Risk Management Policy and Management Structure
The Company is developing a risk management system aligned with international standards, specifically COSO-ERM 2017 (The Committee of Sponsoring Organizations of the Treadway Commission). This initiative is undertaken comprehensively throughout the organization and encompasses all types of risks and all business activities. The objective is to ensure that the Company`s risk management is effective and efficient, capable of managing risks to an acceptable level, and supports sustainable business operations. The implementation involves the following:
-
The Audit and Risk Management Committee has been tasked by the Board of Directors to examine the adequacy, effectiveness, and adherence to policies and risk management strategies, including an acceptable level of risk.
-
The Executive Committee is responsible for overseeing and monitoring the status of key risks, risk management, and promoting a risk management culture.
-
The Risk Management Sub-committee is independently appointed, separate from business units, with the Chief Financial Officer serving as its chairperson. This committee plays a crucial role in driving the Company`s risk management, tasked with examining key risks, monitoring the implementation of risk management measures and Key Risk Indicators, in collaborating with all relevant units as the risk owner. The Risk Management Sub-committee shall hold quarterly meetings.
-
The Risk Management Office is responsible for promoting, disseminating knowledge, and providing guidance to various units regarding risk management, and monitor the progress of management activities.
-
Business unit executives and department heads have direct responsibility for assessing and managing risks within the areas of responsibility and also report the results of risk management to the Risk Management Sub-committee.
-
The Risk Champion serves as the intermediary in coordinating between business units and the Risk Management Office.
-
The employees in the organization are required to collaborate in risk management as an integral part of their job responsibilities, conduct themselves in accordance with the risk management culture and promptly report identified risks through the specified channels.
-
The Internal Audit Office is responsible for reviewing risk management process to ensure compliance with risk management policy, following up on the risk owner’s actions according to the risk mitigation plan, and providing recommendations to enhance the risk management system.
Also, the Company mandates quarterly risk assessments or when there are significant changes in the business environment. The Risk Management Sub-committee will report the assessment results to the Executive Committee, followed by reporting to the Audit and Risk Management Committee. Additionally, there is communication of the assessment outcomes to the Management Committee for awareness and follow-up on specified measures.
Risk Management Process
The Company`s risk management process is consolidated in the "Risk Management Handbook," outlining the operational steps and tools utilized as follows:
- Establish the business context involves analyzing the global, regional, and industry conditions, as well as the specific circumstances of the Company. This is done to gain insights into the current situation, including trends and anticipate potential future trends.
- Identify the risks and opportunities that could affect the Company`s objectives, encompassing both existing risks and emerging risks that may arise in the future. This operation covers internal and external factors, utilizing various tools or techniques such as examining issues that may arise internally, considering reliable external data sources, studying risk assessment surveys from different organizations, and analyzing risks from scenarios. Additionally, we clarify the description of risk to assist management in understanding the scope of risks.
-
Assess, prioritize risks, and establish the key risk management measures and Key Risk Indicators.
-
Define risk appetite in various areas as follows:
- Investment projects shall yield returns higher than the financial costs.
- Conduct business ethically towards all stakeholders, comply with laws, uphold moral and ethical standards, and adhere to the organizational culture. This includes addressing safety issues, considering the environment, and taking responsibility for societal impact.
- Produce quality products that meet the standardized requirements.
- Maintain the organization`s image and reputation.
- Disclose accurate and reliable information.
- Assessing risks involve gathering data through risk surveys and conducting practical workshops, utilizing predefined criteria for assessment in terms of both impact and likelihood of the risk events. Subsequently, the results of the risk assessment are presented on a Risk Heat Map.
- Prioritizing risks involves considering the relationship between the impact and the likelihood of the occurrence of each risk event. Risks exceeding the acceptable level are considered significant, requiring the identification of key causes for these risks.
- Establish additional risk management measures and Key Risk Indicators for significant risks, considering their effectiveness and efficiency before making any decisions on implementation.
The above-mentioned acceptable risk levels are linked with company objectives and strategies, and it also takes into account the amount of risk that stakeholders can accept. This statement is being governed by the Board of Directors when implementing CPF’s strategic objectives, while the Audit & Risk Management Committee helps to review compliance of the risk appetite. In addition, CPF utilized risk appetite as fundamental data in establishing risk assessment criteria.
-
Define risk appetite in various areas as follows:
- Reporting and monitoring the progress of the risk management measures and the status of Key Risk Indicators as scheduled to related committees such as Risk Management Sub-committee, Executive Committee, Audit and Risk Management Committee.
Risk Management Culture
The Company communicates roles and responsibilities, aiming to instill awareness among board members, executives and employees to act responsibly in considering potential risks and opportunities, through the following actions:
- Risk management environment: Communicating risk management policy, integrating principles into work processes, establishing risk management as an organizational strategy, setting risk appetite as a basis for developing risk assessment criteria, and defining the roles and responsibilities of personnel involved in risk management.
-
In terms of awareness: The Company regularly promotes the development of directors of the board and executives by having them attend training courses continuously to enhance knowledge. The Company had provided the directors and executives’ knowledge on risks related to corporate governance and sustainability development as well as those related to nature of business, such as new products, compliance process, relevant laws, along with the Company's operational guidelines on such matters. For employees, the company develops a communication video emphasizing the dedication and significance of managing risks among employees, creates posters illustrating potential risk events to inform workers about preventive measures and risk management, implements training programs on risk management both through E-Learning and on-site training. Additionally, we conduct a review to ensure a comprehensive understanding of risk management before risk assessments are conducted.
- In terms of practical implementation: The Company conducts regular risk management workshops between business unit executives and the Risk Management Office, and develops management measures and establishes Key Risk Indicators (KRIs), while monitoring progress in operations. Additionally, we organize risk assessments in various areas, such as deciding on large-scale investment projects, responding to changes in weather conditions, handling floods, droughts, human rights issues, and ensuring workplace safety. We also promote the integration of risk discussions into monthly business unit meetings and support the sharing of risk management experiences among business units. Therefore, employees are equipped with practical knowledge to operate day-to-day activities and manage project with risk awareness such as incorporating risk management in the process of developing new product and services, project investment, merger and acquisition, etc.
- Financial incentives: The consideration on remuneration of executives and employees at all levels is based on results of performance assessment with organization indicators. Other than work achievement in terms of economic success, it includes sustainability indicators which comprise compliances with CPF VALUE and Code of Conduct, personnel development, risk management, as well as social responsibility goals and environmental goals. For example of occupational health and safety risk, and legal risk, the Company sets KPIs for executives and employees, target and performance, then evaluate annual performance, and link results to employee financial benefits and position adjustments.
Compliance Oversight
The Corporate Compliance Office (“CCO”) has been appointed and tasked by chairman of Executive Committee. CCO has followed compliance framework, to ensure that CPF’s operations are conducted in compliance with the applicable laws and good practices. In the year 2023, we have continued
- To monitor new or updated laws and regulations applicable for CPF businesses and communicated to the relevant business units and supporting functions through various channels, including emails, infographic, Management Committee Meetings and physical and on-line training sessions. We have also sent early warning notifications and enquiries to relevant business units and supporting functions to acknowledge and to revert with their feedback for hearing and/or serving as private sector’s comments and recommendation to relevant authorities regarding the upcoming laws and regulations.
- To annually perform compliance review by using self-assessment questionnaires for business units and supporting functions. For business units with high risk, we have increased the frequency to 2 times per year. Corrective action plans for potential non-compliance or non-compliance issues are properly set, closely monitored and followed up.
- To perform case management process for non-compliance issues raised through whistle blowing and other channels by working with business units and relevant supporting functions in order to mitigate impact from potential legal action or litigation and improve control process to prevent recurrence.
To strengthen compliance oversight, we have built Compliance champions across business units both in Thailand and overseas in order to coordinate and work closely with CCO. In this year, we have continued building compliance awareness by launching compliance e-learning and Code of Conduct and Compliance awareness survey in order to emphasize the importance of compliance and focus on the crucial role of compliance as a collective responsibility within the Company and the outcomes of this survey is utilized to refine and enhance the supervision of the rule adherence, ensuring greater efficiency in compliance process. In addition, we also increase our communication channel through Compliance Page (Company’s intranet) so that executives and employees can easily access key laws and the Company’s policies relevant to business operations. Moreover, we have incorporated regulation compliance and adherence to the business code of conduct as key performance evaluation criteria for executives and employees for their annual performance assessment, salary adjustments, and position adjustments to promote and support regulatory compliance throughout the Company.
CCO has regularly reported the progress and results of the regulatory compliance and the business code of conduct to the Audit and Risk Management Committee, Risk Management Sub-committee, Management Committee and/or the relevant committees and executives.
Performance