MISC Annual Report 2017

145 Corporate Governance • Business Continuity Planning Business Continuity Planning (BCP) has been implemented in stages to ensure continuity of critical business functions in the event of disruption. During the year under review, BCP simulations were organised for critical units based in Menara Dayabumi to test the resiliency and robustness of the BCP initiative put in place, as well as to familiarise employees with the business continuity plans. The scenario-based simulation was designed to test all roles and responsibilities of the critical business functions, including critical staff who are required to carry out business recovery from the alternate site. The purpose of the BCP simulations is to ensure that employees understand their specific roles and responsibilities as laid out in the plans, as well as establishing familiarity with the alternate site. The outcome of the simulations identifies the improvement measures that need to be taken, and the lessons learned were employed to enhance and update the plan. This strategy allows MISC to recognise benefits from the investment made, taking advantage of knowledge gained and experience attained through the testing of the business continuity plans. KEY RISK AREAS MISC risk management process enables the evaluation of all relevant risks that may impact the Group. Further to that, key risks covering financials, asset performance, major health, safety, security and environmental incidents, project management and human resource were monitored closely at the Company’s quarterly RMC and BARC meetings. These key risks were selected based on risks that are prevalent and common across the Group, and risks that may have significant and material impact to the Group. The RMC holds quarterly meetings to review the key risks and to ensure mitigation plans are in place to manage such risks. The adequacy and effectiveness of the controls and the robustness of the mitigation actions are also addressed. These are then deliberated at the BARC on a quarterly basis. Several reviews and periodic testing were conducted during the year under review as follows :- • Group Internal Audit provides regular independent audit on the adequacy of MISC’s risk management system and governance. The recommendations arising from the review are adopted and corrective action plans are taken for continuous improvement. • The PETRONAS Group Risk Management conducted three (3) self-assessment reviews on MISC’s compliance to the PETRONAS Resiliency Model (PRM), Plant and Facilities, and Project. The purpose of the self-assessment is to ensure MISC complies to requirements established in its frameworks, guidelines and guiding principles. • An Anti-Bribery and Corruption (ABC) Risk assessment was conducted to preliminarily identify, assess and evaluate bribery exposures within MISC, and identify the areas of operations within MISC that are more exposed to bribery and corruption risk has been presented to the Management. Mitigation plans have thereupon been developed to be implemented in FY2018. OTHER KEY INTERNAL CONTROL PROCESSES To further enhance the internal control system, the Group’s other internal control processes are as follows :- 1. The Board reviews quarterly reports from Management on key operating performance, legal, environmental and regulatory matters. Financial performance is deliberated monthly by the MC and tabled to the BARC and the Board on a quarterly basis. 2. The Group performs a comprehensive annual planning and budgeting exercise which involves the development of business strategies for the next five years to achieve the Group’s Vision. The long-term strategies are supported by initiatives to be pursued in the upcoming year, and for effective implementation, the initiatives are tied to specific measurable indicators which will be evaluated against the relevant business/service units and subsidiaries’ deliverables. The Group’s strategic direction is then reviewed annually taking into account current progress level and other indicators such as latest developments in the industry, changes in market conditions and significant business risks. In addition to that, the Group’s business plan is translated into budgetary numbers for the next five years and financial performance and variance against budget is analysed and reported monthly to the MC and quarterly to the BARC and the Board. STATEMENT ON RISK MANAGEMENT & INTERNAL CONTROL