s integrated control and risk management system, which obtained the AENOR ISO 9001:2000 quality certificate in December 2005. As part of this system, operating-level duties and responsibilities are adequately defined and assigned, and methodologies, procedures and support tools are adapted to the different stages and activities. These include:

- Identification of relevant market, credit, business, regulatory, operating, environmental, reputational and other risks, bearing in mind possible effects on the key management targets of the IBERDROLA Group Strategic Plan, new investments and financial statements (including contingent liabilities and other off-balance sheet risks).

- The analysis of these risks, both in individual corporate areas or businesses and considering the effect on the IBERDROLA Group as a whole and, in particular, the analysis of the risks associated with new investments, with risk vs. return as a key element in the decision-making process.

- Establishment of a policy, guidelines and limits structure, as well as of the mechanisms for approval and implementation thereof, to effectively ensure that risk management reflects the Company’s risk appetite.

- Implementation and control of compliance with policies, guidelines and limits through the appropriate procedures and systems, including any contingency plans necessary to mitigate the impact should these risks materialise.

- Measurement and control of risks in accordance with standardised IBERDROLA Group-wide procedures and, in particular, monitoring and periodic control of income statement risks in order to contain the volatility of the IBERDROLA Group’s yearly results.

- Information and internal control systems enabling regular and transparent evaluation and reporting of the conclusions reached in monitoring risk control and management, including compliance with the policies and the limits established.

- On-going evaluation of the suitability and efficiency of the system and the best practices applied, and recommendations for possible new incorporations in the risk management model.

- Supervision of the system by the Internal Audit Department, in accordance with the Basic Internal Audit Regulations.

This general policy develops and complements through the corporate and specific policies of risks that are established in relation by certain business or societies of IBERDROLA Group. They are detailed later and that also are an object of approval on the part of the Board of Directors of the Company.

- Corporate risks policies:

• Investment policy

• Treasury share policy

• Listed investee companies’ risk policy

• Funding and financial risks policy

• Credit risk

• Insurance policy

• Reputational risk framework policy

- Specific business risk policies:

• Spanish and Portuguese liberalized business risk policy

• Network business risk policy

• Iberdrola´s business in Latin America’s risk policy

• Iberdrola´s business in the United Kingdom’s risk policy (Scottish Power)

• Energy East´s risk policy

• Iberdrola Ingeniería y Construcción´s risk policy

• Iberdrola Inmobiliaria´s risk policy

The system takes into account any type of risk deriving from the domestic and international non-regulated and non-regulated activities of the Group, such as:

- Market risk: exposure to fluctuations in prices and market variables, such as exchange rates, interest rates, price of raw materials (electricity, gas, CO₂ emission rights, other fuels, etc), price of financial investments and others.

- Credit risk: possibility that a counterparty fails to comply with contractual obligations, thereby causing an economic or financial loss to the IBERDROLA Group. Counterparties include end customers, partners, suppliers, contractors, and counterparties in financial or energy markets.

- Business risk: uncertainly regarding trends in key variables inherent to IBERDROLA’s business, such as demand characteristics, environmental conditions, strategies of different agents and others.

- Regulatory risk: arising from changes in regulations; for example, with respect to remuneration for regulated activities and supply conditions, environmental regulations, tax regulations and others.

- Operating risk: direct or indirect losses due to improper internal procedures, technological failures, and human errors, or as a result of certain external events, including the economic, social, environmental and reputational impact, as well as legal risk.

- Reputational risk: negative impact on the value of the company caused by the perception held by critical stakeholders, such as shareholders, customers, media, analysts, public entities, and the general public.

Because of its universal and dynamic nature, it can easily respond to new risks that may affect the IBERDROLA Group following changes in external factors or modifications to objectives and strategies.

In addition, the system can easily be updated in view of the results of the ongoing monitoring, verification, review and supervision efforts.

4.1 Market and business risks

The IBERDROLA Group’s activities are subject to a range of business risks, such as changes in demand, factors affecting hydroelectric and wind power production and other weather conditions, and a range of market risks, such as fuel prices for generation, the price of CO2

emission allowances and wholesale prices in the electricity market.

In both the Spanish market, where IBERDROLA’s main activities are based, and in the UK market, which is the Group’s second most important market following the acquisition of Scottish Power, the current generating mix provides significant cover through the range of generating technologies used; hence the market and business risks associated with production and trading, and, in particular, risk deriving from the indexation established in certain energy contracts, can be managed effectively.

The remaining risk, resulting from price fluctuations on products against which fuel prices are indexed, and the exchange rate, is offset through diversification and management of supply contracts which aim to:

• Index price, as far as is possible, against indices which replicate the changes in revenue on the demand side (commercial and generation markets).

• Inclusion of revision and re-opener clauses which help prices keep pace with market changes.

Finally, the Group’s risk policies establish limits on the risk positions existing at any particular time, and these are managed by hedging.

In the case of the Mexican market, the Group does not have a significant commodity price risk, with the main contracts being of the pass-through variety.

In the case of electricity and gas trading activities carried out by IBERDROLA in other countries, limits are established on the positions which can be open at any time, in terms of both the amounts of money involved and the timescale covered.

4.2 Regulatory risks

Companies in the IBERDROLA Group are subject to a complex framework of laws and regulations concerning prices and other aspects of their activities in Spain and the other countries in which they operate. The introduction of new laws and regulations, and modifications to existing ones, may have a negative effect on the company’s activities, financial situation and the results of its operations.

The risk policies include continuous analysis and monitoring of regulatory changes, together with decision-making based on reasonable assumptions concerning regulatory behaviour, both domestically and internationally.

4.3 Operational risks

During the operation of all IBERDROLA Group activities, there may be direct or indirect losses as a result of inadequate internal procedures, technical failures, human error, or as a result of external events.

In particular, the Network business is subject to risk related to supply outages and, in general, quality falling below the required level, which could give rise to lawsuits or penalties from the authorities, with the consequent impact on the Group’s financial position and reputation.

IBERDROLA offsets these risks by ensuring that all required investment is carried out; by applying operating and maintenance procedures and programmes supported by quality systems and planning; and through training of personnel; whilst at the same time it also arranges appropriate insurance policies.

4.4 Environmental risks

The IBERDROLA Group’s activities are subject to risks related to the existence of wide-ranging regulations and standards which require environmental impact studies to be carried out;

requirements to obtain licences and planning permission which may be subject to environmental conditions; and to environment-related taxes and market instruments, such as greenhouse gas emission allowances. As with other types of risk, can not be guaranteed:

• That the competent authorities will approve the environmental impact assessment.

• That the licences and planning permission required will be granted.

• That there will be no public campaigns against specific projects, which could result in delays or modifications to the project planned.

• That regulations will not be modified or interpreted in a way which results in increased costs, or which affects projects, operations or investment plans.

In addition, the Group’s activities involve inherent environmental risks relating to the management of waste, discharges, emissions and soils at its facilities or risks to biodiversity, and these could give rise to claims for damages, penalty proceedings and harm to the Group’s image and reputation.

The Group’s risk policies aim to mitigate these environmental risks by implementing environmental management systems for the company’s production and distribution facilities, and through continuous cooperation with regulatory bodies and any parties affected.

4.5 Risks related to new investments

All new investment is subject to a range of market, credit, business, regulatory, operational and other risks, which might undermine the objectives or profitability of the project.

Investment is subject to considerable and complex risks during the construction of new generating facilities, consisting mainly of combined cycle plant and wind farms; these may require licences or planning permission to be sought from the competent authorities, acquisition of land and the signing of leases, agreeing contracts for the supply of equipment and construction services, operations and maintenance, fuel supplies and transmission, and consumption and finance agreements, all of which can result in delays and increased costs.

The risk policy for new investments covers all such risks and establishes specific limits on forecast profitability and expected profitability risk which must be complied with before a project can be authorised. Furthermore, specific procedures are in place for the approval of major investments, which require an investment dossier to be prepared including a risk analysis before a project can be approved.

4.6 Risks associated with activities outside Spain and the United Kingdom

All of the Group’s activities outside Spain and the United Kingdom are, to a greater or lesser extent depending on their nature, also exposed to the risks described above (weather, demand, regulation, fuel prices, energy prices, the environment, and so on) and also to other risks inherent to the country in which they operate:

• Changes to government policies and regulations in the country

• Imposition of monetary and other restrictions on the movement of capital

• Changes in the market

• Economic crisis, political instability and social unrest which affects activities

• Government expropriation of assets

• Exchange rate movements

The results of all our international subsidiaries, their market value, and the transfer of these to the Group, may be affected by all such risks.

4.7 Reputational risk

The Company’s reputation is part of its value creation cycle. In this cycle, stakeholders’ perceptions of the company reflect the reputational impact of the company’s actions; every organisation in the IBERDROLA Group is committed to the Group’s vision, values and policies.

The framework policy for reputational risk establishes the basic principles for managing this risk within the Group, and also establishes monitoring indicators; specific risk policies also cover the same areas and implement actions which contribute to limiting or mitigating such effects.

4.8 Financial risks

Information related to the policy for managing financial risk is contained in Note 6 of the Consolidated Financial Statements.