Webjet : Risk Committee Charter

Risk Committee Charter

1. Introduction

1.1 The Risk Committee (Committee) is a committee of the Board of Webjet Limited (Company). This charter sets out the authority delegated by the Board to the Committee and the Committee's role, responsibilities, structure and operations.

2. Role

1. The Committee's role is to:
2. • assist the Board to understand and manage the risks faced by the Company and its controlled subsidiaries (Group);
   • oversee all categories of risk across the Group (noting that the monitoring of financial risks is primarily the focus of the Audit Committee), including the processes used to identify, evaluate and manage risk; and
   • oversee the Group's adherence to internal risk management policies and procedures.
3. The Committee is authorised to perform the functions outlined in this charter and to make appropriate recommendations to the Board.

3. Dutiesandresponsibilities

3.1 The Committee has the following duties and responsibilities:

Risk identification, assessment and management

• Review and recommend for approval by the Board the risk management framework, profile and risk appetite across the Group.
• Receive reports from management concerning the Group's risk management strategies, to consider, approve or vary them.
• Approve and oversee the process developed by management to identify principal risks, evaluate their potential impact, and implement appropriate systems to manage such risks.
• Monitor the effectiveness of the risk management framework against the agreed risk appetite across the Group.
• Assess the Group's risk culture and report any material issues or concerns to the Board.
• Approve principles, policies, strategies and processes for the management of risk, which may include the establishment of other committees from time to time to manage specific risks and the delegation of matters to those committees.
• Approve and, where appropriate, make recommendations to the Board as to the exposure limits and risk- taking authority to be delegated by the Board to the Managing Director and other members of the executive management team.
• Receive reports from management concerning the Group's delegation frameworks, to consider, approve or vary them.
• Monitor and receive reports from management concerning the risk implications of new and emerging risks, organisational change, information technology programs and projects, material acquisitions, divestments and other major initiatives.
• Receive reports from management concerning resolution of significant risk exposures and risk events, to monitor and approve them where appropriate.
• Review from time to time the base principles, policies, limits, standards, guidelines, management committee mandates and other significant procedures established by management with respect to specific categories of risk.

Adherence to risk management policies and procedures

• Address such risk issues in connection with the Group's strategic and business objectives as considered appropriate by the Committee.
• Consider risk aspects of strategies or exposures to industry segments to ensure they are in keeping with overall Group risk tolerances.
• Approve, ratify or review (as the Committee considers appropriate) any transaction or other proposal that involves management exceeding delegation limits set out in Group policies.

Risk Committee Charter. Effective: May 2022

Page 2 of 5

• Ensure the risk management systems take into account all material risks, including risks arising from:
• • implementing strategies (strategic risk);
  • ineffective enterprise risk management framework, which includes risk appetite, risk strategies, risk policies and authority levels (enterprise risk);
  • inadequate or failed internal processes, people and systems or from external events that impact adversely on operational matters (operational risk);
  • legal and regulatory compliance (legal risk);
  • inappropriate business conduct and ethics (corporate responsibility risk);
  • changes in community expectations of corporate behaviour (reputation risk);
  • legal or regulatory sanctions, financial loss, or loss of reputation that the Group may suffer as a result of a failure to comply with applicable regulations, codes of conduct and good practice standards (compliance risk);
  • a counterparty not meeting its obligations (financial or otherwise) in accordance with the agreed terms (credit / counterparty risk);
  • unfavourable changes in consumer confidence, competition, consumer prices, foreign exchange rates, interest rates, equity prices, market volatilities and liquidity (market risk); and
  • inability to service existing or future cash flow obligations or convert assets into cash (liquidity risk).
• Assess the adequacy of internal controls in place to identify unusual transactions and any potential transactions that may carry more than an acceptable degree of risk.
• Assess and prioritise the areas of greatest legal and regulatory risk, and report and make recommendations to the Board regarding the management of such risks.
• Monitor compliance with legal and regulatory obligations.
• Receive reports from management on any actual or suspected fraud, theft, data breach, cyber security breach or other breach of the law.
• Review for completeness and accuracy the reporting of corporate governance practices in accordance with the ASX Listing Rules.
• Review management's recommendations concerning the scope, cover and cost of insurance, including insurances relating to directors' and officers' liability, company reimbursement, business interruption, cyber risk, public liability and any other special risks.

Compliance processes

• Approve and oversee the Group's legal, licensing and regulatory compliance processes developed by management, including compliance by subsidiary companies, and where considered necessary, commission and direct specific actions and assignment of responsibility to ensure compliance practices are adequate.
• Receive reports from management concerning the Group's compliance management processes, to consider, approve or vary them.
• Review management's processes for ensuring and monitoring compliance with laws, regulations and other requirements relating to all public announcements, interim reporting, analyst briefings and other open or one-on-one briefings and continuous disclosure.

Other

• Review issues raised by external and internal audit processes that impact the risk management framework or risk management processes and practices of the Group.
• Review and make recommendations to the Board on draft statutory statements covering governance and risk management issues in accordance with the requirements of the applicable regulators.
• Review and receive reports from management regarding the Group's tax compliance risk management framework and risk appetite.
• Conduct or authorise any reviews, special projects or investigations into any matter within the Committee's charter or as may be requested by the Board from time to time.

4. Structureandoperations

Size and composition

Risk Committee Charter. Effective: May 2022

Page 3 of 5

1. The Committee will comprise a minimum of three directors. No executive directors will be appointed to the Committee, and the majority of Committee members will be independent directors.
2. Committee members should have a sufficient understanding of the industry in which the Group operates and should, between them, have sufficient technical expertise to effectively discharge the Committee's duties and responsibilities.
3. The Board will determine appointments and revocations of appointments to the Committee having regard to the requirements of the ASX Listing Rules and the Corporations Act.

Chair

4.4 The Committee Chair will be an independent director appointed by the Board from the Committee's members and will not be the Chair of the Board.

Company Secretary

4.5 The secretary of the Committee will be the Company Secretary, or such other person as nominated by the Board or the Committee from time to time.

Meetings

1. The Committee will meet as often as it considers necessary. Any member of the Committee may call a meeting of the Committee. A quorum is two Committee members.
2. All non-executive directors who are not members of the Committee will have a standing invitation to attend each Committee meeting where there is no conflict of interest.
3. Any person (including external advisers) that the Committee regards as appropriate may be invited to attend all or part of any Committee meeting. The Committee may ask management to present at Committee meetings on matters relevant to the Committee's duties and responsibilities.
4. Papers, reports and minutes of each Committee meeting will be made available to all directors (subject to conflict of interest exclusions).

Reporting

4.10 The Committee Chair will report to the Board regularly on the activities of the Committee and make appropriate recommendations to the Board for decision.

Access

1. The Committee has access to the Group's senior management (in accordance with communication protocols agreed by the Committee from time to time) and corporate records as required.
2. The Committee collectively, and each Committee member individually, may seek any independent professional advice as considered necessary to fulfil their responsibilities. Individual Committee members who wish to obtain independent professional advice at the Group's expense should seek the prior approval of the Committee Chair
   (including approval of the likely costs of obtaining such advice) and such approval will not be unreasonably withheld or delayed. A copy of any such advice must be made available to all directors where there is no conflict of interest.

5. Evaluationandreview

Committee evaluation

5.1 The Committee is accountable to the Board for its performance. The Committee and the Board will conduct an annual review of the Committee's composition, performance and effectiveness, having regard to the principles and requirements of this charter.

Charter review

5.2 This charter will be reviewed regularly as considered necessary by the Committee or the Board. The Committee will advise the Board on any recommended changes to this charter.

Webjet Limited

May 2022

Risk Committee Charter. Effective: May 2022

Page 4 of 5

Webjet Limited

Level 2, 509 St Kilda Road | Melbourne, Victoria 3004 | Australia

www.webjetlimited.com