TCFD APPENDIX SOCIAL 1 IMPACT 2022 TCFD Theme Thomson Reuters Response Relevant Disclosure Strategy Transition-related risks are largely mitigated via Thomson Reuters net-zero commitment and interim c) Describe the (con’t) science-based targets. With Thomson Reuters’ focus on primarily digital products and services for resilience of the its customers, the business strategy is inherently resilient to multiple climate-related scenarios organization’s Task Force on Climate-Related Financial Disclosure (TCFD) Summary as it is less exposed to physical risks like price increases in raw materials or energy, for example. strategy, taking into Thomson Reuters sourcing of 100% renewable energy for its global operations further mitigates the consideration different 1 potential impacts of rising energy prices associated with fossil fuel-based energy sources. Our use climate-related TCFD Theme Thomson Reuters Response Relevant Disclosure scenarios, including a Governance The Corporate Governance Committee of the Board oversees Thomson Reuters overall approach a) Describe the board’s of cloud-based models for data services also ensures the resiliency of our digital services by limiting to ESG and ensures its alignment with our long-term business strategy. The committee receives oversight of climate- the exposure of our data to physical climate-related impacts. Thomson Reuters’ ongoing supplier 2°C or lower scenario. periodic updates from management to inform the evaluation of our ESG strategy and progress related risks and engagement program supports the alignment of our suppliers’ actions on climate and risk mitigation against climate-related goals. The Corporate Governance Committee is further supported by the opportunities. with our own climate commitments. Thomson Reuters also pursues operational leases in premium HR Committee as well as the Audit Committee and the Risk Committee of the Board, which has of昀椀ce locations with ef昀椀cient building systems, which helps mitigate the risks associated with ultimate oversight over Thomson Reuters risk assessment and management processes. In the past mandates on lower use of emissions technologies/energy supplies. Overall, our risk framework and site-level facilities monitoring enables the identi昀椀cation of adaptation measures needed across our year, Thomson Reuters conducted its 昀椀rst global ESG materiality assessment and developed our new company Purpose — to Inform the Way Forward — which now collectively anchor our ESG strategy. of昀椀ce locations and other facilities. Thomson Reuters operational climate-related management is led by an operating committee of b) Describe Risk Thomson Reuters uses an industry standard approach for assessing climate-related risks and their a) Describe the Management organization’s Thomson Reuters executives, representing the most senior body of executives responsible for setting management’s role potential impacts and integrates identi昀椀ed ESG risks into the enterprise risk management (ERM) and executing our company strategy. This committee is supported by additional management bodies, in assessing and process. The Risk & Compliance team performs an annual enterprise risk assessment exercise with processes for managing climate- each Business Segment and Enabling Function and partners with the heads of each division to assess identifying and including the Enterprise Risk Committee, which assesses the status of identi昀椀ed risks, reviews the assessing climate- related risks and and describe their top respective risks. The risks identi昀椀ed by each business function are categorized adequacy of applicable mitigation plans, and reports these 昀椀ndings to this committee. The Social related risks. Impact Institute, led by our Vice President, Government Affairs and ESG, leads the implementation of opportunities. within Thomson Reuters Enterprise Risk Taxonomy, which classi昀椀es risks into pre-de昀椀ned categories, our climate strategy, embedding climate initiatives within our departments and business segments establishing a common risk language and a consistent means of risk aggregation across our c) Describe how and engaging internal and external stakeholders. business. Upon aggregation, risks are assigned a Low, Medium, High, or Critical level of severity processes for based on the Enterprise Risk Management Framework. identifying, assessing, Strategy Over the course of the last year, Thomson Reuters completed a comprehensive update of our ESG a) Describe the and managing materiality assessment, with the results informing our strategy and guiding our reporting. In 2022, climate-related risks climate-related risks Thomson Reuters also conducted a comprehensive climate-related scenario analysis to identify and and opportunities are integrated into the evaluate exposure to climate-related risks and opportunities. As part of this process, various climate the organization has organization’s overall identi昀椀ed over the pathways were applied to Thomson Reuters direct operations, strategy, and value chain, re昀氀ecting risk management. a range of future states of global emissions trajectories. The scenario analysis assessment covered short, medium, and b) Describe the physical and transition climate-related risks on our direct operations, strategy, and value chain. This long term. As material climate risks are identi昀椀ed and assessed through our Enterprise Risk Management exercise has enabled Thomson Reuters to identify relevant climate-related risks as well as several process, the Risk & Compliance team reports these to the Enterprise Risk Committee, comprised of organization’s key areas of opportunity — primarily around the procurement of renewable energy and participation senior executives, as well as the Risk Committee of the Board. Many of Thomson Reuters relevant processes for climate risks are managed through our Business Continuity and Disaster Recovery Program (BCP), managing climate- in carbon markets, the shift to more ef昀椀cient buildings, and the development of new products and led by the Resiliency Team, and designed to address disruptions of varying scope — ranging from related risks. services through R&D and innovation. business unit-level incidents to large-scale multiple-location events. The Resiliency Team provides Short (0 – 1 years, up to 2023), medium (1 – 3 years, up to 2025), and long-term (3 – 30 years) time governance and counsel to our business units worldwide to ensure that continuity and disaster horizons were de昀椀ned to facilitate the grouping of 昀椀nancial and operational impacts and better recovery planning is performed consistently across our entire company. Business continuity plans integrate the results into Thomson Reuters’ existing risk management and strategic planning. are developed to support each business unit’s strategic and operational goals, as well as meet local regulatory requirements and customer expectations. Business units are responsible for handling The following risk areas were identi昀椀ed for Thomson Reuters, with all areas presenting low risk to Thomson Reuters across all time frames except where noted: increased pricing of greenhouse gas all application, product, and technology issues relevant to a climate-related incident or disaster, as emissions; enhanced emissions-reporting obligations (medium risk in long-term); mandates on use well as customer communications. In addition, climate-related risks located within our value chain of lower emissions technologies/energy supplies (medium risk in long-term); changing customer are managed by our Procurement Team, which is responsible for engaging suppliers on climate and requiring them to mitigate their climate risk. This occurs through the quarterly business reviews behavior; risk of supplier default or increased prices due to insuf昀椀cient supplier action on climate; increased stakeholder concern; increased costs arising from sea level rise; increased costs and conducted with key suppliers, and through the development of ESG-related clauses in our vendor contracts and the Supply Chain Ethical Code to which suppliers are held. disruption from heatwaves; increased costs and disruption from 昀氀ooding; business disruption and/ or damage arising from hurricane events (medium risk in long-term); increased costs due to water Metrics and Relevant metrics used by Thomson Reuters to assess climate-related risks and opportunities in line a) Disclose the stress; and business disruption and/or damage from wild昀椀re events. Targets with our strategy and risk management process are captured on pages 8-9 and in the “Environment” metrics used by the Exposure rankings to six climate-related hazards (heat stress, droughts sea level rise, cyclones, b) Describe the impact table in the Appendix of our Social Impact Report. organization to assess of climate-related climate-related risks heatwaves, 昀氀oodings, and wild昀椀res) were individually evaluated across our global facility locations risks and opportunities and opportunities in and fed into Thomson Reuters real-estate planning. These results are used to further re昀椀ne site- on the organization’s line with its strategy level tracking on risk indicators and adaptation measures (e.g., tracking water recycling and low 昀氀ow businesses, strategy, and risk management systems to mitigate against drought; and measuring HVAC system ef昀椀ciency to ensure employee process. comfort during heatwaves). The exposure results of each climate-related hazard represent a key and 昀椀nancial planning. input into our business impact models used to determine the overall potential business impact of each climate-related risk. 1 As discussed with Thomson Reuters, the corresponding recommendations will not be published, but we have provided here to facilitate review. 36