Diversified Energy Co PLC

Our ERM program focuses on the importance of

risk awareness and mitigation across the

organization. We proactively identify, assess,

prioritize, monitor and mitigate risks enabling

us to deliver the value-creating strategic

objectives outlined in our business model. The

Board regularly assesses our principal and

emerging risks.

ENTERPRISE RISK MANAGEMENT PROGRAM(Oversight and approval by the Audit & Risk Committee)

ENTERPRISE RISK ASSESSMENT REVIEW(Senior Management Team led with business unit leader support)

ERM Program

Our ERM program is based on risk identification,

assessment, prioritization, monitoring and mitigation

processes, which are continually evaluated and enhanced

with experience and industry best practices.

As part of our ERM activities our Senior Leadership Team,

as directed by the Audit & Risk Committee of the Board,

regularly engages in risk discussions across all areas of our

operations. This healthy dialogue regarding risk creates a

culture that highly regards risk mitigation as a way to

preserve and create value for our stakeholders.

Within the program’s risk identification phase, we capture

potential and emerging risks that could arise as a result of a

change in circumstances or new developments impacting

us. To strengthen our risk identification, we carry out the

following ongoing activities:

—Continuous monitoring of the risk universe for new or

emerging risks;

—Refresh the risk universe at least annually;

—Enhance our risk awareness culture and identify

risk ownership;

—Interview risk owners for current mitigation

activities; and

—Design and implement a risk mitigation

control framework.

2023 and Ongoing

Risk Assessment

As part of our continuous assessment process during 2023,

each business unit head determined the perceived level of

risk for their individual unit’s risk universe. Our Senior

Leadership Team then reviewed and challenged each

perceived risk level, and compared it to our risk universe as

a whole. The results of this exercise were then used to

narrow our risk universe into four principal risk categories

andseven principal risks outlined below, which are closely

monitored by our Senior Leadership Team and the Audit &

Risk Committee.

During 2024, we will be updating our original risk

identification and mitigation assessment by conducting in-

depth interviews and group discussions with business

process owners to determine emerging and escalating risks

within the business and current business and market

environments. Based on the findings of the updated

assessment, we will reassess a new list of principal risks and

the resulting mitigation plans for each risk.

Strategic Risks

Corporate Strategy and Acquisition Risk

Our future growth hinges on the successful completion of

acquisitions aligned with our strategic objectives. The

execution and seamless integration of these acquisitions

could exert substantial pressure on our managerial,

operational, and financial resources. Failure to adequately

assess, execute, and integrate these acquisitions may

adversely impact our business operations, financial

performance, and overall prospects.

The following KPIs are sensitive to the impact of Corporate

Strategy and Acquisition Risk:

—Acquire long-life stable assets

—Disciplined commitment to our core strategy of

acquiring low-cost, long-life, relatively low-decline

producing assets and complementary, synergistic

midstream assets.

—Commercial Development, Land, Reserves, Strategic

Planning and Financial Planning & Analysis teams work

closely to identify and review potential acquisition

opportunities which meet strategic objective criteria.

—Experience and knowledge throughout the organization

in recognizing prospective opportunities.

—Thorough risk assessments and due diligence process on

all potential new acquisitions which includes an analysis

of the target’s emissions profile.

—Feedback and evaluation of external experts in the

diligence process.

—Strong balance sheet with significant liquidity to fund

growth through acquisitions.

Climate Risk

Climate-related matters remain central to numerous global

corporate discussions and decisions. While opportunities

related to climate continue to arise in this swiftly changing

landscape, we acknowledge that these issues also pose risks

for DEC. Environmental regulations, climate change concerns,

and investor-driven changes may lead to (i) increased

business costs, (ii) challenges in executing our strategy, and

(iii) restricted access to specific markets or investors.

Climate Risk:

—Emissions intensity

—Our Board oversees the development of our climate

change strategy which aims to position us at the heart of

the energy transition based on responsible stewardship

of existing natural gas assets. The Board’s decision-

making is informed by regular climate subject matter

updates from each of our key Board committees.

—Through our annual TCFD reporting process, we identify

and assess climate-related risks for consideration of

appropriate risk mitigation actions.

—Our core business strategy aligns with sustainability

initiatives and breeds sustainability. We acquire reliable,

long-life, producing wells that often have not reached

their full potential under their former owners. This

stewardship model allows us to avoid the high cost and

sometimes sizeable environmental impact often

associated with exploration and drilling, which is the

intended target of many sustainability initiatives.

—Alongside our zero-tolerance policy for fugitive

emissions, we invest capital funds towards emission

reduction technologies and projects and regularly deploy

SAM optimization techniques that allow us to eliminate

or reduce our carbon footprint.

—Our core KPI of methane intensity reduction is central to

our corporate goals to reduce both methane and GHG

emissions on our path towards net zero Scope 1 and 2

GHG emissions by 2040.

—We expanded our asset retirement capabilities, managed

through our Next LVL subsidiary, that will permit DEC to

exceed our long-term Appalachian asset retirement

agreements, reflective of our core KPI to Meet or exceed

state asset retirement goals.

Financial Risks

Commodity Price Volatility Risk

Changes in commodity prices may affect the value of our

natural gas and oil reserves, operating cash flows and

adjusted EBITDA, regardless of our operating performance.

Commodity Price Volatility Risk:

—Our Senior Leadership Team monitors commodity

markets on a daily basis and internal models are

routinely updated to evaluate market changes. This

monitoring process includes reviewing realized pricing,

forward pricing curves, and basis differentials. This active

monitoring is critical to risk mitigation and the successful

execution of our hedge strategy.

—Our hedging policy continues to be guided by our goal

to generate reliable free cash flow in any commodity

pricing environment and secure our debt and dividend

payments. Our hedge strategy of proactively layering on

appropriately structured hedge contracts at

advantageous prices and tenors allows us to capitalize

on beneficial price movements in a constantly changing,

forward natural gas price market.

—External specialists are consulted on a regular basis to

assist in the execution of our hedging strategy.

Financial Strength and Flexibility Risk

Liquidity and access to capital risk arises from our inability

to generate cash flows from operations to fund our

business requirements or our inability to access external

sources of funding. This risk can result in difficulty in

meeting our financial obligations as they become due.

The following KPIs are sensitive to the impact of Financial

Strength and Flexibility Risk:

—Acquire long-life stable assets

—Our Senior Leadership Team actively monitors debt

levels and available borrowing capacity on our

Credit Facility.

—Our Senior Leadership Team updates the Board at least

quarterly on our debt and liquidity position.

—Our business model of stable production contributes to

predictable cash flows, which makes it easier to forecast

funding needs.

—Strong access to bank capital as our borrowing base in

the Fall 2023 redetermination was reaffirmed

unanimously by our 14-bank group syndicate.

—Maintain access to multiple avenues of funding beyond

our Credit Facility: equity issuance, asset-backed

securitizations, and bond issuance.

—Proactive hedge program to protect against commodity

price volatility and stabilize operating cash flows.

—Continuous management review of the funding and

financing alternatives available to us to ensure sufficient

access to capital is available to meet our future needs.

Legal, Regulatory and Reputational Risks

Regulatory and Political Risk

Our operations are subject to regulations in all the

jurisdictions in which we operate. We are unable to predict

the effect of additional laws and or regulations which may

be adopted in the future, including whether any such laws

or regulations would adversely affect our operations. We

can provide no assurance that such new legislation, once

implemented, will not oblige us to incur significant

expenses, undertake significant investments, or

reduce production.

The following KPIs are sensitive to the impact of Regulatory

and Political Risk:

—Emissions intensity

—Safety Performance

—Operate to the highest industry standards with

regulators and monitor compliance with our contracts,

asset retirement program and taxation requirements.

—External specialists utilized on legal, regulatory, and tax

issues as required.

—Maintain positive relationships with governments and

key stakeholders.

—Continuous monitoring of the political and regulatory

environments in which we operate.

—Working responsibly and community/stakeholder

engagement and outreach is an important factor in

maintaining positive relationships in the communities in

which we operate.

—We encourage our employees to become actively

involved in their communities through industry

associations in their respective operating areas. By

leading, participating in and championing a variety of

these organizations, we believe that our support of the

energy industry’s associations adds value to our business

through the sharing of operating best practices,

technical knowledge and legislation updates, ultimately

to the benefit of all of our stakeholders.

Health and Safety Risk

Potential impacts from a lack of adherence to health and

safety policies may result in fines and penalties, serious

injury or death, environmental impacts, statutory liability for

environmental redemption and other financial and

reputational consequences that could be significant.

The following KPIs are sensitive to the impact of Health and

Safety Risk:

—Safety Performance

—Effectively managing Health and Safety Risk exposure is

the first priority for the Board and Senior Leadership

Team. The Safety & Sustainability Committee of the

Board regularly reviews health and safety programs

and mitigations.

—Health and safety training is included as part of all staff

and contractor inductions.

—Detailed training on our field manual procedures has

been provided to key stakeholders to ensure processes

and procedures are embedded throughout the

organization and all operations.

—Establishing processes for continually assessing our

overall operating and EHS capabilities, including

evaluations to determine the level of oversight required.

—Effective execution of the field operating manual

in operations.

—Crisis and emergency response procedures and

equipment are maintained and regularly tested to ensure

we are able to respond to an emergency quickly, safely

and effectively.

—Leading and lagging indicators and targets developed in

line with industry guidelines and benchmarks.

—Findings from ‘lessons learned’ reviews are implemented

on future operations.

—All employees maintain work stoppage ability.

Operational Risk

Cybersecurity Risk

Cybersecurity risks for companies have increased

significantly in recent years due to the mounting threat and

increased sophistication of cybercrime. A cybersecurity

breach, incident or failure of our IT systems could disrupt

our businesses, put employees at risk, result in the

disclosure of confidential information, damage our

reputation and create significant financial and legal

exposure for DEC.

Our network is designed using a Zero Trust Approach

(“ZTA”) and is segmented. We’ve established several layers

of security, including least privilege access, conditional

access policies, and multi-factor authentication (“MFA”).

Our ZTA extends beyond our network to encompass

identity, endpoints, infrastructure, data, and applications.

This integrated ecosystem enables enhanced visibility,

intelligence, and automation for our security team. Due to

our 100% cloud environment, we now focus on continuous

testing of our security posture from both trusted and

untrusted sources—both external and internal to our

networks—rather than relying on a one-time penetration

testing approach. Additionally, we collaborate with a third-

party managed security service provider and utilize internal

resources for round-the-clock incident monitoring.

Cybersecurity Risk:

—Employees are our first line of defense against these

attacks and we promote secure behaviors to help

mitigate this growing risk. We focus on practical rules

that we promote through robust mandatory annual

training and e-learning sessions delivered by our digital

security team. One of these rules addresses phishing and

reminds staff to ‘think before they click’.

—We engage with key technology partners and suppliers

to ensure potentially vulnerable systems are identified

and secured.

—We test our cybersecurity crisis management and

business continuity plans, recognizing the evolving

nature and pace of the threat landscape.

—Continuous implementation and monitoring of our IT

Security Policy, which includes measures to protect

against cyberattacks.

—Advanced network security detection which includes

regular threat testing.

—Control and protection of confidential information.

—Our Cybersecurity Council, which includes certain

members of the Senior Leadership Team including the

Chief Financial Officer, Chief Information Officer, Chief

Information Security Officer and General Counsel, meets

at least once a quarter to discuss cybersecurity issues,

risks and strategies. The Cybersecurity Council regularly

briefs (at least on a quarterly basis) the Board of

Directors on information security matters, including

assessing risks, efforts to improve our network security

systems and enhanced employee trainings. The

membership of this committee is adequately trained and

educated to provide proper governance, risk

management and control of the cyber security program

utilizing the National Institute of Standards and

Technology framework.

There were no cybersecurity incidents during the year

ended December 31, 2023, that resulted in an interruption

to our operations, known losses of any critical data or

otherwise had a material impact on the Group’s strategy,

financial condition or results of operations. However, the

scope and impact of any future incident cannot be

predicted. Refer to Risk Factors for more information

on how material cybersecurity attacks may impact

our business.

Our ERM program is based on risk identification, assessment, prioritization, monitoring and mitigation processes, which are continually evaluated and enhanced with experience and industry best practices.