High levels of governance require companies to manage their risk carefully. At Suzano, this management strategy is structured around three complementary areas, each supported by dedicated teams focused on minimizing the likelihood of potential impacts from risk events across various aspects of the business.

Risk management

At Suzano, integrated risk management is carried out by the Corporate Risks area. This area works closely with other teams within the company to identify, evaluate, prioritize, treat, monitor, and report the key risks associated with our operations. The goal is to ensure the continuity of our business. The Integrated Risk Management Policy governs this entire process.

According to Suzano's Enterprise Risk Management (ERM) process, the company identifies its main risks through a structured method. These risks are assessed based on their probability of occurrence and their impacts, whether quantitative (financial) or qualitative (health and safety, environment, socio-cultural aspects, image and reputation, organizational climate, and legal factors). Each aspect of impact is considered equally important in the final risk assessment. Following this evaluation, a risk matrix (known as a heatmap) is created to prioritize the risks and establish mitigation action plans, including prevention and containment strategies.

It is worth emphasizing that the risk management process is continuous, and the risk matrix may change as internal and external business conditions evolve. Suzano's risk management process relies on structured multidisciplinary groups to ensure a comprehensive overview of the entire company. These groups meet regularly to discuss risks and are responsible for identifying, evaluating, treating, and monitoring the risks within their respective units or areas. They are organized into three main categories:

1. Regional Risk and Business Continuity Committees (RCNs): specific to industrial units, with each plant having its committee, led by a designated coordinator from the unit's structure, to discuss the risks applicable to its reality. RCN meetings take place at least every two months;
2. Technical Risk Forums: specific to corporate areas. The forums are held individually for each corporate area. Depending on the topic to be discussed, they are attended by the heads of each area (functional directors and/or executive managers) and their direct and/or indirect leaders. The meetings take place at least once a year;
3. Risk Meetings, specific to international units, are similar to the RCNs and occur at least quarterly.

The reports produced by the Corporate Risks area identify priority risks classified as having high or critical levels. These reports are presented quarterly to the Executive Committee, which includes all of Suzano's vice presidents and the CEO, as well as to the Statutory Audit Committee. Additionally, they are provided annually to the Board of Directors. These reports aim to discuss risk mitigation strategies and other pertinent issues related to the risk management process. It is important to note that Suzano's integrated risk management process undergoes annual certification audits and client audits.

The Corporate Risks area is also tasked with overseeing the crisis governance process, which is built on key pillars:

• Definition of crisis levels (regional, corporate and institutional);
• Definition of triggers for each level of crisis, including activation of the Statutory Audit Committee and the Statutory Audit Committee;
• Composition of the Crisis Committees, with more evident roles for each member;
• Reporting rules.

As part of this governance upbringing, crisis training and simulations are conducted annually for the prominent people involved in this process to prepare them for possible crises.

Operational risk management

The Risks area establishes the Risks and Business Continuity Committees outlined above in collaboration with various units. Suzano faces operational risks and emerging threats that could disrupt its activities, either partially or temporarily. These interruptions may arise from equipment failures, accidents, fires, climate-related events, exposure to natural disasters, cyberattacks, and pandemics.

These events could lead to severe damage to our property, a significant reduction in production, increased production costs, and potential accidents—whether involving fatalities or not—affecting our employees and/or service providers. Additionally, these events may negatively impact our financial performance and overall operating results.

We rely on the reliable availability of logistics and transportation networks, including roads, railroads, terminals, and ports. However, these networks can be disrupted by factors beyond our control, such as social movement demonstrations, natural disasters, or interruptions in the supply of materials to our industrial and forestry operations. Any delays in delivering our products to customers can also impact our financial and operational performance.

Market risk management

Suzano has established monitoring and control processes for market risks, recognizing that the pulp market is cyclical and influenced by global price trends. These trends are driven by supply and demand, global pulp production capacity, and economic growth conditions.

The price may also be influenced by exchange rate fluctuations in the currencies of significant pulp-producing and consuming countries, variations in stock levels held by producers and buyers based on future price expectations, and producers' strategies to introduce more competitive products to the market.

Paper prices tend to be more stable than those in the pulp market, primarily influenced by the supply and demand dynamics of the specific markets where they are sold. Additionally, these prices can fluctuate based on several uncontrollable factors, such as changes in pulp prices and the unique characteristics of the market in which Suzano operates.

The company cannot guarantee that pulp prices will stay at current levels. However, effective plant management gives us a competitive advantage in production costs and greater resilience during price declines.

The significant volatility of the real against the dollar could significantly impact Suzano's revenues and indebtedness, as well as the Brazilian securities markets.

Fluctuations directly influence export revenues in exchange rates. When the Brazilian Real appreciates against the dollar, export revenues decrease. Additionally, revenues from the domestic market can also be impacted by exchange rate volatility. Furthermore, changes in exchange rates affect some of the company’s operating costs, including export insurance, freight charges, and the prices of specific chemicals used in product manufacturing.

A significant portion of Suzano's debt is denominated in dollars. As a result, if the Brazilian Real depreciates against the US dollar, the financial expenses related to these debts and other obligations could increase. Conversely, these expenses could decrease if the Brazilian Real appreciation is high. It’s important to note that the company has chosen to maintain its debt in dollars because its future cash flows are either in dollars or indexed to the dollar. Therefore, while a real depreciation against the US dollar may raise the company’s financial expenses, it will also positively impact its revenues, and vice versa.

Fluctuations in interest rates can either increase or decrease the cost of new financing and existing operations. Suzano continuously explores alternatives for utilizing financial instruments to minimize any negative impacts on its cash flow caused by interest rate fluctuations in Brazil and internationally.

The previously mentioned points in the market risk management process are addressed by identifying and evaluating risks, implementing strategies, and using financial instruments to protect against potential losses. To manage the impact of adverse scenarios on results, the company has established processes for monitoring exposures and policies for risk management. These policies define the limits and specify the instruments to be used to:

• Protect cash flow due to currency mismatch;
• Mitigate interest rate exposures;
• Reduce the impact of fluctuating commodity prices;
• Exchange debt indexers.

Risk management and social impacts

As part of its social relationship strategy, Suzano addresses socio-environmental and economic impacts by continuously diagnosing and identifying issues. This enables the prevention, mitigation, and compensation of any adverse effects from its operations. The company implements management practices and makes socio-environmental investments, along with ongoing prevention and control measures. Additionally, Suzano seeks to enhance beneficial impacts that promote territorial development in areas influenced by its activities.

The management model focuses on identifying and evaluating social aspects and impacts. It systematically identifies, classifies, and prioritizes the significant effects on the human environment that arise from the company's activities in the areas and communities surrounding its operations. Based on their significance, the model defines the necessary mechanisms, controls, guidelines, and monitoring practices for each identified aspect or impact.

This procedure involves mapping and classifying the social impacts associated with Suzano's various operational processes and activities based on their relevance. The significance of these impacts is determined using the Social Aspects and Impacts Matrix, which evaluates seven factors: detection, incidence, class, severity, frequency, demand, and scope of the identified impacts.

This process begins with a weighting system, followed by a qualitative analysis to assess the significance of the social impact at each unit. We establish measures and action plans for every significant adverse effect identified to avoid, mitigate, monitor, and repair the damage. These plans are documented in reports, manuals, and procedures, which serve as guidelines for conducting activities and inform decision-making.

Each year, the Social Relations department of every unit evaluates whether the Social Aspects and Impacts Matrix needs to be updated. This assessment considers the outcomes of monitoring and critically evaluating stakeholder relations processes. Additionally, feedback from stakeholders through the company's stakeholder relationship management system, Relacione+, is reviewed. This system facilitates identifying and assessing elements contributing to the matrix's composition.

The instances in which this issue is monitored include the local and corporate Shared Value Committees (CVCs), which deal with Suzano's reputational assessment based on its relationship with strategic stakeholders (including communities), the Regional Risk and Business Continuity Committees (RCNs), which monitor all the risks associated directly or indirectly with Suzano's operations, including social risks, and the Sustainability Committee, whose duties include evaluating and suggesting improvements in the process of dealing with communities and providing the Board of Directors with guidance on decisions related to this issue. 

Climatic factors

Climate change can significantly impact Suzano's operations, exposing the company to physical and transition climate risks. Physical risks stem from climate changes that adversely affect favorable conditions in Brazil, which could negatively influence the growth rate and quality of eucalyptus plantations. These risks may lead to financial consequences such as a decline in fair value, loss of biological assets, decreased productivity, or interruptions in production.

Transition risks emerge from changes in the market, regulations, or legal frameworks aimed at shifting society toward a low-carbon economy. These risks can have financial implications, such as introducing a carbon price, which may become a cost for companies that fail to reduce their emissions.

Suzano adheres to the Task Force on Climate-related Financial Disclosures (TCFD) and follows its recommendations for managing and reporting risks and opportunities. However, given that the TCFD initiative was incorporated by the IFRS Foundation in 2023 and the Brazilian Securities and Exchange Commission (CVM) adopted reporting resolutions based on the IFRS sustainability and climate change booklets in 2024, throughout this year, the company began to prepare itself to adhere to this scenario.

To effectively address the impacts of climate change, Suzano monitors these risks through its Business Matrix. By utilizing this matrix along with various research and trend analyses, the company aims to increase carbon removal from the atmosphere through its forestry operations and to reduce its emission intensity.

Suzano is taking several initiatives to adapt to climate change. These include conducting climate modeling studies that consider the unique characteristics of each region to generate operational recommendations and guide potential expansions. The company is also researching how to develop eucalyptus clones and seedlings that are more resilient to climate variations and extremes. Additionally, Suzano is preparing contingency plans for critical scenarios, such as potential water shortages in the river basins where it operates. For more information, please refer to the "Climate Change at Suzano" indicator.

With specific regard to environmental risk management, we implement the Integrated Risk Management Policy along with the Corporate Climate Change and Environmental Management Policies. Our Industrial Environment and Forestry teams monitor the Matrix of Operational Environmental Aspects and Impacts. This matrix helps us track operational risks and controls through specific processes. Additionally, we conduct regular assessments to ensure compliance with all relevant legal requirements. Our operations regularly undergo internal and external audits by an independent third party.

Lines of action

Suzano employs a corporate risk governance model that follows the three lines of defense framework established by the Institute of Internal Auditors (IIA) and incorporates best practices from the market. The primary objective of this model is to ensure that risk management is effectively integrated at all levels of the company and that responsibilities are divided. This approach enhances the strength of risk management, oversight, and analysis. The main lines of action are:

1st line - Business Areas: Responsible for managing process risks, implementing corrective actions, and executing action plans.
2nd line - Internal Controls, Corporate Risks, and Compliance: Provides consultative and supportive functions, assisting in mapping, identifying, and managing business risks while fostering an effective control, monitoring, and reporting environment to support the company’s continuity.
3rd line - Internal Audit: This department ensures an independent assessment of the company’s risk and control environment, reporting findings to senior management, the Statutory Audit Committee, and the Statutory Audit Board.

Internal Controls

The mission of the Internal Controls area is to promote a culture of internal controls across the organization. We aim to provide technical support to various areas of Suzano, focusing on monitoring critical processes, mitigating and addressing risks, and ensuring compliance with applicable regulations. Additionally, we advise senior management on decision-making to enhance the sustainability and longevity of the company's operations.

Conduct and ethics management

Suzano has established several instruments to ensure the ethical management of its business. These include the Code of Ethics and Conduct, the Ombudsman Policy, the Disciplinary Measures Policy, the Rules of Procedure for the Conduct Committee, and the Sustainable Purchasing Policy. Together, these documents outline the guidelines for the company’s governance processes.

Our Code of Ethics and Conduct is rooted in the company's Culture Drivers. This document outlines six ethical principles that guide our daily actions, emphasizing the quality of our relationships, products, and services. It serves as a tool to direct our actions and decisions, ensuring that our interactions with employees, shareholders, customers, suppliers, service providers, government agents, and communities align with the ethical behavior and respect we maintain in our relationships with various stakeholders.

The Complaints Channel provided by Suzano is a confidential and independent resource available to employees and the public to report any issues that may violate our Code of Ethics and Conduct. The company's Culture Drivers inspire this Code, which encompasses six ethical principles that guide our daily actions. We emphasize the importance of quality in our relationships, products, and services. This document serves as a vital tool for steering our actions and decisions, ensuring that our interactions with employees, shareholders, customers, suppliers, service providers, government representatives, and communities align with the ethical standards and respect we strive to uphold in all our stakeholder relationships.

Compliance

Essential to good corporate governance practices, compliance initiatives form the basis for ensuring ethics, integrity, and transparency in all of Suzano's businesses and its relationships with its stakeholders. An intelligence program for prevention, detection and response gives rise to eight essential elements of the Compliance Program, which are: Tone at the Top; Risk Assessment; Policies and Procedures; Training and Communication; Conflict of Interest; Third Party Management; Control and Monitoring; and Governance and Reporting.

Cautionary principle or approach

Every year, the risk processes undergo internal audits, which are evaluations of the effectiveness and efficiency of the governance, risk management and control processes, as well as offering objective and independent assessment and consultancy services, and external audits, which consist of evaluating the adequacy of the Integrated Management System following regulatory requirements (ISO 9001, ISO 14001, ISO 45001), including assessing the legal compliance of items related to products/services, the environment, occupational health and safety.

Any deviations identified are recorded, and corrective and preventive actions are defined and implemented.