FY21 ESG Disclosures July 2022 Unaudited 63 GOV.11 Risk Governance Our Executive Vice President (EVP), ERM is tasked with dedicated risk management responsibility, reporting to our EVP and Chief Legal and Administrative Officer. Our President and COO is tasked with responsibility for monitoring and auditing risk management performance on an operational level, reporting to our Chair of the Board and CEO. The Board oversees the Company’s approach to ERM, which is designed to support the achievement of strategic objectives, improve organizational performance and enhance long-term shareholder value. In conjunction with management, the Board assesses the specific risks faced by the Company and reviews the steps taken by the Company’s leadership to manage those risks. The Board also provides guidance to and oversight of management throughout the year with respect to setting the Company’s corporate strategy, which facilitates these assessments and reviews. The Board also encourages management to promote a corporate culture that integrates risk management into the Company’s corporate strategy and day-to-day business operations in a way that is consistent with the Company’s targeted risk profile. In FY21, the Board formed a new standing committee, the ESG & Risk Committee, to further enhance the structure of the Board’s oversight for ESG and ERM. The ESG & Risk Committee assists the Board in overall oversight of ESG and ERM matters, with certain specified areas being allocated to the Board’s other standing committees. To ensure coordination and collaboration among the Board’s committees, the membership of the ESG & Risk Committee includes members from each of the Board’s committees. Additional discussion of the Board’s role in ERM oversight can be found in the 2022 Proxy Statement , including risk oversight for each committee, on pp. 14–16. A Global Enterprise Risk Steering Committee, chaired by our EVP for ERM, oversees and works with teams working on priority areas (for example, ESG, Cyber and Projects) and defines and updates as necessary, risk appetite and risk policies. Key ESG risk and opportunity areas include, but are not limited to, climate, supply chain, inclusion and diversity, health and safety, and talent attraction, retention and development. Our FY21 Form 10-K contains a discussion of some of the risks and uncertainties that could have a material adverse effect on the Company (pp. 21–46). As detailed further in the Climate Change section of this document ( ENV.15 Climate Change ), our first global climate risk assessment was completed in March 2020. We applied the TCFD framework to identify climate risks that are material to our business, including those arising from both physical and transitional risks. Potential risks include project failure, operational and supply chain disruption, being outpaced by competitors, and business fragmentation. Our opportunity analysis indicates that we are well-placed to take advantage of low and zero carbon transition and help our clients create smart, resilient cities and infrastructure. Our Global Security & Resilience (GS&R) program provides integrated assurance from its subject matter experts to identify, react and adapt to disruption. It sets the standards and framework to ensure designation, responsibility, competence and tools for anticipation, evaluation, preparation, response, and management of emergency incidents and crisis events, based on the Incident Command System, a standard emergency response model used internationally. Our business resilience program safeguards the protection of our people, environment, assets, and reputation, as well as enabling the continuation of business services to endure and succeed. Emerging Risks Two emerging risks that may have long-term impact on the business are summarized in Table 37. Both risks are included in our Enterprise Risk Management (ERM) framework and are the subject of regular review and discussion in Jacobs’ risk governance processes, including Board oversight and engagement.