Link to strategy:

1         Building and strengthening number 1 and number 2 network positions

2         Maintaining a lean cost advantage

3         Maintaining customer and operational excellence

4         Continuing to leverage data and digital platforms

5         Grow revenue

6         The best people

  V           Considered as part of the long-term viability assessment (turn to page 31 [of the Annual report] for further details)

Mitigation

easyJet's number one priority is the safety and security of its customers and people.

A Safety Committee (a committee of the Board) provides oversight of the

management of easyJet's safety processes and systems.

Turn to page: 57 [of the Annual report] for further details.

A Safety Review Board (at Executive Management Team level) is responsible for directing overall safety policy and governance. This is chaired by the Chief Executive.

Safety Action Groups from across the airline are responsible for the identification, evaluation and control of safety-related risks.

easyJet operates a Safety Management System using a leading software system (SafetyNet). This is used to:

•       collect and analyse safety data (enabling potential areas of risk to be projected); and

•       enable learning from easyJet and industry events/incidents to be captured and embedded into future risk mitigations.

A robust incident reporting process and 'Just Culture' are in place.

easyJet has an emergency response process and performs regular crisis

management exercises.

Hull (all risks) and liabilities insurance (including spares) is held.

easyJet has an industry-leading fatigue risk management system and has implemented the European Aviation Safety Agency ("EASA") Flight Time Limitations regulations.

Turn to page: 42 [of the Annual report] for further details.

A Security Decision Group, comprising the Chairman of the plc Board, Chief

Executive, appropriate members of the Executive Management Team and other senior management, determines whether easyJet should continue to operate in countries or areas affected by security-related incidents or conflict. As part of that process the easyJet security team works to provide the Security Decision Group with the most timely, credible and reliable information upon which to base operational decisions. easyJet adheres to all recommendations and guidelines provided by the authorities.

The Director of Safety and Security and the Head of Security work with authorities and governments around easyJet's network to assess whether security measures are effective and in compliance with regulatory requirements. A significant amount of work is carried out with the aim of enhancing:

•       early identification of developing and emerging security risks;

•       the active management of security risks;

•       the methods for reducing the impact of any security-related incident; and

•       the Group's security culture and awareness.

Mitigation

Critical systems are hosted either across two data centres, or at third-party provider locations. Recovery arrangements, including failover between the two data centres, are in place for all locations holding critical systems.

An IT incident management team is in place to respond rapidly to any unforeseen incidents that may arise.

IT disaster recovery plans are tested regularly to identify opportunities for

improved resilience.

Business continuity plans ensure easyJet is prepared in the event of loss of facilities, including alternative sites for the relocation of critical staff.

There is a defined procurement process, led by a centralised procurement team, which ensures a competitive and robust selection of suppliers. As part of the process, alternative service providers are identified and assessed against a balanced evaluation criteria within the major markets in which easyJet operates.

Any specific supplier risks are identified and assessed during the procurement process and controls and risk mitigations are included in the contracts entered into with the supplier.

Contracts are managed according to easyJet's supplier relationship management framework, with key principles covering defined ownership and accountability, a governance framework and effective communication. Supplier performance is monitored through regular business reviews, including achievement of service level agreements and key performance indicators.

Robust transition plans are agreed in the event of switching suppliers to enable an acceptable level of service to be maintained.

As easyJet operates across Europe, its crew are members of 20 unions and 11 representative bodies across eight countries. easyJet seeks to maintain positive working relationships with all trade unions and other representative bodies.

Each of the countries in which easyJet operates has localised employment terms and conditions. This mitigates the risk of large-scale internal industrial action occurring at the same time.

Processes are in place to adapt to disruptions as a result of industrial action.

The Board considers that the efficiencies achieved by operating a single fleet type outweigh the risks associated with easyJet's single fleet strategy.

The Airbus A320 family (which includes the A319 and A321) is one of the two primary fleets used for short-haul travel, the other being the Boeing B737 family. There are approximately 7,400 A320 family aircraft operating with a proven track record for safety and reliability.

The introduction of the A320neo during the year in part mitigates this risk as the aircraft is equipped with a different engine type.

easyJet operates a rigorous established aircraft maintenance programme.

To mitigate the potential valuation risks, easyJet regularly reviews the second-hand market and has a number of different options when looking at fleet exit strategies. Sale and leaseback facilitates the exit of A319 aircraft from the fleet by transferring residual value risk, and also provides flexibility in managing the fleet size.

Mitigation

The Finance Committee (a committee of the Board) oversees the Group's treasury and funding policies and activities.

Turn to page: 63 [of the Annual report] for further details.

This includes:

•       maintaining a treasury policy setting out Board approved strategies for foreign exchange and fuel hedging, along with liquidity, interest rate management, counterparties' limits; and

•       reviewing and reporting on compliance with Board treasury policies.

The policy is to hedge revenue and costs within a percentage band for a rolling 24-month period.

Board policy is to maintain a liquidity buffer including cash and a $500 million revolving credit facility provided by a group of 12 relationship banks. This allows the Group to better manage the impact of downturns in business or temporary curtailment of activities. The basis for the liquidity policy was revised in 2016. The policy is to maintain a minimum liquidity buffer at £2.6 million per 100 seats (previously £4 million per aircraft).

A strong balance sheet supports the business through fluctuations in economic conditions and the Group has access to diverse sources of funding to support liquidity requirements.

The easyJet Change Board meets monthly to review progress made on the portfolio of programmes and solve issues that require escalation.

Key IT projects or programmes have additional oversight through the IT Governance and Oversight Committee (a committee of the Board).

Turn to page: 63 [of the Annual report] for further details.

Each project or programme has its own steering group which provides challenge to the project, monitors progress and ensures that decisions are made at the appropriate level.

A portfolio management office is in place to oversee delivery of projects and programmes, and track budgets and realisation of benefits.

A project management framework, which sets out the governance requirements, key processes and controls, is followed by all projects and programmes. Lessons learnt reviews are undertaken to ensure continuous improvement to this approach.

Mitigation

There is a recruitment strategy for pilots and cabin crew. This includes pilot sponsorship and the Amy Johnston flying initiative to attract more female pilots. In addition, easyJet has developed a coherent employment brand to attract and retain top talent.

easyJet also this year opened recruitment for 14 engineering apprentices and sought to encourage more women to apply for these roles.

easyJet's aim is to develop talent from within. There are several talent development programmes in place for individuals who have been identified for fast-tracking into more senior roles as vacancies arise.

Alongside this, there is an annual succession planning process to ensure there are clear successors for all key business roles.

Mitigation

easyJet has put in place in Austria a third AOC; easyJet Europe. This will ensure easyJet can retain its intra-EU flying rights. We continue to actively engage with the European Commission, EU Member States and the UK government to ensure that there is an EU/UK agreement in place to maintain flying rights between the UK and the EU.

An internal working group has been established to manage all aspects of easyJet's operations and structure with relation to the EU exit and the implementation of the third AOC.

easyJet has an in-house legal and compliance team to advise on legal issues and developments, and to monitor compliance with formal regulatory requirements. It also has a panel of external legal advisers, both in the UK and in key easyJet markets, who are briefed to keep easyJet informed of any changes or new legislation and to assist easyJet in developing appropriate responses to such legislation.

The Regulatory Affairs Group co-ordinates easyJet's role in influencing future and existing policy and regulations which affect the airline industry and will work with industry bodies to assist in this, as appropriate.

Country Review Boards are established for easyJet's main markets, raising awareness of in-country issues, and providing a forum in which to highlight any potential legislative changes and impacts in the different countries.

Mitigation

easyJet has an active shareholder engagement programme led by its investor relations team. As part of that programme easyJet engages with easyGroup Holdings Limited on a regular basis alongside its other major shareholders.

In addition, the Company has a relationship agreement with easyGroup and Polys Holdings in line with the controlling shareholder regime as set out in the Financial Conduct Authority's Listing Rules.

Representatives from the Board and senior management take collective responsibility for addressing issues arising from any activist approach adopted by the major shareholder. The objective is to address issues when they arise and anticipate and plan for potential future activism.

easyJet has a number of initiatives in place to ensure that its shares are held by relevant shareholders in order to comply with European Union regulations. easyJet's current ownership by EU-relevant, non-UK shareholders is close to 50%.

The brand licence agreement with easyGroup Ltd provides for the regular meeting of senior representatives from both sides, attended by the Chief Financial Officer and General Counsel, to actively manage brand-related issues as they arise. Such meetings occur on a quarterly basis and have proven effective. easyJet also monitors compliance with brand licence service levels and has a right to take steps to remedy any instance of non-compliance.

An Information Security Steering Group, chaired by the General Counsel, oversees any developments in data threats and controls, and determines whether actions taken in response are appropriate.

There are dedicated information security teams that monitor threats and ensure that the design, implementation and operation of easyJet systems are secure. This is through the following:

•       achieving secure by design through a dedicated security architecture capability;

•       monitoring of secure systems for unauthorised access;

•       reviewing the security of external and internal systems, including easyJet.com, through periodic vulnerability scanning;

•       considering information security risks within procurement processes and the introduction of new systems and IT services;

•       ensuring payment card security with data encryption and a dedicated team to monitor and control access;

•       reviewing and refreshing information acceptable use policies; and

•       maintaining staff security awareness and education through a Security Champions network, on-line training materials and periodic awareness campaigns.

Given the nature of this risk, the appropriateness of mitigation activity is continuously reviewed under the governance of an information security programme. This programme is subject to independent programme assurance on an at least annual basis.