3.4 Risk Saliency Matrix • NOTE: This matrix reflects the raw risk ratings pre-mitigation. Major Severe or irrevocable violation/s of human rights (such as harm causing serious injury or death, extreme forms of labour exploitation) Human rights risks were identified by desktop research and stakeholder consultations and were then plotted on a matrix against the following criteria and ratings: • Moderate Substantial harm is caused Likelihood [Column A] (how likely is the risk to occur within the next 3 years?): Minor Some harm is caused • Highly likely (rights holders are currently at risk or highly likely they will be) Possible (rights holders may not currently be at risk but it is likely it will occur) Remediability [Column D] (will a remedy restore the victim to the same or equivalent position before harm): Not remediable (most serious, harm is not remediable) Unlikely (although there is a risk, it is unlikely to impact rights holders over next 3 years) Possibly remediable (remedy may only partially return victim to same or equivalent position) The determination of the likelihood of a particular risk resulting involved a consideration of a number of different factors such as FIFA and the local entities’ operating contexts in and around the tournament and the ability of the related business relationships (such as suppliers, sponsors, broadcasters and government entities) to effectively manage human rights risks. Some examples of factors that can increase the likelihood of risks resulting include the existence and enforcement or otherwise of national laws and regulations; conflicts between national laws and international human rights; social customs and practice, the presence of corruption and the presence of conflict.85 • Scale [Column C] (what is the gravity of the impact on the human right(s)? of affected people): Fully remediable (remedy will restore victim) Risks are then ranked Tier 1, 2 or 3. • Tier 1 risks must urgently be addressed as most salient. • Tier 2 risks must be addressed as next most salient. • Tier 3 risks should be addressed to prevent harm occurring. Tier 1 risks require: likelihood is highly likely AND two out of three other assessment criteria are red. Scope [Column B] (how many people are likely to be affected by the harm?): Tier 2 risks require at least two of or the four assessment criteria to be amber or red. Major (entire category of stakeholders e.g. all players or all children) Tier 3 risks are those which do not meet the criteria for Tiers 1 or 2. Moderate (significant proportion of stakeholders or specific stakeholder groups e.g. all hospitality staff) Tier 1 risks are shown in bold font in the table that follows. Minor (a few people or a minor proportion of stakeholders e.g. one or two players) FIFA 2023 Women’s World Cup Human Rights Risk Assessment • 37

Select target paragraph3