Company: SQM
Filing Date: 2025-04-24
Form Type: 20-F
Source: 0000909037-25-000020
Chunk: 217

Company: CHEMICAL & MINING CO OF CHILE INC
Filing Date: 2025-04-24
Form: 20-F
Item: Item 16K
Chunk 217
---
 a cause-consequence analysis must be performed, which is registered in a Bow-Tie sheet, which will help to better identify the controls that mitigate such risk. This analysis will be reviewed at least once every six months by the Business Risk Management Department and the responsible area. 
Risk Assessment: For any critical risk related to the Company's strategic objectives, such as the risk of cybersecurity, a cause-consequence analysis must be performed, which is registered in a Bow-Tie sheet, which will help to better identify the controls that mitigate such risk. The Bow-Tie analysis is a risk management technique that provides a visual representation of potential hazards, the threats that could cause those hazards, the consequences of those threats, and the controls in place to mitigate the risks. The name "bow-tie" comes from the shape of the diagram, which resembles a bow-tie with the hazard in the center and the threats and consequences branching out on either side. This analysis will be reviewed at least once every six months by the Business Risk Management Department and the responsible area. 
Risk Treatment: Once the residual risk has been defined, there are different ways of dealing with the risks based on the risk management methodology, which must be considered on a case-by-case basis. The way in which risk is dealt with will depend mainly on the risk appetite defined for each case. 
Risk Monitoring: The Business Risk Management Department continuously monitors the action plans committed by each responsible area. 
Risk Communication: At least twice a year, the Business Risk Management Department will present SQM's critical risks, such as cybersecurity, to the Board of Directors directly, or through the Directors' Committee, so it may then report to the Board of Directors. Upon receipt of information regarding critical risks, the Board of Directors may request further details during the Board meeting or engage in discussions about the risks and/or mitigation measures with the respective responsible party.
SQM Business Risk Management Department is responsible for performing all the above described stages of the process.
Every three years, SQM's Business Risk Management Department requests a evaluation of SQM's risk management function. This evaluation is conducted by an external audit firm and includes a review of governance, processes, culture, and supporting systems, comparison with an industry benchmark, and recommendations. The most recent evaluation was conducted in 2024.
We believe to have protection mechanisms (controls) in place against unauthorized access, changes or modifications in production, development and testing environments, which may affect the confidentiality, integrity and availability of the company's information or data. Information security is subject