Sustainability Report

TCFD Risk Management

Defensive Layers in Management

TCFD risk management covers the methods and processes used to identify, analyse, and address risks, while also capturing opportunities within both internal and external environments. Rather than focusing on climate related risks and uncertainties, we have included all principal risks and uncertainties faced by the company.

The Enterprise Risk Management (ERM) system is supported by three key defensive layers, each with defined roles and responsibilities, as outlined in the table below.

Line of defence in ERM roles and responsibilities

Risk Governance

Enterprise Risks Management (ERM) roles and responsibilities

The Enterprise Risk Management (ERM) system is used to assess our overall risk profile and guide management activities. It is a continuous process for identifying, assessing, responding to, and reporting on both opportunities and threats. There are seven key steps:

Line of defence

Line of defence

Responsibilities

3rd line of defence

Board

Approve strategy & set the culture

Reviews & assesses the effectiveness of risk management & internal control systems.

Internal Audit

Monitors good governance.

CONTEXT Company objectives and its risks or opportunities that align with our strategy.

1

2nd line of defence

Operational Risk Committee

Design & establish risk management & internal control systems. Monitor risk & controls.

IDENTIFY The principal risks and opportunities that could alter company objectivest.

2

Develop & manage ERM process.

Ensure financial, legal & ethical compliance

ESG committee

Ensure risks are well managed.

3

ANALYSE The significance of each risk or opportunity.

1st line of defence

HODs

Establish & apply internal control systems

Escalate issues to operational risk committee

4

EVALUATE Prioritize the risks by their impact and likelihood.

Supervisors

Understand roles & responsibilities

RESPOND STRATEGY • Avoid the risk by discontinuing the activity or minimise its likelihood. • Share the risk by distributing it and accept the risk when appropriate.

5

MONITOR Update the status of risks, overseen by the Operational Risk Committee.

6

REPORT To stakeholders, the HODs, the ESG Committee and the Board of Directors.

7

44

45