The corporate risk management system is a key component of corporate governance, aimed at timely identification,
assessment, and control of risks that may adversely affect the achievement of KEGOC JSC’s strategic and
operational goals.
The primary objective of the existing Corporate Risk Management System (CRMS) is to ensure continuity and
stability of operations by limiting the impact of internal and external negative factors on KEGOC JSC’s
activities.
The core principles of the risk management system include:
-
engagement of the Company’s management in the risk management process;
-
continuous improvement of the risk management system;
-
ongoing training and knowledge-sharing in risk management among employees;
-
transparency and honesty in risk reporting and escalation.
The tasks of the risk management system are:
-
development and application of uniform and consistent approaches to identifying, assessing, and managing
KEGOC JSC’s risks, simplifying vertical (management) and horizontal (experience sharing) risk communication
processes;
-
prompt response to emerging risk events, tracking changes in external and internal environments;
-
targeted risk management activities to reduce risks to an acceptable level or to transfer them to third
parties (outsourcing, insurance, hedging) or avoid them altogether;
-
systematization and accumulation of risk data at KEGOC JSC to enhance the Company’s manageability;
-
improving KEGOC JSC’s competitiveness and achieving its strategic goals by enhancing the efficiency of the
CRMS.
The CRMS serves as a tool to support managerial decision-making and day-to-day operational activities at
KEGOC JSC.
The risk management process at KEGOC JSC is continuous, cyclical, and multidirectional, and includes the
following components:
-
internal environment;
-
objective setting;
-
risk identification;
-
risk assessment;
-
risk response;
-
control activities;
-
information and communication;
-
monitoring.
KEGOC JSC Risk Management Process
Implementation of the above components of the risk management process contributes to the development of risk
management culture (risk culture), which is the basis of risk management. It comprises beliefs, understanding
and knowledge in the field of risk management, shared and applied by all officers and employees in the
performance of their duties.
Risk culture is part of the corporate culture. The level of risk culture determines how risks are identified,
assessed and managed from the development of the Development Plan through to its implementation and performance
monitoring.
The risk culture is based on the following principles:
-
Tone at the top: Decision-making is based on an optimal balance between long-term
value, profitability and the risks associated with both making and not making decisions, and management
encourages risk-oriented behavior in subordinates.
-
Corporate Governance: KEGOC JSC activities are aimed at creating a control
environment that ensures that employees understand that the Policy and all IRDs are binding. All officers and
employees of KEGOC JSC clearly recognize their area of responsibility and authority for risk management and
internal control. Risk Owners, within the scope of their competence, understand and manage risks and properly
communicate risks in accordance with KEGOC JSC INEDs.
-
Decision-making: The internal environment is characterized by open communication and
transparency of risk information, which facilitates open and constructive discussion of associated risks and
potential opportunities between employees and management, allowing for joint effective decision-making
in response to external challenges.
-
The remuneration system at all levels uses financial and non-financial incentives
for management and employees to form the right attitude to risk in the process of making managerial decisions.
With a well-developed risk culture, decisions are clearly defined by the Risk Appetite.
-
Competence: KEGOC JSC organizational structure is based on the ‘three lines
of defense’ model. The Risk Unit effectively fulfils the role of the second line of defense, thereby
increasing Management’s confidence in achieving KEGOC JSC objectives.
One of the sources of information on the level of risk culture for the Management Board and the Board
of Directors are documents on assessment of CRMS efficiency, reports on diagnostics of corporate governance
in the Company.
In order to improve risk culture, the Company provides briefing/seminars for newly hired employees in the area
of the Company’s CRMS, and the Company’s senior management takes part in specialised risk management seminars
and trainings aimed at senior executives.
To control the level of risk culture development in the Company, in 2023, a questionnaire (survey)
of employees/testing of knowledge in the field of CRMS was conducted to assess the effectiveness of risk
management at the workplace. Based on the results of the survey, seminars for employees of structural divisions
are planned for 2024. In addition, KEGOC JSC employees were tested on their knowledge of risk management and
internal control systems, which was successfully passed by all tested employees.
Organizational structure of the CRMS
Functions and responsibilities of CRMS participants:
-
The Board of Directors is responsible for the effective operation and development of the CRMS as a whole,
setting the tone for risk management, and is responsible for implementing mechanisms to ensure that this tone
is reflected throughout the Company and the subsidiary organizations and approves key CRMS documents;
-
The Audit Committee acts in the interests of the shareholder(s) and its work is designed to assist the Board
by making recommendations to monitor the robustness and effectiveness of the CRMS. Documents submitted for
approval by the Board of Directors are preliminarily reviewed by the Audit Committee of the Board
of Directors.
The IAS is responsible for regularly auditing the CRMS and providing an independent opinion to the Board
of Directors/Audit Committee:
-
audits and analyses the effectiveness of risk management procedures and methodology in the area of CRMS, and
prepares proposals to improve the effectiveness of risk management procedures;
-
submits the Report on CRMS efficiency to the Board of Directors;
-
provides information to the structural unit responsible for risk management on realized risks identified
during audits;
-
fulfils other functions in accordance with the approved regulatory documents of KEGOC.
The Management Board is responsible for establishing, maintaining, and applying risk identification, assessment
and management procedures, organizing the effective functioning of the CRMS, supporting structural units
in implementing/improving risk management processes in their activities, and ensuring that employees of the
structural unit responsible for risk management have professional qualifications.
KEGOC JSC structural subdivisions, branches and subsidiaries are risk owners and are responsible for risk identification, analysis, risk assessment, risk management, preparation of proposals for mitigation of key risks, reporting on KEGOC JSC key risks and timely informing about the realized risks.
The Compliance Service is responsible for the development and implementation of a compliance programme aimed at managing the risks of violation of the Code of Conduct, anti-corruption legislation and other regulatory requirements applicable to KEGOC JSC.
The Risk Committee, whose task is to make decisions on KEGOC JSC risk management issues and prepare recommendations to KEGOC JSC Management Board on the Company’s risk management issues. In 2024, the Committee held 8 meetings.
The structural subdivision responsible for risk management, for development of CRMS, clarification of internal and external requirements, provision of consulting assistance, develops IRDs on CRMS, monitoring of implementation of risk management measures and preparation of quarterly reporting on risks for the Risk Committee, Management Board and Board of Directors.
In performing their functions, the Board of Directors and the Management Board rely on the ‘Three Lines of Defence’ model, which interacts within the framework of the CRMS.
The first line of defence is represented by structural subdivisions represented by each employee within their competence.
The second line of defence is represented by structural subdivisions performing monitoring functions.
The third line of defence is represented by the Internal Audit Service, which independently assesses the effectiveness of and contributes to the improvement of risk management and internal control, supports the Audit Committee and the Board of Directors by providing them with an independent assessment of the effectiveness of CRMS and internal control.
On a regular basis, KEGOC JSC analyses existing risks and identifies new risks that may adversely affect the achievement of goals, objectives, indicators, and fulfilment of the KEGOC JSC Development Plan (Strategy), Action Plan (Business Plan) of KEGOC JSC.
The following methods are used for risk identification:
-
analysing business processes;
-
collection and analysis of statistical data;
-
individual expert methods (questionnaires, interviews);
-
group methods (brainstorming, business game);
-
monitoring of publications and speeches.
Risks may also be identified when considering issues submitted to the meetings of the Management Board, Board of Directors, changes in the external environment, changes in KEGOC JSC processes, procedures, organisational structure, etc.
Risks are identified on the basis of existing goals (KPIs) of the Management Board members, management employees, heads of structural divisions of the current year, which are formed on the basis of strategic goals of KEGOC JSC.
In the process of risk inventory, a risk assessment is carried out in parallel with the determination of approaches to risk management.
Within the framework of risk assessment the following risk parameters are assessed:
-
the impact (size) of the risk;
-
probability of realisation (frequency) of risk;
-
impact time.
When assessing risks, qualitative or quantitative analyses or a combination of both are used.
Assessment of risk realisation probability, impact, impact time is carried out in accordance with the risk assessment criteria established in KEGOC JSC. The results of the risk assessment process are plotted on the Risk Map, which visually reflects the relative importance of each risk. Risks are ranked into low, medium, large and critical risks.
Preventive and reactive measures are developed for all identified risks and approved by the Board of Directors. Key risk management measures are aimed at preventing risks and/or minimising the consequences in the event that risks materialise.
All identified risks with their assessment and measures are approved by the Board of Directors.
