STATEMENT ON RISK MANAGEMENT AND INTERNAL CONTROL On 15 November and 2 December 2021, the BARC and the Board approved the revision of the ERM to include a more detailed designation of risk management responsibilities across in ERM reporting structure. The designation of responsibilities includes the Three Lines of Defence model by the IIA. The revised ERM reporting structure and designation of responsibilities is as below: Responsibilities and Processes in the Three Lines of Defence Model Adopted model of Three Lines of Defence (The Institute of Internal Auditors, 2013) Governing Body / Board / Audit Committee External audit Regulator Senior Management 1st Line of Defence 2nd Line of Defence 3rd Line of Defence Management Controls Internal Control Measures Financial Control Internal Audit Security Risk Management Quantity Inspection Compliance The Board and the BARC Responsibilities Governing overall risk oversight responsibility including defining the appropriate governance structure and risk appetite. Process • Articulates and provides direction on risk appetite, organisational control environment and risk culture. • Provide an independent view on specific risk and control issues, the state of internal controls, trends and events 3rd Level of Defence: Internal Audit Responsibilities • Provide independent assurance design and effectiveness on an organisation’s risk management, governance and internal control processes are operating effectively. • Assurance about design and effectiveness Process Perform risk-based internal audit and independent reporting to Management and BARC GOVERNANCE STRUCTURE 119 STRATEGIC PERFORMANCE FINANCIAL REPORTS CORPORATE OVERVIEW THE DRIVING FORCES SUSTAINABILITY STATEMENT
RkJQdWJsaXNoZXIy NDgzMzc=