Columbus A/S

Governance roles

Reference: pages 53, 55.

Columbus' ESG governance has three bodies: the Administrative Body, led by the Head of ESG Compliance with subject-matter experts on environmental, human-rights and business-conduct impact; the Management Body (the Executive Management team); and the Supervisory Body, represented by the Board of Directors through the Audit Committee.

The Supervisory Body "sets the strategic direction, and the Management Body implements these strategic plans through leadership of the Administrative Body." The Audit Committee "represents the Board of Directors in operational activities, including: CSRD-compliant reporting; annual review and approval of double materiality assessment; oversee the result of the limited assurance process."

Board composition (page 55): 0 executive, 5 non-executive, 2 independent members; no employee representation; 20%/80% female/male ratio. Executive Board: 2 executive, 2 independent members; 0%/100% female/male ratio. The sustainability effort is governed through six annual Audit Committee meetings, including two with the External Auditor.

Information provided to and sustainability matters addressed

Reference: page 54.

During 2025 the Audit Committee addressed five topics at its meetings: "Implications of Omnibus"; "Sustainability compliance strategy for 2025 and 2026"; "Double materiality assessment for 2025"; "Sustainability performance reviews (including discussion on corrective actions.)"; and "Sustainability Targets and transition plan for climate change mitigation."

The Board of Directors "approves strategic direction and oversee the results of the initiatives" and "oversee operational ESG activities through the Audit Committee," which in turn reviews and approves the DMA result, defines and communicates sustainability targets and strategic initiatives, prioritises and allocates resources, and oversees the effectiveness of strategic initiatives.

Integration of sustainability-related performance in incentive schemes

Reference: page 54.

Columbus reports a nil position: "In Columbus, we have decided not to set formal sustainability targets at this time, nor have we incorporated climate-related or other sustainability-related performance in our incentive schemes."

The stated reasons are "a range of factors, and elements that are still under consideration, including the ongoing Omnibus package from where we expect significant reduction and simplifications in our reporting scope in the coming years." The company states it prefers "to observe and gather more information before making any commitments" and will "reassess the necessity to formulate and disclose targets for relevant metrics in the future" as the reporting scope matures.

Statement on due diligence

Reference: page 56.

Columbus maps the core elements of due diligence to pages of the statement in a dedicated table (page 56):

The basis for preparation states the statement "does not use incorporation by reference" (page 52).

Risk management and internal controls over sustainability reporting

Reference: page 57.

Columbus has "established a comprehensive risk management and internal control framework to ensure the integrity, completeness, and accuracy of sustainability information," covering "all stages of the sustainability reporting process, from data collection to final disclosure."

Key risks identified: completeness and accuracy of data for GHG emissions, workforce metrics and governance indicators; timeliness of data availability; integrity of estimates where actual data is unavailable.

Mitigation: preventive controls at the source of data collection, automated validation and reconciliation, documentation/audit trails, and expanded training for data owners.

The Audit Committee "receives quarterly verbal reports on the effectiveness of sustainability-related internal controls and risk management activities," with significant findings escalated to the Board.

Strategy, business model and value chain

Reference: pages 58, 59.

"Columbus is a global digital advisor and IT services consultancy company with more than 1,500 employees" serving four focus industries: Manufacturing, Retail & Distribution, Food & Beverage, and Life Science. Services span Cloud Services, Cybersecurity, Data & AI, Digital Commerce, Enterprise Information Management, Finance and Supply Chain, Intelligent Business Process Automation & Apps, Managed Services, Sales/Marketing/Customer & Field Service, and Transformation Strategy.

Value chain (page 59): upstream covers technology partners (Microsoft, Infor), energy providers, suppliers and landlords; own operations are Enabling Functions and Business Lines (Dynamics 365, M3, Digital Commerce, Data & AI, EIM); downstream covers customers across manufacturing, retail, food & beverage, banking, travel and life-science sectors.

The sustainability strategy is built on two streams: external (enabling sustainable impact for customers) and internal (sustainable operations, diverse culture, responsible business conduct), page 58.

Interests and views of stakeholders

Reference: page 60.

Four stakeholder groups are described: Customers & End-users (engaged via the "Voice of the Customer" programme); Partners & Suppliers (Microsoft, Infor, and suppliers for office facilities, travel and IT equipment); Employees & Subcontractors (engaged per page 86, "own workforce"); and Shareholders (Columbus is "listed on Nasdaq Copenhagen stock exchange"; Consolidated Holdings A/S owns 64.14% of shares and 65.56% of voting rights via voting agreements).

"We do not engage directly with the end-users" of solutions built for customers, since Columbus' solutions are used by its customers' own employees or their customers.

Material impacts, risks and opportunities

Reference: pages 62-64.

"Our material IROs are outlined in the DMA process and detailed under each topic in the sustainability statement... Most material IROs are managed continuously within our operations, including business conduct, workforce and climate change."

Environmental IROs "are primarily linked to climate change," arising from business travel, energy and IT infrastructure (page 65 detail). Social IROs "primarily relate to our own workforce and, to a lesser extent, end-users and consumers" - equal treatment, non-discrimination, work-life balance and health and safety (page 80 detail). Governance IROs "relate to business conduct, ethical compliance, and responsible relationships across our value chain," with the most significant being anti-corruption, bribery, whistleblower protection and supplier management (page 97 detail).

Pollution, water/marine resources and waste were evaluated and found not material given Columbus' consultancy business model (page 61-62).

Description of the process to identify and assess material IROs

Reference: pages 60-63.

The DMA runs in four phases. Understanding (page 60-61): mapping the business model and value chain per EFRAG's Value Chain Implementation Guidance; organisational scope is "Columbus A/S and our subsidiaries, including the 25 Columbus offices." Identification (page 61): a long list built from ESRS 1 AR 16 topics, desktop research, SASB's materiality map, stakeholder interviews and employee-survey analysis, using the inherent-risk approach (before mitigation). Assessment (page 61-62): impact materiality scored on severity (scale, scope, irremediability) and likelihood; financial materiality scored against EBITDA/revenue/cash-flow effect ranges; "severity takes precedence over likelihood... particularly for human rights-related impacts." Reporting (page 62-63): the shortlist goes to the Governing Body for approval, then determines the reporting scope - "For the topical sections in scope, all material mandatory disclosure requirements have been included."

Pollution, water/marine resources and waste were explicitly screened and found not material (pages 61-62): "these environmental aspects are not considered material to our value chain or operations" given the consultancy business model.

Disclosure requirements in ESRS covered by the sustainability statement

Reference: pages 51, 66, 81, 93, 98.

Columbus prints a dedicated ESRS content index at the start of General Disclosures (page 51) and again at the start of each topical section it reports on - E1 Climate change (page 66), S1 Own workforce (page 81), S4 End-users and consumers (page 93) and G1 Business conduct (page 98) - each mapping every disclosure requirement to a page number or an explicit "Omitted, immaterial" / "Omitted, not material" / "Omitted, phase-in" / "omitted" marker.

"We report only on ESRS data points that are: Material under our double materiality assessment, and Mandatory under the ESRS" (page 52). The company states it applies "all phase-in provisions set out in Appendix C of ESRS 1." No topical chapters exist for E2, E3, E4, E5, S2 or S3: the Appendix B datapoint table (pages 105-108) marks their constituent datapoints "Immaterial."

Transition plan for climate change mitigation

Reference: page 68.

"Columbus has not adopted science-based targets for GHG emission reductions or a transition plan for climate change mitigation." The stated climate-related ambition is "to maintain our existing level of GHG intensity per unit of revenue." The company is explicit that "this ambition is not derived from a sectoral decarbonisation pathway, nor is it aligned with a 1.5°C global warming scenario... the ambition has not been externally assured."

The stated rationale: "Given our relatively small footprint as a consultancy company and the strategic uncertainties related to the Omnibus package, we have opted for a pragmatic approach focused on maintaining our current emissions intensity while continuing to monitor and manage our environmental impact."

Columbus confirms it is not excluded from EU Paris-aligned Benchmarks (Appendix B datapoint table, page 108).

Identification of climate-related risks and scenario analysis

Back-filled from the E1 material-IRO table and ESRS 2 IRO-1, disclosed in the FY2025 report (pages 61, 67). This disclosure requirement did not exist under the 2023 ESRS the report was prepared against.

Columbus' climate-related IRO assessment identified only actual negative impacts, not risks: four IROs from business travel/commuting (Upstream, short term), company cars (Own operations, short term), purchased goods and services (Upstream, short term) and office energy consumption (Own operations, short term) - all tagged "Actual negative impact" (page 67).

No material climate-related financial risk or opportunity was identified: E1-9 (Anticipated financial effects from physical and transition risks) is marked "Omitted, immaterial" in Columbus' own E1 content index (page 66). With no material climate risk identified, there is nothing to classify as physical or transition, and the report records no scenario analysis for climate. The general DMA methodology (inherent-risk approach, time horizons, value-chain placement) is applied uniformly across IROs (pages 60-62) but no climate-specific exposure/sensitivity methodology beyond this is described.

Policies related to climate change mitigation and adaptation

Reference: page 67.

In addition to an overarching Sustainability Policy, Columbus has adopted: a Travel Policy ("to eliminate all unnecessary business travel... all business travel must be pre-approved and have a valid business purpose, and hotels with a green profile should be prioritised"), approved by the Executive Board; a Code of Conduct for Business Relations, expecting customers, suppliers and partners to conduct due diligence and a DMA aligned to the UNGPs and OECD Guidelines, approved by the Board of Directors; and an Energy Sourcing Business Practice seeking renewable energy in offices "wherever possible."

"Despite our relatively small footprint, we firmly support the global target of sustainable development for the environment." The policies are communicated through the monthly newsletter and onboarding.

Actions and resources in relation to climate change policies

Reference: page 68.

Renewable energy sourcing: Columbus "continued our transition towards renewable energy in our offices," directly selecting renewable providers where possible and exercising leverage with landlords elsewhere. In 2025, renewable energy's office share rose from 73% to 81%, and total office energy consumption fell slightly from 1,336 MWh to 1,330 MWh, partly through introducing renewable energy at the Krakow office.

Monitoring and tracking: "we have refined our data collection process for CO2 emissions and developed management reporting on our emissions in Power BI," to detect and react to negative developments and support the small-footprint ambition. No quantified investment, CapEx/OpEx figure or funding mechanism is attached to these actions.

Targets related to climate change mitigation and adaptation

Reference: page 68.

Columbus has no adopted GHG reduction target. The stated ambition is narrower: "to maintain our existing level of GHG intensity per unit of revenue." This is explicitly not a science-based or 1.5°C-aligned target, and is not externally assured (see E1-1).

GHG intensity is tracked: total GHG emissions per net revenue moved from 4.08 tCO2eq/mDKK (location-based, 2024) to 4.25 (2025), and from 4.07 to 4.20 on a market-based footing, against net revenue of DKK 1,576m in 2025 versus DKK 1,659m in 2024 (page 70) - meaning emissions intensity rose even as absolute emissions and revenue both fell, which the report does not reconcile against the "maintain" ambition.

Energy consumption and mix

Reference: page 69.

Total energy consumption: 1,330 MWh in 2025 (1,336 MWh in 2024). Mix: fossil sources 186 MWh (14%, down from 229 MWh/17%); nuclear sources 67 MWh (5%, down from 128 MWh/10%); renewable sources 1,078 MWh (81% of total, up from 979 MWh/73%).

"All consumption of renewable energy stem from purchased or acquired electricity, heat, steam, and cooling." Accounting principles (page 71): energy data comes from providers per office, split by occupied square footage where facilities are shared; "23% of the reported energy consumption is estimated" based on the prior year's consumption for the same office, because of the fast book-closing timetable; renewable/fossil/nuclear mix uses Renewable Energy Certificates where held, otherwise AIB residual-mix data (Europe), US EPA eGrid (US) or the Climate Transparency 2021 Report (elsewhere).

GHG emissions

Reference: page 70.

Scope 1: 223 tCO2eq (2025) vs 259 tCO2eq (2024); 0% from regulated ETS. Scope 2: location-based 219 tCO2eq (vs 242) and market-based 154 tCO2eq (vs 218). Scope 3 (significant categories only, 3 of 15 GHG Protocol categories): purchased goods and services 3,996 tCO2eq (vs 3,803, restated from 3,803 base), business travel 1,395 tCO2eq (vs 1,542), employee commuting 859 tCO2eq (vs 926); total Scope 3 was 6,251 tCO2eq (2025) against a restated 6,271 tCO2eq 2024 base (originally published as 5,271 tCO2eq - see below). Total GHG emissions: location-based 6,693 tCO2eq (vs 6,772), market-based 6,628 tCO2eq (vs 6,748).

Restatement disclosed (page 52): "Due to a misstatement in 2024, the Total Gross indirect (Scope 3) GHG emissions has been corrected from previously published 5,271 tCO2eq to 6,271 tCO2eq... The misstatement was the result of a typing error."

Accounting principles (pages 71-72): Scope 1 from company cars using estimated driving distance and Defra (2025) conversion factors; Scope 2 market-based uses Renewable Energy Certificates (zero-rated) or residual-mix/grid factors, location-based uses IEA (2024) country factors; Scope 3 purchased goods/services use the spend-based method with Defra (2025) emission factors by cost category; business travel/commuting use ICAO conversion factors.

Policies related to own workforce

Reference: pages 82, 85.

Diversity, Gender Balance & Inclusion Policy (page 82): aligned with section 139c of the Danish Companies Act and the Recommendations on Corporate Governance, approved by the Board of Directors, communicated via a mandatory e-learning course. Objectives: increase diversity, promote equality, encourage inclusion, and "does not tolerate any kind of discrimination, violence, harassment or bullying."

Code of Conduct for employees (page 82): introduced at onboarding, updated annually alongside the DMA, approved by the Board of Directors.

Vacation & Leave policies and Incentive models and target setting policy (page 85): local policies aligned with national legislation across Europe, India, Chile and the USA, entitling employees to vacation, leisure, rest and family-related leave (maternity, paternity, parental, carers'); the global target-setting policy is "approved by the executive leadership team."

Processes for engaging with own workforce

Reference: page 86.

Engagement runs through: half-yearly mandatory performance management conversations; a monthly Employee Net Promoter Score (eNPS) survey (group score improved from 56 to 61 in 2025, despite response rate dropping from 79% to 71%); manager-level one-on-one sessions; and an annual anonymous Employee Survey with an 88% response rate in 2025, covering team efficiency, workplace environment, inclusion, engagement and leadership, analysed by gender, team and country to target improvement actions.

Processes to remediate negative impacts and channels to raise concerns

Reference: page 87.

Three channels: dialogue with a dedicated People Partner at each location; the Tell-Us mechanism, launched 28 February 2025 for stakeholder engagement on sustainability matters (non-anonymous, reviewed by trusted grievance managers); and the whistleblower system for financial fraud, bribery, corruption, competition-law violations and harassment, which is anonymous, does not log IP/machine IDs, and is investigated by the Chairman of the Board (acknowledgement within 7 days, follow-up within 3 months for non-anonymous reports).

Remedy approach: "1) Make the impact stop, 2) implement preventive/mitigating measures to avoid recurrences, and 3) Provide access to remedy for the impacted stakeholders."

Taking action on material impacts on own workforce

Reference: pages 83, 85.

Equal treatment (page 83): a fair recruitment process using competency-based questions and science-based psychometric tests to reduce bias; the Career Pathways competency framework (fully rolled out in 2025) underpinning performance management and promotion; a project begun in 2025 to build role-based salary bands (phase one covers ~80% of the workforce, the consultant job family, in 2025-2026); and regular pay-gap analyses feeding the annual salary-adjustment process.

Working conditions (page 85): a pay-out cap at 100% utilisation to prevent excessive overtime; incentive design that does not penalise vacation or parental leave; a structured onboarding process with Columbus Academy training, mentorship and People Partner follow-up.

Targets related to own workforce

Reference: page 88.

"We have not defined and set any official targets for the Group in relation to any of our material IROs, but continuously monitor relevant trends in our metrics and take action when we see indications of negative developments in relation to both working conditions and equal treatment."

One exception: "Due to local legislation in Denmark, a target for the ratio of women in management levels has been set for Columbus A/S", detailed in the Corporate Governance section (page 36) rather than the sustainability statement itself.

Characteristics of employees

Reference: pages 88, 89.

1,515 employees (average headcount, 2025; 1,613 in 2024), 31%/69% female/male split. By gender: male 1,046 (1,123 in 2024), female 469 (490). By country: Sweden 403, Denmark 337, India 237, UK 214, Norway 164, other 160. By contract: all permanent, 0 temporary; 11 non-guaranteed-hours employees (18 in 2024); full-time 1,398, part-time 117. 311 leavers in 2025 (338 in 2024); employee turnover rate 21% (unchanged from 2024).

Characteristics of non-employee workers

Reference: page 89.

212 non-employees in Columbus' own workforce in 2025 (225 in 2024). Accounting principle (page 91): "Non-employees in own workforce is freelancers and subcontractors that Columbus engage as delivery resources on a Columbus customer engagement. They do not have an employment contract with Columbus."

Diversity metrics

Reference: pages 89, 90.

Top management gender (page 89): 26% female / 74% male (11.4 average headcount total), versus 19%/81% in 2024. Age distribution (page 90): under 30 - 186 (12%); 30-50 - 864 (57%); over 50 - 465 (31%). The company notes "the composition of our workforce reflects historical trends within the IT sector... Currently, women comprise 31% of our workforce and approximately 26% of our top management positions" (page 58).

Social protection

Reference: page 90.

Employees are protected against loss of income from sickness, unemployment, employment injury/acquired disability, and parental leave in all locations (Yes/Yes/Yes/Yes). For retirement, protection is Yes with a footnoted exception: "79 employees in USA and Chile are not protected in the event of retirement."

Training and skills development metrics

Reference: page 89.

Average training hours: males 6.7 hours (up from 3.7 in 2024), females 6.9 hours (up from 4.1); total 6.8 hours (vs 3.8). Performance-review participation: male 70% (71% in 2024), female 71% (70%); average 70%. Delivered via Columbus Academy, the internal e-learning platform covering technical skills, personal development and policy training, with completion tracked and verified (page 85).

Work-life balance metrics

Reference: page 90.

Family-related leave entitlement: 100.0% of both male and female employees entitled (unchanged from 2024). Take-up: 10.0% of entitled male employees took family-related leave (8.9% in 2024); 12.9% of entitled female employees (10.8% in 2024).

Compensation metrics

Reference: page 90.

Gender pay gap - total: 13.1%. By level for Business Consultants: Associate -4.4% (vs 3.7% in 2024), Consultant 8.3% (8.1%), Senior 0.4% (0.2%), Principal -9.7% (-8.4%), Director -7.9% (-14.8%). Total remuneration ratio: 1:10 (1:13 in 2024, i.e. highest-paid individual versus median, excluding the highest-paid employee).

Incidents, complaints and severe human rights impacts

Reference: page 90.

"No incidents or complaints have been reported in the reporting period." Definitions given (page 90): complaints are concerns raised through established channels related to discrimination or harassment, whether or not tied to a confirmed incident; a severe human rights impact is one scored high-severity under the DMA's own severity criteria.

Policies related to consumers and end-users

Reference: pages 94-95.

Data Ethics Policy: commits to responsible and sustainable data usage and compliance with Danish and EU law; key principles include "no data selling or profit from third-party data usage," security measures matched to data sensitivity, and employee training in data protection. Columbus "aligned our practices to the Information Security standard ISO/IEC 27001." The policy is reviewed annually by the Board of Directors.

Delivery methodology "On Target": embeds security throughout project delivery via regular risk assessments, data-protection/access controls, incident response plans and mandatory security training for all team members.

Processes for engaging with consumers and end-users

Reference: page 96.

Columbus engages end-users and consumers of its customers' digital solutions primarily through the ITSM support platform, which logs and routes support requests to service teams, and through the Data Processor Agreements (DPAs) it signs with customers setting the terms on which Columbus processes personal data as a processor under GDPR.

Processes to remediate negative impacts and channels to raise concerns

Reference: page 96.

The ITSM platform is the main channel to report data incidents; in addition, incidents can be reported through the same channels described for own workforce on page 87 (Tell-Us, whistleblower system). The Breach Response and Notification Procedure is activated for personal-data breaches, with notification to affected individuals, authorities and stakeholders scaled to severity; major incidents trigger the Major Incident Management Procedure with a dedicated Major Incident Manager and, where necessary, a Service Continuity Plan.

Taking action on material impacts on consumers and end-users

Reference: pages 95-96.

In 2025 Columbus launched a mandatory Security & Privacy Training module (three self-paced parts: GDPR in Columbus, Information Security Awareness, Employee Compliance Acknowledgement), rolled out Q2-Q4 2025 across all business units and geographies: "All employees in Columbus have completed the training." Annual refreshers are planned.

Data Processor Agreements with customers enforce GDPR-compliant technical and organisational measures. The incident-management procedure sets out identification, categorisation/prioritisation, and dedicated handling for privacy and major incidents.

Targets related to consumers and end-users

Reference: page 96.

"We have not identified any material targets. We have not set specific targets in relation to this topic. Our established processes are anchored within the functions that have day-to-day responsibility for ensuring adherence to our policies."

Business conduct policies and corporate culture

Reference: page 101.

Board-approved policies: Anti-Bribery and Anti-Corruption Policy (zero tolerance for bribery in any form; only modest business gifts/hospitality permitted, cash gifts and quid pro quo forbidden; donations/sponsorships must be objective, transparent and recorded; conflicts of interest must be reported immediately); Tax Policy (timely/accurate tax payments, transparent structure, arm's-length intercompany pricing, no aggressive tax planning); Whistleblower Policy; and Columbus Authorisation and Risk Management Rules (CARMR), which set authorisation levels for contracts, partnerships, subcontracting and purchasing/investment decisions. Executive Management oversees enforcement of the anti-corruption policy.

Management of relationships with suppliers

Reference: page 103.

Payment terms are negotiated individually with each supplier rather than standardised. Columbus recognises "increased vulnerability to late payments" for its many small independent subcontractors and freelancers and has "implemented additional procedures to ensure that all necessary information is obtained for timely processing of payments" for this group. Through its Code of Conduct for Business Relations, Columbus sets UNGP/OECD-aligned expectations for tier-1 suppliers, including a due-diligence management system on human rights, environment and economic impacts, and expects tier-1 suppliers to cascade the same expectations to their own tier-1 relations.

Prevention and detection of corruption and bribery

Reference: page 102.

Six named controls: Manager Approval and Finance Approval of all costs under CARMR; Segregation of Duties so no single individual controls all aspects of a financial transaction; Proactive Cost Controlling; Monthly Business Reviews of costs, spending and performance to flag irregularities promptly; and dedicated Channels for Reporting Suspected Misconduct (whistleblower system, Tell-Us). Material IRO context (page 99): Columbus does "not conduct significant business with public authorities," and large-customer deals typically require board-level sign-off, "reducing the potential for influence through gifts, expensive meals, trips, or extravagant entertainment," though the risk is not ruled out entirely.

Incidents of corruption or bribery

Reference: page 103.

Zero in both years: 0 convictions for violation of anti-corruption/anti-bribery laws (2025 and 2024); DKK 0 in fines; 0 breaches in anti-corruption/anti-bribery procedures and standards; 0 legal proceedings related to late payments.

Payment practices

Reference: page 103.

"We do not have defined standard payment terms for suppliers. Specific payment terms are negotiated with each individual supplier... The most common supplier payment terms are 'net 14 days', 'net 30 days' and 'net 60 days'."

2025: average payment time 11 days (0-15 day terms), 29 days (16-30 day terms), 27 days (more than 30 days), 27 days overall (0-15/16-30/>30 day terms weighted); 79% of payments aligned with standard terms overall (62%/84%/79% by term band).

Restatement: "Due to a misstatement in 2024, the average payment time has been corrected from previously published 52 days to 29 days, and share of payments aligned with standard terms has been corrected from previously published 85% to 69%. The misstatement was the result of a data extraction error." The company also discontinued its voluntary "Number of invoices processed" metric, "deemed immaterial during our DMA process" (page 52).

Targets related to business conduct

MDR-T limb: effectiveness of business-conduct measures is tracked in the absence of a formal target.

Group-wide, Columbus states: "we have decided not to set formal sustainability targets at this time... we are continuing to monitor our sustainability metrics regularly and will act if we notice any concerns" (page 54) - a blanket position that extends to business conduct.

Effectiveness is instead tracked operationally: Monthly Business Reviews analyse costs, spending and performance "to identify and address any irregularities promptly" (page 102), and G1-4's metrics are tracked and reported with a zero result across both years (0 convictions, 0 fines, 0 procedural breaches, 0 late-payment legal proceedings - page 103). Payment-practice metrics (average payment time, share aligned with standard terms) are likewise tracked year over year, including the self-identified and corrected 2024 misstatement (page 103).