Risk Management Policy
1. Purpose
The purpose of this Risk Management Policy is to establish a structured approach for
identifying, assessing, mitigating, and monitoring risks that could impact the Company’s
operations, assets, and compliance obligations. This policy ensures that risk management is
embedded into business processes and decision-making.
2. Scope
This policy applies to all business units, employees, contractors, and other stakeholders
involved in the management or use of the Company’s assets, systems, and processes.
3. Risk Management Principles
The Company follows these guiding principles for risk management:
● Proactive Identification: Risks must be identified before they materialize to minimize
potential impact.
● Business Alignment: Risk management activities must align with the Company’s
strategic objectives.
● Continuous Monitoring: Risks must be continuously assessed to ensure effective
mitigation.
● Regulatory Compliance: Risk management practices must comply with applicable
laws, regulations, and industry standards.
4. Risk Identification and Assessment
● Risk assessments must be conducted periodically to evaluate potential threats to the
Company’s operations, data, and assets.
● Risks must be scored based on their impact and likelihood using a 10x10 risk matrix.
Impact and likelihood are each rated on a scale from 1 (Low) to 10 (High), with the
overall risk score determined by multiplying the impact and likelihood ratings. This
scoring methodology helps prioritize risk treatment and ensures appropriate mitigation
measures are implemented. The risk ratings are:
○ 1-25 (Low Risk): Minimal impact, unlikely to occur; managed with standard
controls and does not require .
○ 26-50 (Moderate Risk): Noticeable impact, possible occurrence; requires
additional mitigation or regular reviews.
○ 51-75 (High Risk): Significant impact, likely occurrence; must be actively
managed and monitored and regularly reviewed.
○ 76-100 (Critical Risk): Severe impact, highly likely occurrence; requires
immediate action and executive oversight.
● A centralized risk register must be maintained to document identified risks and mitigation
measures.
5. Risk Mitigation and Treatment
● Risk responses must be determined based on the risk severity and business impact.
● Mitigation strategies include risk avoidance, reduction or transfer.
● Controls and security measures must be implemented to minimize identified risks.
● All risks other than those rated Low must be reviewed annually and accepted,
considering documented mitigation measures, by the risk owners.
6. Risk Monitoring and Reporting
● Risk owners must continuously monitor assigned risks and report any significant
changes.
● Risk reports must be generated and reviewed by senior management on a periodic
basis.
7. Roles and Responsibilities
● Senior Management: Oversees the risk management framework and provides strategic
direction.
● Risk Owners: Responsible for identifying and managing risks within their respective
areas.
● Employees: Must adhere to risk management practices and report potential risks.
● Compliance and Security Teams: Ensure regulatory compliance and implementation
of security controls.
8. Policy Review and Updates
This policy must be reviewed annually or as necessary to adapt to emerging risks and
regulatory changes. Updates must be communicated to all relevant stakeholders to ensure
compliance and awareness.
