Company: MT
Filing Date: 2025-03-10
Form Type: 20-F
Source: 0001243429-25-000017
Chunk: 50

Company: ArcelorMittal
Filing Date: 2025-03-10
Form: 20-F
Chunk 50
---
 the support of its Committees, ensures that internal control functions operate properly. The Audit & Risk Committee monitors the effectiveness of internal control and risk management systems implemented by the Board of Directors and management. As part of its role to foster open communication, the Audit & Risk Committee meets at least annually with management, the head of Global Assurance and the Company’s independent accountants in separate executive sessions to discuss any matters that the Audit & Risk Committee or each of these persons believe should be discussed privately. Management's responsibility is to ensure that the organizational structure plans, executes, controls and periodically assesses the Company's activities. It regularly reviews the relevance of the organizational structures so as to be in a position to adapt them swiftly to changes in the activities and in the environment in which they are carried out. The business segments' and operational entities' management are responsible for the internal control and risk management system within their scope of responsibility. ArcelorMittal has defined responsibilities that cover the three dimensions of internal control: operational management, which is responsible for implementing internal control, support functions such as Finance, Legal, Treasury or Human Resources, Health & Safety and Sustainability & Environment which prescribe the internal control systems, verify their implementation and effectiveness and assist operational employees, and Global Assurance who, through their audit reports, provide recommendations to improve the effectiveness of the systems. Following a risk-based approach, business processes and/ or management systems may be the subject of an internal audit performed by the Global Assurance Department reporting to both the Audit & Risk Committee Chair and the Group Executive Chairman in accordance with the international framework of the internal audit and its Code of Ethics. The audit plan, which is risk based, is submitted annually to the Audit & Risk Committee. The Global Assurance department presents its results to the management of operational entities and business segments and reports to the Audit & Risk Committee, Executive Office and Group CFO. The design and effectiveness of the key operational, financial and information technology controls related to internal control over financial reporting, are regularly examined and assessed in compliance with the Sarbanes-Oxley Act.

27

| Management report |

Cybersecurity Risk management and strategy The Group Chief Information Security Officer and Head of Cyber Strategy (“CISO”) follows the Group risk management program as defined by the Global Assurance team in the management of risks relating to the security of information systems. For further information on the Global Assurance team, see “Corporate governance—Sustainability committee—Global Assurance”. The Group CISO is an experienced information technology and operation technology executive . He is a leading international chief information officer with proven expertise