Risk Governance

Board of Directors

1. Board has an overall responsibility, exercising oversight for enterprise risk management
2. Establishes and defines the risk appetite
3. Monitors key risks, considers risks that affect strategy and leverages risk information into decision-making
4. Approves the Enterprise Risk Management Policy

Audit Committee

1. Supports Board in monitoring the effectiveness of enterprise risk management and internal control system
2. Reports on key risks and the progress of mitigation plans on periodic basis

Cabinet of the CEO and Executive Management

1. Participate in the formulation of the risk appetite framework
2. Accountable of the proper identification, assessment and treatment of enterprise risks, based on the ERM framework
3. Promote an ethical and risk-oriented culture across business sectors
4. Analyze the effect of principal risks and discuss upcoming emerging risks

Third Line

1. Internal Audit provides independent and objective assurance on the adequacy and effectiveness of governance, risk management, and control processes

Second Line

1. Enterprise Risk Management Division, Compliance Division and Information Security Officer are responsible for providing risk assurance services in their respective area

First Line

1. All business units and their respective process, risk and control owners that are responsible to manage risks on daily operations and escalate concerns/ issues that may alert the severity of risks