Risk Management - GeoPark

20
23

SPEED/
SUSTAINABILITY REPORT

Risk Management

Scroll down

Risk culture

We have developed a series of actions to foster a culture of active, rigorous risk management aligned with our SPEED values:

  • We carry out risk management training activities in our organization
  • We design and implement innovative processes and initiatives that contribute to the consolidation of an effective risk management culture
  • We have programs that enable our employees to take the lead in identifying and reporting risks, as well as in continuously improving our risk management practices

Risk management system

Different areas are involved in actively and responsibly managing the operational and technical risks identified. Their role as leaders is to increase the understanding and management of risks in their areas throughout the whole organization. The challenge in 2024 is to transform the current area-based management into a corporate management system. This is currently in process.

Risk management governance at GeoPark

The Board of Directors is responsible for monitoring risk management at GeoPark, and through its different committees it provides guidelines and monitors the success of risk identification and management.

Currently, two of our Board members have experience in this area. For more information about the composition of the Board, our highest governing body, see page 26 of this Report.

At GeoPark, everyone shares responsibility for risk management. However, there are positions which by their nature mean that they have the most risk management responsibility at the operational level:

Double Materiality (DM)

In 2023 we carried out our first double materiality exercise, whose main input was the Company’s corporate risk matrix. The result was the definition of eight material topics with double impact on sustainability issues.

In 2024 we will work to incorporate double materiality results into the corporate risk management system. Alignment of the prioritized material topics with the risk matrix is shown in the following table:

Human Rights and Physical Security

Our SPEED/Sustainability Integrated Value System is at the heart of GeoPark’s corporate identity and has been part of our DNA since day one. Generating value for all our stakeholders determines what we do and how we do it, which is why our actions are framed in the commitment to respect and promote Human Rights

We have a grievance mechanism called Cuéntame that is aligned with the United Nations Guiding Principles on Business and Human Rights (UNGP) and allows us to engage directly with all stakeholders at any time.

We inform relevant authorities about situations that affect or could affect the Human Rights of our stakeholders, including neighbors and social leaders that we have identified as Human Rights defenders. We are committed to actively looking for solutions to problems, always within legal boundaries and respecting the Human Rights of third parties. This implies promoting dialogue in scenarios in which there are no de facto channels, and always in coordination with relevant authorities.

Promoting respect for Human Rights during the public hearing of the Bienparado project (PUT-8)

During the environmental public hearing, led by the Nature & Neighbors team and in accordance with the mandate of the environmental authority for the Bienparado development area license evaluation, we undertook actions to promote respect for the Human Rights of the communities. These actions included:

 

Human Rights Due Diligence

Human Rights management starts with identifying potential impacts and their associated risks. Different areas of the Company participate in these analyses

when we arrive in a new area. We carry out an early management analysis to identify the possible social, economic and environmental impacts that our projects could have on the environment and neighboring communities. This detailed review is the basis of our Environmental Impact Assessments (EIA), which authorities require to evaluate social license to operate.

Based on the information collected, we implement actions aimed at preventing the occurrence of risks and mitigating their potential impact. This work is reported to the neighboring communities and local authorities at the times established by the legislation of each respective country in which we operate, as well as in different participation spaces that our team organizes periodically.

We conducted Human Rights Risk and Impact Analyses in Putumayo, Colombia as part of our due diligence process in 2022. We replicated this exercise for our operations in Ecuador and Colombia’s Llanos basin in 2023. As a result of each risk analysis, our team works with Human Rights consultants to design and implement action plans to prevent the occurrence of the identified risks and mitigate impacts if they do happen.

According to the results of the Human Rights Risk Analyses that we have carried out, none of our operations is at significant risk of forced or compulsory labor or child labor.

This is the first cycle of Human Rights Risk Analyses, and we plan to update it every four years.

(PG HR6) In 2023:

  • We trained 93 employees in Human Rights through induction sessions
  •  We included a Human Rights component in our contractor inductions from September onwards. 2,107 contractors received this training • We conducted Human Rights risk analyses for our operations in Ecuador and Colombia (Meta and Casanare). The consultants who assisted us in this process presented proposals for action plans to prevent and mitigate the risks identified. We are defining the actions we will undertake, the areas that will be responsible, and the indicators to assess our progress
  • We took part in the following working groups and discussion spaces:

» IPIECA’s Human Rights Working Group: Made up of representatives of member companies of international association IPIECA, which shares best practices and develops tools for Human Rights-focused management

» Guías Colombia: A group led by the Ideas para la Paz Foundation that brings together representatives of several companies in Colombia to draw up guidelines to help strengthen Human Rights and international humanitarian law in the country. In 2023 we contributed to the Climate Change and Just Transition Guide. GeoPark is currently approving its implementation

  • As a member of Guías Colombia, we implemented the self-diagnosis tool to evaluate our work in Human Rights. This tool evaluates 9 transversal indicators associated with GRI due diligence standards and 24 indicators associated with Guías Colombia standards. We scored 97% progress, reflecting high levels of Human Rights and International Humanitarian Law compliance in the exercise of security activities
  • The Mining and Energy Committee for Security and Human Rights (CME): A permanent and independent platform for dialogue and collaborative construction, present in Colombia since 2003 and which brings together various organizations and institutions interested in the protection, promotion and respect of Human Rights in relation to security. It is a multi-stakeholder initiative that promotes and contributes to the implementation of the Voluntary Principles and improves the management of Human Rights related to corporate security in the mining and energy sector. We joined in 2023, and every month we participate in meetings to share best practices in physical security and analyze situations and scenarios around this topic

(DH3) In 2023, no cases were received, through legal channels, Cuéntame or other communication mechanisms, of violations or affectations of our stakeholder´s Human Rights as a consequence of our operations

  • Daily situation monitoring in our areas of interest and social surroundings, to generate alerts and/or recommendations that allow us to avoid incidents or minimize risks to people and the operation
  • Access control processes, analysis and risk assessments, monitoring cargo vehicles and people and permanently updating a database that allows us to understand our social surroundings and the sector and, from that, issue information that contributes to decision-making
  • Communications and awareness-raising to strengthen a safety culture in which all employees contribute to safeguarding people and the operation
  • Structured approaches with public and private security forces

In addition, we continuously develop and/or update:

  • Risk analyses of each of the assets that make up the operation and the protection plans derived from this analysis • The business management and continuity plan • Good self-care practices
  • Ongoing communication with protection leaders on each asset
  • The Information, Monitoring and Analysis Center (CIMA), where we consolidate and record events, reliability studies, and keep in touch with and assist employees while on business trips
  • The Road Safety Center (CSV), which ensures compliance with current regulations and the standards established for vehicles and drivers that provide service in GeoPark operations, to reduce risks in the organization

Cybersecurity

(DJSI 1.9.1/2/3)

As we recognize the importance of safeguarding GeoPark’s information and digital assets:

  • We have an information security model aligned with the critical infrastructure cybersecurity framework of the National Institute of Standards and Technology, (NIST)
  • We have an internal information security/ cybersecurity policy that is available to all employees
  • We implement a training and awareness plan on information security/cybersecurity, which is planned and carried out annually and includes:

» Awareness messages sent via email, the Company’s internal social network and screens located throughout our facilities

» Training exercises on identifying phishing and malicious emails, so that employees can recognize them and report them to the Cybersecurity team

» Talks with employees and users » Cybersecurity training in new employee inductions

» Activations as part of the commemoration of Cybersecurity Day (November 30), which include cybersecurity talks and activities in the family and at work

» Incentives for the users who most report suspicious activities or emails in a year

  • We have an escalation process through which employees can report suspicious email or digital activity. Reports can be made through a button in the Outlook app. In addition, we have two channels to report potentially malicious events: » An email address (ciberseguridad@geo-park. com) that is managed by cybersecurity analysts and specialists from the Security Operations Center, and operates 24/7 » ChatBot (olivia@geo-park.com), a channel of the IThink team that connects employees with the help desk
  • We have a business continuity plan that defines the guidelines we must follow in the event of cybersecurity breaches. This plan is evaluated and tested every six months
  • We audit our IT infrastructure and information security management systems. During the last fiscal year, this exercise was conducted by external auditors • We carry out a vulnerability analysis using third parties, including simulating hacker attacks
  • We have a cybersecurity committee at a strategic level that meets quarterly to review the cybersecurity model strategy and the aspects that can be improved. This committee is made up of the Compliance Officer, Chief People Officer, Corporate Governance Manager, Chief Technology Officer and Information Security Manager
  • Our strategy and cybersecurity-related activities at the corporate level are overseen by the Board Audit Committee
  • During 2023 we had no information security breaches at GeoPark