Risk Management

Risk Management Structure

The company recognizes the importance of enterprise risk management, which plays a key role in helping the company achieve its strategic goals, objectives, or targets, as well as supporting good corporate governance and stable, sustainable growth. Therefore, the company has established a risk management policy to serve as a guideline and framework for all departments within the company and its subsidiaries.

• The Board of Directors is responsible for supporting, promoting, and overseeing the management of risks that may have a significant impact on the company.
• The Audit Committee is responsible for overseeing and independently monitoring risk management, reviewing the internal control system, communicating with the Executive Committee, and reporting to the Board of Directors regarding risks.
• The Executive Committee is responsible for approving risk management policies, monitoring the development of processes, and evaluating risks. Additionally, they communicate and coordinate with the Audit Committee regarding significant risks.
• The Chief Executive Officer is responsible for creating and reviewing risk management policies to align with changing circumstances, ensuring that the company has adequate and appropriate risk management plans in place.
• The Legal Officer / Regulatory Authority is responsible for establishing frameworks, plans, and processes for risk management within the department, presenting them to the Executive Committee for approval, and supporting and monitoring the department's risk management within their area of responsibility.
• The Internal Auditor is responsible for reviewing the internal control systems and the risk management operations.
• Supervisors and employees are responsible for identifying, measuring, controlling, monitoring, and reporting risks, as well as collaborating in the development and implementation of risk management plans.

Risk Management Structure and Responsibility

Management and all employees of the group companies are the owners of risks, with shared responsibility for identifying and assessing risks within their respective departments. This includes determining appropriate measures to manage the risks. The company will manage risks to an acceptable level (Risk Appetite) or will deviate no more than the level the company deems acceptable (Risk Tolerances). To foster this mindset, the company must promote a Risk Management Culture to create an understanding of awareness and shared responsibility regarding risks among both management and employees.

Risk Management Process

The company continuously evaluates and monitors risk issues, considering both internal and external factors that may impact the company's operations in all aspects. The company's risk management process is designed to be systematic and comprehensive to effectively identify, analyze, and manage risks, aiming to keep risks at an acceptable level.

The company recognizes the importance of appropriate risk management to support business operations in alignment with the company's strategy, objectives, and goals, while also promoting long-term stability and sustainability. This process consists of 8 steps, as follows:

• Strategy and Objective Setting

  Define strategies and objectives for the operations of all departments, and ensure that employees set clear business strategies, objectives, or work goals that align with policies, targets, strategies, and acceptable risks.

• Identifies Risks

  Responsible department heads and employees should understand the risks, identify potential risks arising from both internal and external factors, which could be events that have either positive or negative impacts on achieving objectives.

• Assesses Severity of Risk

  Department heads and employees should assess the risks based on the likelihood of an event occurring and the severity of the impact that the event may have.

• Prioritizes Risks

  Department heads and employees should prioritize and manage risks based on urgency. High-risk activities critical to achieving strategies and objectives should be addressed first, followed by high-risk activities of secondary importance.

• Implements Risk Responses

  Department heads and employees should consider effective and efficient risk management methods, taking into account acceptable risk levels, costs, and benefits. Risk responses may involve using one or more strategies to reduce the likelihood or severity of potential events.

• Develops Portfolio View

  Department heads and employees should develop risk management by integrating risk factors and relationships across departments, creating a shared risk management database.

• Review and Revision

  Department heads and employees should ensure ongoing risk monitoring and review of risk management performance. Any necessary adjustments should be made to ensure effective risk management across all levels of the company. Risks that significantly impact the achievement of company objectives should be reported to responsible parties.

• Monitoring and Evaluation

  Department heads and employees should establish regular monitoring and review of risk management, communicate risk information collaboratively, and report on risk management to the executive committee.

This is to ensure that the corporate governance system aligns with best practices, regulations, and oversight requirements. To keep the risk management policy up-to-date and suitable for current situations, the policy should be reviewed at least annually.

Business Continuity Plan (BCP)

The Business Continuity Plan (BCP) is designed to enable various departments in the company to respond and operate effectively during crises or emergencies, whether caused by natural disasters, accidents, or malicious activities targeting the organization. The goal is to ensure that these crises do not disrupt business operations or prevent the company from continuing its activities. If the organization lacks a response process during a crisis or emergency, it could negatively impact departments and stakeholders in various aspects such as economics, service delivery, society, community, environment, as well as public safety and property.

Therefore, developing a Business Continuity Plan is essential for helping the organization cope with unexpected emergencies and ensuring that critical business processes can resume to normal or predetermined service levels. This will help minimize the severity of the impact on the organization.

To address the uncertainty of such situations and maintain business continuity, the company conducts risk analysis, prioritizes risk issues, and systematically plans for risk management. Additionally, the BCP is tested through simulation events to gather results for plan improvement, review personnel capabilities, and assess the plan's effectiveness in responding to crises.

• 1
  Assessing the impact of a crisis: Preparing for and being ready to respond to any potential situation, ensuring that business operations can continue uninterrupted.
• 2
  Establishing a Business Continuity Management Team: To ensure the BCP is executed effectively with clear responsibilities, minimizing duplication in addressing crises.
• 3
  Analyzing business impacts: Prioritizing the impacts and identifying critical processes that need immediate attention to restore normal operations as quickly as possible.
• 4
  Emergency notification process (Call Tree): Notifying the BCP team members to ensure accurate and consistent information, allowing each member to prepare and respond to crises systematically with clear responsibilities.
• 5
  Business continuity and recovery plan: Restoring the situation to normal or pre-crisis conditions as quickly as possible.
• 6
  Review and improvement of the BCP: Management is responsible for updating the Business Continuity Plan annually to improve its effectiveness and ensure it stays relevant to current circumstances.