Novo Nordisk Annual Report 2021

Contents Introducing Novo Nordisk Strategic Aspirations Key risks Management Consolidated statements Additional information Novo Nordisk Annual Report 2021 41 Risk management To be a sustainable business, we must anticipate and adapt to our environment to create new strategic opportunities. Managing risks rigorously and systematically is key in order for us to create and protect value. We apply a dual lensed approach to risk management. This means we identify and mitigate both operational risks that pose a threat to our short to medium-term plans, as well as strategic risks that could reduce our ability to achieve our corporate strategy over the long-term. Addressing risks in our strategic planning: Scenario and risk-thinking exercises are part of our strategic planning. They include analyses of market dynamics as well as socioeconomic and political developments that present risks or opportunities for our business. Annually, Executive Management and the Board of Directors review a strategic risk profile. Access and affordability Access to affordable care is a global issue as healthcare systems struggle to provide quality care at a sustainable cost, while the burden of chronic diseases keeps rising. Ensuring access and affordability is a risk and responsibility Novo Nordisk shares with all involved in healthcare. We recognize that we cannot defeat chronic diseases alone, but to mitigate the risk we can accelerate our actions to find solutions in collaboration with relevant stakeholders. Innovation and competition We are a scientific based company whose future is based on raising the innovation bar. To remain competitive in the future and thereby mitigate the innovation risk, we invest significantly in internal and external pipeline opportunities to ensure patients receive improved treatments. Digital disruption New digital technologies could bring new competitors into the pharmaceutical industry. It also provides an opportunity for us to deliver more value to our stakeholders and help patients live a life free from the limitations of their disease. Digital health solutions bring new risks particularly around data regulation and privacy, as well as potential quality risks. We strive to monitor and mitigate these risks in close collaboration with relevant partners. Production capacity and supply chain risks Demand fluctuations, resource shortages, trade disputes, quality assurance and local manufacturing requirements are all factors that can pressure global supply chains. Furthermore, expanding production capacity is complex and associated with a long lead time. Therefore, planning and management of our supply chain and production is key to mitigate this risk. Operational risk management process: In the short to medium-term we are also exposed to risks throughout our value chain. Some risks are inherent in the pharmaceutical industry, such as delays or failures of potential late-stage medicines in the R&D pipeline. Other risks, such as supply disruptions and competitive threats, are well-known to any manufacturing company with global production. We will never compromise on product quality, patient safety and business ethics: these are front and centre of our enterprise- wide risk management set-up. We assess risks to potential financial loss and reputational damage. Executive Management, the Board of Directors and Audit Committee review a 'heat map' of our biggest operational risks every six months. This map is based on insights from management teams across the organisation and includes risks that could cause significant disruptions to the business over a three-year horizon. The following overview provides more details of our key risks. For more information, see our Corporate Governance report available at www.novonordisk.com/about/corporate- governance.html Key operational risks An aggregated illustration of our key operational risks is outlined below with associated descriptions on the next page. Clinical Pipeline Risks Product Supply, Quality and Safety Risk 3 Commercialisation Risks High IT Security Risks Financial Risks 6 Legal, Patents and Compliance Risks 3 2 1 Impact 4 5 Low Likelihood ILLUSTRATIVE High

View entire presentation