Enterprise Risk Management Policy and Procedure

Document control

August 2025

Document Version 4.0

For Internal Use Only

Document Review and Approval

Revision History:

Table of Contents

1. Overview

1.1 Introduction

SecureXcel Private Limited is a cybersecurity, governance, risk and compliance (GRC), and assurance services company. Its activities include cybersecurity assessments, offensive security testing, security and control reviews, GRC and compliance advisory, privacy and risk-management support, incident-response and forensic assistance, security utilities, and an enterprise GRC platform. The Enterprise Risk Management framework supports informed decision-making across strategic, operational, financial, technology, cybersecurity, legal, compliance, people, third-party and resilience risks relevant to these activities.

A key factor for a Company’s capacity to create sustainable value is the risks that the Company is willing to take and its ability to manage them effectively. The ability to identify and manage risks promptly is also a critical aspect of corporate governance at any Company. Many risks exist in a Company’s operating environment and continuously emerge on a day-to-day basis. Risk Management does not aim at eliminating them, as that would simultaneously eliminate all chances of rewards/ opportunities. Risk Management is instead focused on ensuring that these risks are known and addressed through a pragmatic and effective Risk Management process.

This Risk Management Policy and Procedure aim to provide specific procedures to operationalize the Risk Management Charter of the Company.

1.2 Objectives

The objectives of Risk Management at SecureXcel are:

• To establish a risk intelligence framework for the Company.
• To establish ownership throughout the Company and embed Risk Management as an integral part of the business rather than a stand-alone system.
• To help the decision makers of the SecureXcel explicitly take account of uncertainty, the nature of that uncertainty, and work towards a solution to address it.
• To ensure that all the current and expected risk exposures of the SecureXcel are identified, qualitatively and quantitatively evaluated, analyzed, and appropriately managed.
• To enable compliance with the relevant legal and regulatory requirements and international norms.
• To assure demonstrable achievement of objectives and improvement of the financial stability of the SecureXcel.
• To develop a risk-intelligent culture that supports strategic decision-making and improves business performance.

Risk Management is an integral part of business practices at SecureXcel. This Risk Management Policy and Procedure aim at formalizing a process to deal with the most relevant risks at SecureXcel, building on existing management practices, knowledge, and structures.

1.3 Legal Regulation

The Securities and Exchange Board of India (SEBI) has included Risk Management as part of Securities & Exchange Board of India. (Listing Obligations and Disclosure Requirements) Regulations 2015 (LODR) requirement as amended time to time. As per Regulation 17 of the SEBI LODR, disclosures to the Board are to be made by the listed entity on whether the risk assessment and its minimization procedures are in place. As per the Companies Act 2013, there are specific requirements for Risk Management that a Company needs to comply with. In addition, the Board of Directors and Risk Committee have been vested with specific responsibilities in assessing the robustness of risk management policy, process, and systems.

1.4 Risk Definitions

• Risk: Any event/non-event, the occurrence/non-occurrence of which can adversely affect the objectives of the Company. These threats may be internal/ external to the Company, may/may not be directly influenced by the Company and may arise out of routine/non-routine actions of the Company.
• Risk Management: A structured, consistent, and continuous process across the entire Company for identifying, assessing, deciding on responses to and reporting on the opportunities and threats that may affect the achievement of its objectives.

1.5 Effective Date

This Policy and Procedure are applicable w.e.f. December 1,2022.

1.6 Scope and Process Overview

The contents of this document apply to the Risk Management Department or Finance Department of SecureXcel. Any exception to the policies stated herein shall be subject to the approval of the Risk Management Committee or their assignees under the Delegation of Authority (DoA) matrix.

This Policy and Procedure set out guidelines to be followed by the Risk Management Department within SecureXcel.

This document describes policies, processes, and procedures for the Enterprise Risk Management (ERM) process applicable within SecureXcel.

1.7 Custody of Document

The custodian of this Policy and Procedure document is the designated team by Management. All enquiries and matters relating to this Policy and Procedure: content, implementation, scope, objectives, etc., should be addressed to the designated team by Management.

The Policy and Procedure custodian is responsible for safeguarding and updating the Policy and Procedure, its content and distribution whether in whole or part.

The content of the Policy and Procedure must be approved by the Management.

This document and its updates are effective from the date of approval unless otherwise specifically mentioned.

1.8 Confidentiality and Distribution Control

The Policy and Procedure are an internal document and may contain business/customer-sensitive information. Hence, it should be kept in a safe place and should be used with discretion for office work only. Unauthorized copying shall not be allowed and if discovered, will lead to disciplinary action.

Hard copies of the Policy and Procedure shall be distributed on a “need to know” basis with a soft copy in non-editable PDF format available.

To properly manage business-sensitive information and distribute amendments made to the Policy and Procedure from time to time, a list of custodians of the Policy and Procedure (known as the Distribution log) is provided above. The Distribution Log should be updated when copies are distributed to staff or changes in personnel take place in SecureXcel.

1.9 Maintenance of Document

1. 1. The Policy and Procedure should be reviewed and approved on an annual basis to reflect changes in the business activities of SecureXcel. It should align with the business activities of SecureXcel.
2. 2. The frequency and responsibilities of review and approval are illustrated in the following table:

* Approval is required only in the event of any modifications

1. 3. Amendments to the Policy and Procedure are usually made because of one or a combination of the following reasons:

• Changes in the business strategies and policies of SecureXcel.
• Changes in functions and activities of SecureXcel.
• Changes in business processes.
• Changes in SecureXcel structure.
• Changes in regulatory norms or authority structure; and/or
• Changes in job roles, duties, and descriptions.
• Any factors or circumstances which lead to an amendment to the existing Policy and Procedure

1. 4. Requests for updating the Policy and Procedure (add/delete/amend) can only be originated by a user of the Policy and Procedure. Such change requests should also highlight the impact of the changes being proposed.
2. 5. This Policy and Procedure will be updated to ensure that all changes, whether temporary or permanent, are properly authorized and documented, and that its contents constantly reflect the current practices in ERM aspects.
3. 6. Updates will be processed only through a Request for Amendment (RFA) Form as detailed in Annexure 9. The origin form remains with the custodian and a copy is given to the originator of the request.
4. 7. Initial and final approval of any changes will be given following the maintenance and review frequency guidelines set out in this section.
5. 8. Updates to Policy and Procedure should be followed as per the process below.

1.10 Distribution of Updates

1. 1. Each section of this Policy and Procedure is numbered. Circulation/distribution of the Policy and Procedure, its subsequent updates and temporary changes will be controlled and monitored.
2. 2. Distribution of the Policy and Procedure, its updates, or temporary changes, in whole or part, will be made only to designated functions and officers as set and approved by the Policy and Procedure custodian.
3. 3. It will be the responsibility of the custodian to ensure that the Policy and Procedure are properly updated in terms of adding new pages, removing superseded pages and/or making any editing changes.

1.11 Copyrights

1. 1. This Policy and Procedure and its content are strictly for internal use and are as such treated as highly confidential material.
2. 2. No part of this Policy and Procedure may be reproduced, stored in any system or form, or transmitted in any form by any means – electronic, mechanical, photocopied, recorded, or otherwise – without the prior written consent of the Policy and Procedure custodian.
3. 3. Violation of the above clause subjects an individual or SecureXcel to applicable legal proceedings as per the laws of the State and SecureXcel’s internal policies.
4. 4. No one other than SecureXcel’s employees can have access to this Policy and Procedure without the prior consent of the Policy and Procedure’s custodian.

1.12 Risk Management Structure

The Management of SecureXcel may appoint an External Risk Management Consultant for carrying out the activities for Risk Management.

1.13 Abbreviations

2. Risk Management Policy and Procedure

While defining and developing a formalized Risk Management process, leading Risk Management standards and practices have been considered. However, at SecureXcel, the focus has been to make this process relevant to business reality and to keep it pragmatic and simple from an implementation and use perspective.

The SecureXcel Risk Management Framework outlines the series of activities and their enablers that SecureXcel proposes to deploy to assess, mitigate and monitor risks across the SecureXcel.

• SecureXcel is committed to developing an Integrated Risk Management Policy & Framework: To achieve strategic objectives while ensuring appropriate management of risks.
• To ensure the protection of stake holder’s value
• To provide a clear and strong basis for informed decision-making at all levels of the SecureXcel
• To strive towards strengthening the Risk Management system through continuous learning and improvement
• To create a ‘risk-aware’ culture across the SecureXcel
• To anticipate and take preventive action to manage risks.

All employees of SecureXcel must strive to take responsibility for effective Risk Management in all aspects of the business. Every employee of the Company is recognized as having a role in Risk Management, from the identification of risk to its treatment and shall be invited and encouraged to participate in the process.

The Designated team by Management or the External Risk Management Consultant shall determine key risks, communicate the policy, objectives, procedures, and guidelines, and direct and monitor the implementation, practice, and enable performance of Risk Management throughout SecureXcel.

The Board and Risk Management Committee nominated by the Board of Directors shall review the Risk Management Framework and Policy and recommend changes, if any, at least once every year.

The Risk Management Governance at SecureXcel comprises essentially 4 elements:

1. 1. Risk Management principles to provide guidance on the characteristics of effective and efficient risk management, communicating its value and explaining its intention and purpose. The principles are the foundation for managing risk and should be considered when establishing SecureXcel’s risk management framework and processes. These principles should enable SecureXcel to manage the effects of uncertainty on its objectives.
2. 2. Risk management framework to assist the SecureXcel in integrating risk management into significant activities and functions. The effectiveness of risk management will depend on its integration into the governance of the SecureXcel, including decision-making. This requires support from stakeholders, particularly top management. Framework development encompasses integrating, designing, implementing, evaluating, and improving risk management across the SecureXcel.
3. 3. Risk Management structure i.e., the enablers that are created to operationalize the process. These are in the form of roles & responsibilities, reporting calendars etc.
4. 4. Risk Management process i.e., the process to identify, analyze, prioritize, reporting, monitor and manage risks in the Company.

Below is a diagrammatic representation of SecureXcel Risk Management.

2.1 Risk Management Principles

SecureXcel follows the following principle for effective and efficient risk management.

1. 1. Risk management is integrated into the SecureXcel’s processes and functions.
2. 2. Risk management is structured and comprehensive contributing to consistent and comparable results.
3. 3. Risk management is customized and proportionate to the SecureXcel’s external and internal context related to its objectives.
4. 4. Risk management is inclusive and transparent and includes timely involvement of stakeholders enables their knowledge, views, and perceptions to be considered.
5. 5. Risk management is dynamic, fluid, and responsive to change as risks can emerge, change, or disappear as SecureXcel’s external and internal context changes. Risk management anticipates, detects, acknowledges, and responds to those changes and events in an appropriate and timely manner.
6. 6. Risk management takes into consideration the best available information like historical and current information, as well as on future expectations, any limitations and uncertainties associated with such information and expectations. Information should be timely, clear, and available to relevant stakeholders.
7. 7. Risk management considers human factors and the company culture which can significantly influence all aspects of risk management at each level and stage.
8. 8. Risk management encourages and drives continual improvement through learning and experience.

2.2 Risk Management Framework

Framework development encompasses integrating, designing, implementing, evaluating, and improving risk management across the SecureXcel. Below illustrates the components of a framework.

2.3 Risk Management Process

Whether risks are external or internal to the Company, or can be directly influenced/ managed or not, these are all managed through a common set of processes at SecureXcel.

This process is scheduled as per Risk Management Activities Calendar along with the business planning exercise or at any point in time on account of significant changes in internal business conduct or external business environment. Where the business seeks to undertake a non-routine transaction (such as an acquisition, entering a new line of business etc.), the Risk Management process is activated as a part of the proposal for undertaking such a transaction. Management can appoint an External Consultant to carry out the activities of Risk Management. Diagrammatic representation of Integrated risk management framework is presented below.

The overall Risk Management process covers:

1. 1. Setting the context:

The risk management process involves the systematic application of policies, procedures, and practices to the activities of communicating and consulting, establishing the context and assessing, treating, monitoring, reviewing, recording, and reporting risk.

The risk management process should be integrated into the SecureXcel's management and decision-making, across its structure, operations, and processes. It can be applied at strategic, operational, program, or project levels, with customized applications to achieve objectives and fit the external and internal context. Throughout the process, the dynamic and variable nature of human behavior and culture should be considered. While often presented as sequential, the risk management process is, in practice, iterative.

Establishing the scope and context involves establishing the external, internal and Risk Management context in which the rest of the process will take place, the criteria against which risk will be evaluated and the structure of the analysis be defined.

Understanding the external and internal environment is the first step in the Risk Management process along with linking to SecureXcel strategies. It considers the challenges and opportunities in the context of SecureXcel’s strategies, vision and objectives, operating environment, and key stakeholders. The key objectives of this step include the following:

• To understand and consider SecureXcel’s strategic objectives, the environment in which it operates, the risk to achieving SecureXcel’s strategic objectives and the criteria by which the risks will be assessed.
• To establish the internal context
• To establish the external context
• To establish a Risk Management context
• To align core values, decision-making, and employees’ behavior to Risk Management cultures

The linkage of SecureXcel's strategy to Risk Management is vital for achieving long-term success. By incorporating risk considerations into strategic decision-making, SecureXcel can identify and address potential threats, seize opportunities, and position itself as an agile and resilient player in the marketplace.

A well-integrated approach to Risk Management of SecureXcel enables businesses to navigate uncertainties effectively, enhance stakeholder confidence, and unlock new avenues for growth and innovation. In the risk-aware culture at SecureXcel, all SecureXcel employees shall know what SecureXcel stands for, SecureXcel’s core values and the boundaries within which they can operate.

They can openly discuss and debate which risks should be taken to achieve SecureXcel’s strategy and business objectives, with the result being employee and management behavior that is more consistently aligned with SecureXcel’s risk appetite.

Below is an illustrative diagrammatic representation of linking strategy to Risk Management: -

Managing both types of risks are key to strategy realization and the long-term growth of SecureXcel.Managing both types of risks are key to strategy realization and the long-term growth of SecureXcel.

Risk from Strategy

Risk to Strategy

Risk to the execution of SecureXcel’s stated strategy.Undermine SecureXcel’s ability to achieve or maintain exceptional performance.Risk related to the entity’s processes and internal systems that supports strategic objectives. Process risk.Operational risksInvolved stakeholders- Head of Department, Process OwnersRisk to the execution of SecureXcel’s stated strategy.Undermine SecureXcel’s ability to achieve or maintain exceptional performance.Risk related to the entity’s processes and internal systems that supports strategic objectives. Process risk.Operational risksInvolved stakeholders- Head of Department, Process OwnersRisks that may impact the assumptions underlying to SecureXcel StrategyChallenge the logic of the Company’s strategic choices.Threaten SecureXcel’s competitive position.Identification and documentation of the risk affecting the strategy, and objectives of the business.Reviewing the strategy with risk lensInvolved stakeholders- CEO, CFO, CIO, and Senior ManagementRisks that may impact the assumptions underlying to SecureXcel StrategyChallenge the logic of the Company’s strategic choices.Threaten SecureXcel’s competitive position.Identification and documentation of the risk affecting the strategy, and objectives of the business.Reviewing the strategy with risk lensInvolved stakeholders- CEO, CFO, CIO, and Senior Management

Benefits of Linking Strategy to Risk for SecureXcel:

• Improved resilience: A well-integrated Risk Management approach strengthens SecureXcel's resilience to unforeseen events, allowing it to withstand and recover from disruptions more effectively.
• Enhanced competitive advantage: By proactively managing risks and capitalizing on opportunities, companies can gain a competitive edge in the marketplace. They can respond quickly to changing market conditions and exploit emerging trends, positioning themselves for sustainable growth.
• Stakeholder confidence: Effective Risk Management integrated into the strategic decision-making process enhances stakeholder confidence. Investors, customers, and regulators are more likely to trust and engage with companies that demonstrate a comprehensive understanding of risks and implement appropriate measures to mitigate them.
• Innovation and agility: Viewing risk as an opportunity encourages a culture of innovation and agility within SecureXcel. Companies that are open to embracing positive risks can experiment with new ideas, technologies, and markets, fostering growth and fostering a culture of continuous improvement.

At SecureXcel, the Company has embraced a risk-aware culture by:

• Maintaining strong leadership: SecureXcel’s Risk Management Committee and Management place importance on creating the right risk awareness and tone throughout SecureXcel. Culture and, therefore, risk awareness cannot be changed from the second-line team or department functions alone; SecureXcel management shall be the real driver of change.
• Employing a participative management style: SecureXcel Management shall encourage personnel to participate in decision-making and to discuss risks to strategy and business objectives.
• Enforcing accountabilities for all actions: SecureXcel Management shall document policies of accountability and adhere to them, demonstrating to personnel that lack of accountability is not encouraged; and that practicing accountability is appropriately rewarded.
• Aligning risk-aware behavior and decision-making with performance: Remuneration and incentive programs of SecureXcel shall be aligned to the core values of SecureXcel including expected behavior, adherence to codes of conduct, and promoting accountability for risk-aware decision-making and judgment.
• Embedding risk in decision-making: SecureXcel Management addresses risk consistently when making key business decisions, which includes discussing and reviewing risk scenarios that can help everyone understand the interrelationship and impacts of risks before finalizing decisions.
• Having open forum discussions about risks vulnerable to SecureXcel: SecureXcel Management does not view risk as being only negative and understands that managing risk is critical to achieving the strategy and business objectives.
• Encouraging risk awareness across SecureXcel: SecureXcel Management continually sends messages to personnel that managing risk is a part of their daily responsibilities, and that it is not only valued but also critical to SecureXcel’s success.

1. 2. Identifying and Prioritizing Risks, which comprises:

Risk identification and definition – Focused on identifying relevant risks that can adversely affect the achievement of the objectives and consider identifying risks associated with upside events and opportunities. It seeks at creating/updating risk definitions to ensure an undisputed understanding of the potential threat.

Risk classification – Focused on understanding the various impacts of risks and the level of influence that the Company has on their root causes.

Risk prioritization – Focused on determining risk priority. This involves an assessment of the various impacts taking into consideration the risk appetite of the Company.

1. 3. Managing risks, which comprise:

Risk mitigation – Focused on addressing critical risks to restrict their impact(s) to an acceptable level (i.e. – within the defined risk appetite). This involves performing a risk competence scan to identify ongoing mitigation actions and any improvements required. This involves the definition of ownership, responsibilities, and milestones for the risk response plan of the Company.

Risk reporting and monitoring – Focused on providing to the Board of Directors, the Risk Management Committee and Line Management periodic information on the risk profile and effectiveness of the implementation of the mitigation plans.

1. 4. Communication and consultation:

The purpose of communication and consultation is to help stakeholders understand risk, decision-making bases, and the reasons for required actions. Communication aims to raise awareness and understanding, while consultation gathers feedback for decision-making. Coordination between the two ensures timely, relevant, and accurate information exchange, considering confidentiality, integrity, and privacy. It should occur throughout the risk management process, aiming to:

• Combine expertise at each step.
• Consider diverse views in defining and evaluating risks.
• Provide information for oversight and decision-making.
• Foster inclusiveness and ownership among affected parties.

2.2 Risk Management Structure

The Risk Management process at SecureXcel is supported by a set of enablers that make Risk Management an ongoing activity. These enablers take the form of:

1. 1. Policies that define the Company’s risk appetite and underlying principles for managing risks & undertaking transactions
2. 2. Risk Management Activity Calendar that summarizes the different activities to be performed by the Company for effective Risk Management
3. 3. Roles and structure for Risk Management and oversight. At SecureXcel, the following set of roles & responsibilities have been prescribed:

• Governance The Board of Directors are responsible for defining and approving the Risk Management Framework. The Board of Directors have delegated direct oversight responsibility of Risk Management to the Risk Management Committee. The Risk Management Committee is thus responsible for monitoring the risks and Risk Management process by reviewing: (i) periodic risk reporting produced by the Executive Management; and (ii) reports from the various Assurance functions.
• ExecutionExecutive Management is responsible for operationalizing the Risk Management Framework at SecureXcel. This includes identifying & prioritizing risks, operationalizing mitigation strategies and reporting on risk mitigation. Management can take support from External Consultants to perform the ERM activities. Management can outsource the activities carried out for Risk Management to external consultants.
  • For routine business activities: Business Unit (‘BU’) head/Function heads are required to implement the Risk Management Framework within their respective area. While they are responsible for performance on risks, they may designate specific risk owners to assist them in managing risks. Each business unit/function has a risk owner who oversees & coordinates the deployment of Risk Management activities within the BU/function.
  • For non-routine business activities: Certain activities/decisions are non-routine and represent one-off transactions. These include activities such as mergers & acquisitions, divestments, entering new lines of business, ERP implementation, etc. The Executive-in-charge of such a transaction has the responsibility for operationalizing Risk Management for such activities.
• Monitoring

Designated team by Management or External Risk Management Consultant is entrusted with the responsibility to review and provide independent assurance on the overall effectiveness and efficiency of the Risk Management process. While all risks cannot be reviewed, the Designated team by Management, External Consultant, or any other function(s) entrusted by the Risk Management Committee may provide independent assurance on the effectiveness of defined risk mitigation strategies for certain areas.

As part of their annual audit planning exercise, these functions shall take specific inputs from the Risk Management Committee on the level and extent of assurance required on specific risks. In addition, these functions through their regular audit/ fieldwork at various levels might identify additional risks, which will serve as an input for the subsequent risk identification and definition process.

As SecureXcel requirements might change, the capabilities and value it seeks from Enterprise Risk Management may also change. Enterprise Risk Management shall be tailored to the capabilities of SecureXcel, considering both what SecureXcel is seeking to attain and the way it manages risk. It is natural for the operating structure to change as the nature of the business and its strategy evolves. Management, therefore, shall regularly evaluate the operating structure and associated reporting lines. Management can appoint an External Consultant to perform Risk Management activities like:

• Kick-off risk identification and assessment annual workshop
• Initial update of the Risk Register
• Quarterly update of the Risk Register
• Annual update of the Risk Register
• Quarterly testing
• Risk monitoring reports.
• Escalation of identified risks.
• Risk monitoring of non-routine business activities
• Risk reporting non-routine business activities.
• Exception to the procedure
• Exception to policy adherence

The Group CFO and Risk Management Committee of the Board shall review and approve such activities from time to time.

2.3 Limitation

SecureXcel Risk Management Framework does not intend to provide complete assurance against failures to achieve business objectives, nor does it provide full assurance against material misstatements, losses, frauds, human errors, misjudgments in decision-making and violations of legislation and regulation. The risk-related information outlined in risk management process may not cover all possible risks. The discussion may include forward-looking statements. The business is subject to uncertainties that could result in significant differences between actual results and those expressed in the forward-looking statements. If any of these risks materialize, they could have a material and adverse impact on business, financial condition, or prospects. Additionally, business, operating results, financial performance, or prospects could be negatively affected by risks and uncertainties currently unknown to SecureXcel or that SecureXcel did not consider material. Users of risk management outputs are advised to refer to the detailed discussion of risk factors and related disclosures in our regulatory filings and to exercise their judgment in assessing the risks associated with the Company.

3. Risk Management Procedures

SecureXcel operates through business functions, service teams and centralized support functions. Risks are identified and managed through decisions and operations within these functions and through enterprise-level governance. Risk Management is therefore operationalized at the functional and enterprise levels, with significant strategic or cross-functional risks escalated to the designated management and risk governance body. The Enterprise Risk Management framework is aligned with ISO 31000 and relevant leading practices and supports a consistent approach to risk identification, assessment, treatment, monitoring and reporting.

While the series of Risk Management activities to be performed remains the same for risks that arise from routine and non-routine activities/events, the frequency, extent, and review for risk mitigation may significantly vary.

The benefits of Enterprise Risk Management to SecureXcel are listed below:

• Increase the range of opportunities: By considering all reasonable possibilities—both positive and negative aspects of risk—management can identify opportunities for SecureXcel, and unique challenges associated with current and future opportunities.
• Increase positive outcomes and advantages while reducing negative surprises: Enterprise Risk Management allows SecureXcel to improve its ability to identify risks and establish appropriate responses, increasing positive outcomes while reducing negative surprises and related costs or losses.
• Identify and manage SecureXcel-wide risks: SecureXcel may face a myriad of risks that can impact many parts of the Company. Sometimes a risk can originate in one part of SecureXcel but affect a different part. Management shall identify and manage these SecureXcel wide risks to sustain and improve performance.
• Reduce performance variability: The challenge is less about surprises and losses, and more about performance variability. Performing ahead of schedule or beyond expectations may cause as much concern as performing below expectations. This shall help SecureXcel to prepare for any adverse events in future.
• Improve resource deployment: Obtaining robust information on risk allows management to assess overall resource needs and helps to optimize resource allocation.

3 Detailed Risk Management Procedures

Risk procedures are divided into following sections.

• Section 3.1 Risks Originating from Routine Business Activities & Operations
• Section 3.2. Risks Originating from Non-routine Business Activities & Operations
• Section 3.3 Change in Risk Management
• Section 3.4 Exception Management Reporting

3.1 Risks Originating from Routine Business Activities & Operations:

Annual Risk Assessment

The Company performs an annual risk assessment that coincides with its business planning exercise.

The annual business plan sets a good context to identify and prioritize risks. Once the risks have been prioritized, a risk competency scan is performed to identify existing management strategies to address the Risks That Matter (RTMs).

Improvement opportunities to enhance risk mitigation are identified. The total of existing management strategies and improvement opportunities is documented as a formal Risk Management plan for the RTM. As part of this exercise, the assessment (of prioritized risks and their mitigation strategies) is presented to the Risk Management Committee for its consideration and review.

The risk assessment is coordinated by the Designated team by Management or External Risk Management Consultant across operational and strategic risks. The results of the risk assessment are owned by the respective risk owners.

Quarterly Risk Refresh and Reporting

On a quarterly basis, the risk owner/BU/Function Head formally reports on Risk Management within his area of operation. The purpose of this reporting is to assess how well the RTMs are being managed and if any additional RTMs have emerged that can adversely affect business operations.

The risk report includes:

• Performance of the function on managing its RTMs in the light of the mitigation strategies and risk MIS
• Identification of any additional RTMs that has emerged post the annual risk assessment; and
• Definition of the mitigation strategy for the new RTM.

The reporting process is coordinated by the risk owners for the unit. The results of this exercise are compiled by Designated team by Management or External Risk Management Consultant and are made available for review by the Management and the Risk Management Committee. Refer to Annexure 2 for the ‘Risk Management Activity Calendar’ illustrates how the Risk Management activities are operationalized at the Company. SecureXcel can outsource this process to an external consultant.

The following section details the Risk Management procedures for routine business transactions/operations:

3.1.1. Set the Context

The purpose of establishing the context is to customize the risk management process, enabling effective risk assessment and appropriate risk treatment. Scope, context, and criteria involve defining the scope of the process and understanding the external and internal context.

This step involves understanding the vision, goals, business strategy and structure of SecureXcel to identify its objectives and areas that it seeks to safeguard.

Enterprise Risk Management shall not create SecureXcel’s strategy, but it influences its development. SecureXcel integrates Enterprise Risk Management practices into setting the strategy and provides management with the risk information it needs to consider alternative strategies and, ultimately, to adopt a chosen strategy.

Designated team by Management or External Risk Management Consultant obtains an understanding of the business objectives and management priorities through discussions with the Risk Management Committee and the Executive Management. The objectives and priorities set the background for identifying and prioritizing risks.

3.1.2. Risk identification.

This step involves understanding and listing the potential threats that may affect the realization of the business objectives or priorities. This is either in the form of a risk (negative event) or an opportunity (positive event). The risk identification process takes into consideration both internal and external events (global, regional, and local) by following the below-mentioned procedure.

Annually, a risk profile for the business/function is prepared based on discussions with key management personnel. Existing Risk Registers and management reports serve as a baseline for this exercise. This Risk profile/Register is revisited quarterly by SecureXcel (Designated team by Management or external consultant) to identify any new risk event that can adversely impact business objectives.

Risks that are identified are documented in a standard template called ‘Risk Register’. The Risk Register details the risk, its classification, its potential area of impact and functions that may play a role in managing it. SecureXcel uses a ‘Risk Classification Framework’ to create a common understanding of risks and to differentiate between the risk, its causes, and eventual effects.

The quality and completeness of the risk identification is the responsibility of the Management for the Function/BU. While Designated team by Management or External Risk Management Consultant plays an active role in facilitating the annual risk exercise, the risk owners for the BU/Function play a predominant role in coordinating the quarterly risk assessment and reporting.

The purpose of risk identification is to find, recognize and describe risks that might help or prevent SecureXcel achieving its objectives. Relevant, appropriate, and up-to-date information is important in identifying risks. The objective of this step is to:

• Identify a comprehensive list of risks and events that might impact the achievement of strategic objectives.
• Identify sources of risk, areas of impact, events, and their causes and potential consequences
• Describe identified risk.

The detailed procedure is documented below.

3.1.3. Risk Analysis and Prioritization

The purpose of risk analysis is to comprehend the nature of risk and its characteristics including, where appropriate, the level of risk. Risk analysis involves a detailed consideration of uncertainties, risk sources, consequences, likelihood, events, scenarios, controls, and their effectiveness. An event can have multiple causes and consequences and can affect multiple objectives.

Risk analysis provides an input to risk evaluation, to decisions on whether risk needs to be treated and how, and on the most appropriate risk treatment strategy and methods. The results provide insight for decisions, where choices are being made, and the options involve different types and levels of risk.

This step involves identifying and selecting critical risks from the Risk Register. The objective of risk analysis is to comprehend the nature of risk and its characteristics including, where appropriate, the level of risk. Risk analysis involves a detailed consideration of uncertainties, risk sources, consequences, likelihood, events, scenarios, controls, and their effectiveness. An event can have multiple causes and consequences and can affect multiple objectives. Risk analysis can be undertaken with varying degrees of detail and complexity, depending on the purpose of the analysis, the availability and reliability of information, and the resources available. Analysis techniques can be qualitative, quantitative or a combination of these, depending on the circumstances and intendeds use.

Risks identified and included in SecureXcel’s Risk Register are assessed to understand the severity of each to the achievement of SecureXcel’s strategy and business objectives. Risk assessments inform the selection of risk responses. Given the severity of the risks identified, management decides on the resources and capabilities to deploy for the risk to remain within SecureXcel’s risk appetite.

An inherent risk assessment is performed for the risks i.e., the impact and likelihood of occurrence is evaluated assuming that controls are not in existence. This allows the business to focus on the most important risks, ‘Risks That Matter’ (RTM). For the RTMs, a separate assessment of the effectiveness of risk mitigation is provided as part of risk reporting.

Before initiating the annual risk prioritization exercise, Designated team by Management or External Risk Management Consultant seeks feedback from the Risk Management Committee on its areas of concern. The ‘Designated team by Management or External Risk Management Consultant’ facilitates the prioritization of risks for the different functions by involving the Function Heads and risk owners. Risk rating criteria should be used as enablers for this exercise. The results of the annual risk prioritization are subject to review, change and approval by the BU/Function Head.

Every quarter, the BU/Function Head would evaluate the relative importance of emerging/existing risk events. This prioritization/refresh would be facilitated by the Designated team by Management or External Risk Management Consultant for the function/BU. Any additional RTM that emerges would be reported as part of the ‘risk reporting’ pack.

Procedures for risk analysis and prioritization

3.1.4. Risk Mitigation

The purpose of risk mitigation is to select and implement options for addressing and treating the risk. Risk treatment involves an iterative process of:

• formulating and selecting risk treatment options.
• planning and implementing risk treatment.
• assessing the effectiveness of that treatment.
• deciding whether the remaining risk is acceptable.
• if not acceptable, taking further treatment.

This step involves preparing the risk response plan for managing the RTMs and restricting their impact to a tolerable level.

The entire process is broken down into the following activities:

• Root cause analysis to identify the reasons and drivers for the existence of the risk.
• Development of mitigation plans with defined ownership and implementation timelines
  • Assessing the existing processes and activities presently undertaken to address the risks.
  • In view of the root causes, identify any gaps in the existing controls environment.
  • Designing additional mitigation strategies to address the risk; and
  • Documenting a mitigation plan with timelines and responsibilities (including existing and proposed activities)

The BU/Function Head has the responsibility for the quality and completeness of the mitigation plans. He/she shall nominate risk owner to identify the root causes and assess existing management controls and improvement opportunities.

This person documents the mitigation strategy (considering existing and proposed activities) with timelines and responsibilities. The Designated team by Management or External Risk Management Consultant would facilitate the documentation of the mitigation plans. All mitigation plans shall be submitted to the Risk Management Committee for review and consideration.

Detailed procedures for risk mitigation are provided below.

3.1.5. Risk Monitoring and Reporting

The purpose of monitoring and review is to assure and improve the quality and effectiveness of process design, implementation, and outcomes. Ongoing monitoring and periodic review of the risk management process and its outcomes should be a planned part of the risk management process, with responsibilities clearly defined.

Monitoring and review should take place in all stages of the process. Monitoring and review include planning, gathering, and analyzing information, recording results, and providing feedback. The results of monitoring and review should be incorporated throughout the SecureXcel’s performance management, measurement and reporting activities.

This step involves reviewing the results of the Risk Management Framework to assess if risks are well controlled. The risk monitoring and reporting process helps in evaluating:

• Any new RTMs which can adversely impact the business.
• The extent of implementation of the mitigation strategies and efficacy of risk mitigation

1. Monitoring

On a quarterly basis, the Business Unit/Function Head reviews the status of Risk Management. While assessing the risk, the BU/Function Head:

• Assesses if any additional risk has emerged that, is already not considered in the risk profile.
• Assesses if a new risk/another risk that is already documented in the risk profiled should be considered as an RTM.
• Nominates a risk owner for a new RTM and oversees the development of mitigation plans; and
• Assesses the performance of the business in managing the risk for the RTM.
• Reviews the extent to which the mitigation plans have been implemented.
• Based on quantifiable data (where possible), assess if the mitigation plans have delivered the right results in terms of Risk Management

To facilitate the above exercise, the risk owners provide information to the Function/BU head.

The designated risk owner provides a self-assessment of the extent of risk mitigation. This assessment is based on feedback on the implementation of the mitigation plans and review of data (where applicable) with respect to risk performance.

If any risks get converted into actual events, the risk owners or process owners shall report the risk event to the Management and Risk Management Committee in the ‘Risk Incident Reporting’ Template as defined by Management.

1. 2. Reporting

The risk management process and its outcomes should be documented and reported through appropriate mechanisms. Recording and reporting aims to:

• communicate risk management activities and outcomes across the SecureXcel.
• provide information for decision-making.
• improve risk management activities.
• assist interaction with stakeholders, including those with responsibility and accountability for risk management activities.

Decisions concerning the creation, retention and handling of documented information should consider, but not be limited to their use, information sensitivity and the external and internal context Reporting is an integral part of the SecureXcel’s governance and should enhance the quality of dialogue with stakeholders and support top management and oversight bodies in meeting their responsibilities. Factors to consider for reporting include, but are not limited to:

• Differing stakeholders and their specific information needs and requirements.
• Cost, frequency, and timeliness of reporting.
• Method of reporting.
• Relevance of information to SecureXcel objectives and decision-making.

The results of the risk assessment are compiled in an ERM risk dashboard as referred to in Annexure 5. The Designated team by Management or External Risk Management Consultant shall support the BU/Function Head in compiling this report.

The ERM risk exposure dashboard is designed to provide an overall risk portfolio perspective of SecureXcel’s top risks. The portfolio perspective communicates the quantified acceptable risk tolerance for each risk, the current risk exposure, the risk mitigation plans (Go-to-Green) to reduce the risk exposure to acceptable risk tolerance levels, and the investments made/needed.

In addition, the portfolio perspective enables the SecureXcel’s overall risk appetite to be considered during risk response planning and resource allocation discussions.

Detailed procedures for preparing Risk Dashboard are provided below.

Developing a “Portfolio View”

1. a) A portfolio is depicted graphically indicating the types and amount of risk assumed compared to the risk appetite of SecureXcel for each SecureXcel function, strategy, and business objective.
2. b) A portfolio view allows management and the board to consider the type, severity, and interdependencies of risks and how they may affect performance.
3. c) Using the portfolio view, SecureXcel identifies risks that are severe at SecureXcel level. These may include risks that arise at SecureXcel level as well as transactional, processing-type risks that could disrupt SecureXcel. The same risk across different units may be acceptable for the operating units but taken together may give a different picture.
4. d) Developing a portfolio view of the risks related to SecureXcel enables risk-based decision-making and helps set performance targets and manage changes in either the performance or the risk profile. By using the portfolio, SecureXcel management can review:

• Assumptions underpinning the assessment of the severity of risk.
• Behavior of individual risks under stressed conditions
• Interdependencies of risks within the portfolio view
• Effectiveness of existing risk responses

The Designated team by Management or External Risk Management Consultant shall consolidate the risk dashboards across the Company and presents these to the Risk Management Committee for its review and appraisal.

In addition, every quarter, based on a pre-specified calendar, a BU/Function would make a formal presentation to the Risk Management Committee on its Risk Management initiatives and status.

On an annual basis, Designated team by Management, or External Risk Management Consultant (along with such officials as may be directed by the Risk Management Committee) makes a formal presentation on the Risk Management activities to the Risk Management Committee. This shall include:

• An overview of the Risk Management process in place.
• Summary of the Risks That Matter across the Company; and
• Results of Risk Management

3.2. Risks Originating from Non-routine Business Activities & Operations:

Where the Company undertakes a non-routine activity/transaction, it shall nominate an Executive-in-Charge. The Execute-in-Charge plays the principal role in driving the transaction and managing the associated risks. He/she may seek the support of a dedicated Designated team by Management or external Risk Management Consultant to oversee risk mitigation.

Depending on the nature and value of the transaction, the Board of Directors/Risk Management Committee thereof may prescribe the frequency with which it shall review the results of Risk Management for this activity/transaction.

3.2.1 Setting Context

This step involves laying down the principal objectives/outcome for the transaction/activity. Risks are identified and prioritized in the context of this objective.

The Executive-in-Charge is responsible for assessing the context. The context set forth for the transaction is reviewed with the Board/Committee of the Board of Directors.

3.2.2 Risk Assessment

A cross-functional team (where applicable) would identify potential risks arising from the transaction/activity i.e.:

1. 1. Risks/threats that the Company is exposed to because of undertaking the transaction/activity; and
2. 2. Potential risks that may impact the successful closure of the activity/transaction.

The Executive-in-Charge would approve this risk profile and identify the critical risks. This listing of RTMs will be presented to the Board / Committee of the Board of Directors for their consideration.

3.2.3 Risk Mitigation

Risks That Matter for such activities may manifest themselves before, during or after the execution of the activity. Specific personnel are identified for managing each RTM. The specified personnel would be required to detail the risk response plan for the associated risk within the timeline and with accountability.

The Executive-in-charge of the transaction bears responsibility for managing all RTMs that have been identified. He would be responsible to the Board / Committee of the Board of Directors to oversee the deployment of this plan.

3.2.4 Risk Monitoring and Reporting

1. 1. Monitoring

The Designated team by Management or External Risk Management Consultant jointly with risk owner would determine the frequency of the review of the Risk Management action plan. A review of the risk preparedness would be performed and documented by the risk owners and the Executive-in-charge would review these results periodically.

1. 2. Reporting

Where such activities need approval from the Board the frequency of review would be agreed thereof with the Board/ its committee. The Executive-in-charge would provide an assessment of Risk Management to the Board/such Committee with the prescribed frequency.

3.3 Change in Risk Management

SecureXcel may anticipate many changes within the setting of strategy and business objectives and performance, but they need to also be aware of the potential for larger, substantial changes that may occur and have a more pronounced effect.

• By embedding continual evaluations into business practices, SecureXcel can systematically identify potential improvements to their Enterprise Risk Management practices.
• Substantial change may lead to new or changed risks and affect key assumptions underpinning strategy.
• Practices for identifying such changes shall be built into business activities and performed continually.
• Changes may be due to the Internal environment or external environment.

SecureXcel’s Designated team by Management or external Risk Management Consultant jointly with risk owners shall identify substantial changes, evaluate their effects, and respond to the changes are iterative processes that can affect several components of Enterprise Risk Management

3.4 Exception Management Reporting

All exceptions to the policy must be approved by the Risk Management Committee and filed at Designated team by Management or External Risk Management Consultant

All exceptions to the procedures to be followed as per the procedures documented in this policy must be approved by the Management. All exceptions should be recorded and approved as per the delegation of authority. All exceptions should be recorded and tracked for closure.

Approval

Level 1- Head of department or enabling function where the risk is identified.

Level 2- Designated team by Management or External Risk Management Consultant

Level 3 – Management

Validity

All exceptions will be provided with a maximum validity period of six (6) months or as per Competent Authority discretion.

4. Risk Management Structure

4.1. Roles and Responsibilities

The Risk Management SecureXcel at SecureXcel comprises the following:

1. 1. Primary role
2. a) Board of Directors (BoD)
3. b) Risk Management Committee
4. c) Management
5. d) BU / Function Head
6. e) Executive-in-Charge (for non-routine transactions)
7. f) Risk owners.
8. 2. Support role.
9. g) Designated team by Management or External Risk Management Consultant
10. h) Reviewers (optional)

a) Board of Directors

The Board of Directors have the responsibility for overseeing the following:

• SecureXcel has put in place a suitable framework for managing risks; and
• This framework has been effectively deployed by the Executive Management.

The Board of Directors have delegated the task of overseeing the deployment of the Risk Management Framework to the Risk Management Committee. On an annual basis, a formal report on Risks That Matter shall be submitted to the Board of Directors.

Below are the Board of Directors' oversight practices of Enterprise Risk Management.

b) Risk Management Committee

The Risk Management Committee is responsible for the overall direction setting and reviewing the implementation of the Risk Management Framework at SecureXcel. The key responsibilities of the Risk Management Committee are to:

• Provide direction to the Risk Management initiatives at SecureXcel; and
• Review of quarterly and annual risk assessments prepared by the Executive Management

The specific roles and responsibilities of the Committee across the components of the Risk Management Framework are detailed below:

Risk identification and prioritization.

• Provide feedback on key risks and concerns.
• Review the results of (the annual and quarterly) risk identification and prioritization and provide inputs.

Risk mitigation.

• Review the mitigation plans developed along with the root causes, Risk Management and reporting ownerships, timelines and status reported by SecureXcel Management or Designated team by Management or external consultant (as the case may be).

Risk monitoring and reporting.

• Review the results of Risk Management as reported by the BU/Functions or the Executive-in-charge.

Risk Management framework.

• Provide overall guidance related to the Risk Management processes across the Company.
• Review the need for additional Risk Management related activities across the Company and assign responsibilities.
• Review the compliance with the processes and timelines as laid out in the Risk Management Activity Calendar.
• Provide an annual summary to the Board of Directors on the efficacy of the Risk Management Framework at the Company.

c) Management

The Management shall be recommended and constituted by the senior management (CFO, CIO, COO, CEO, and other officials as required by the management) and approved by the Risk Management Committee of the Board. The specific roles and responsibilities of the Management across the components of the Risk Management Framework are detailed below:

Risk identification and prioritization.

• Provide feedback on key risks and concerns.
• Review the results of (the annual and quarterly) risk identification and prioritization and provide inputs.

Risk mitigation.

• Review the mitigation plans developed along with the root causes, Risk Management and reporting ownerships, timelines and status reported by the Designated team by Management or External Risk Management Consultant.

Risk monitoring and reporting.

• Review the results of Risk Management as reported by the Functions or the Executive-in-charge.

Risk Management framework.

• Provide overall guidance related to the Risk Management processes across the Company.
• Review the need for additional Risk Management related activities across the Company and assign responsibilities.
• Review the compliance with the processes and timelines as laid out in the Risk Management Activity Calendar.
• Review the performance of the Designated team by Management or External Risk Management Consultant.
• Provide an annual summary to the Board of Directors on the efficacy of the Risk Management Framework at the Company.

d) BU/Function Head

The Function Head / Risk Owner is responsible for implementing the Risk Management Framework in his operational area. The specific roles and responsibilities of the BU/ Function head in the operationalizing of the Risk Management Framework are as follows:

Risk identification and prioritization.

Annual risk identification and prioritization

• Lead the annual risk identification and prioritization exercise.
• Review and finalize the Risk Register.
• Chair and facilitate the session for prioritization of risks.
• Review the list of RTMs; and
• Approve the identification and prioritization results for submission to the Risk Management Committee.

Quarterly risk identification and prioritization

• Initiate the quarterly risk review meetings with the risk owners.
• Review any new risks that are identified.
• Review the prioritization ratings for the new risks.
• Submit the new risks and the prioritization results for the review and approval of the Risk Management Committee.

Risk mitigation.

The BU/Function Head has the responsibility for overseeing the development of mitigation plans to address the Risks That Matter. This involves:

• Nominating the risk owners who are responsible for identifying the root causes, mitigation plans, timelines etc.
• Reviewing and approving the mitigation plans and accountabilities for Risk Management; and
• Submitting the root causes and mitigation plans for the review and approval of the Risk Management Committee.

Risk monitoring and reporting.

Reviewing the effectiveness of risk mitigation for the Risks That Matter. This involves:

• Reviewing the risk MIS and results of self-assessments on risk mitigation by the risk owners.
• Determining and operationalizing corrective action where applicable; and
• Providing an overall Risk Management rating for the RTMs in the risk reporting.

Providing risk reports to the Risk Management Committee. This involves:

• Preparing and approving the risk reporting pack for the Risk Management Committee.
• Presenting the results of Risk Management to the Risk Management Committee/ Board of Directors on such frequency as may be directed by the Risk Management Committee/ Board of Directors.

e) Executive-in-Charge

For non-routine transactions/activities, the Company nominates an Executive-in-Charge to oversee the transaction/activity. This person is responsible for managing the associated risks with such a transaction/activity. This involves:

Risk identification and prioritization.

• Oversee the identification of risks.
• Review and finalize the Risk Register.
• Chair and facilitate the session for prioritization of risks.
• Review the list of RTMs; and
• Approve the identification and prioritization results for submission to the Board of Directors/Committee thereof.

Risk mitigation.

The Executive-in-Charge has the responsibility for overseeing the development and deployment of mitigation plans to address the Risks That Matter. This involves:

• Nominating the risk owners who are responsible for identifying the root causes, mitigation plans, timelines etc.
• Reviewing and approving the mitigation plans and accountabilities for Risk Management; and
• Submitting the root causes and mitigation plans for the review and approval of the Board of Directors/Committee thereof.

Risk monitoring and reporting.

• Reviewing the effectiveness of risk mitigation for the Risks That Matter by reviewing the risk MIS and mitigation plans.
• Determining and operationalizing corrective action where applicable; and
• Providing risk reports to the Board of Directors/Committee thereof

f) Risk Owners

Each Risk That Matters is assigned to a ‘risk owner.’ The risk owner has the responsibility for ensuring that the risks are within the defined risk appetite of the Company. The role of the risk owner involves:

Risk mitigation:

• Identifying the root causes of the risk and existing mitigation strategies of the Company.
• Identifying the gaps in the mitigation strategies and drawing out a corresponding improvement plan; and
• Documenting the risk mitigation strategy with accountability and timelines.

Risk monitoring and reporting:

• Following up with the risk owners on the implementation status of their mitigation plans and taking corrective action where required.
• Providing a formal assessment on risk mitigation to the Executive-in-Charge / BU or Function Head. This assessment is based on their review of the deployment of mitigation plans and risk MIS.
• Supporting the Executive-in-Charge/BU or Function Head in their presentation to the Risk Management Committee on Risk Management; and
• Providing such information as is required by the Assurance team to evaluate the accuracy of his quarterly reporting on mitigation plan effectiveness.

g) Designated team by Management

The Designated team by Management or External Risk Management Consultant is responsible for initiating and coordinating activities for operationalizing the Risk Management Framework reporting directly to the Group CFO.

While the Company has Designated team by Management oversee the deployment of the Risk Management Framework, they are supported by External Risk Management Consultant. The Designated team by Management or External Risk Management Consultant takes the primary role in driving the Risk Management activities within the Function/BU. The role of the Designated team by Management or External Risk Management Consultant is as follows:

Risk identification and prioritization.

Annual risk identification and prioritization

• Initiate and coordinate the annual risk identification and prioritization exercise.
• Update risk classification flow and update criteria.
• Obtain feedback from the Board of Directors and key management personnel on the critical risks for the Company.
• Coordinate the risk identification exercise at the BU/Function:
• Guide the nominated personnel on the approach for risk identification.
• Compile the Risk Register (including mapping of risks to the categories in the risk classification framework) based on the inputs received from the nominated personnel.
• Finalize the Risk Register based on the input received from the senior management.
• Facilitate the session for prioritization of risks.
• Compile the risk prioritization results and prepare the list of risks in the order of priority identifying the RTMs.
• Obtain the approval of the BU/Function Head on the risk assessment.
• Compile the results of risk assessments across the Company and present these to the Risk Management Committee /Board of Directors

Quarterly risk identification and prioritization –

• Organize and facilitate the quarterly risk review meetings with the BU/Function Owner to identify and prioritize Risks That Matter

Risk mitigation.

• Facilitate the activity of documenting the risk mitigation plan.
• Initiate and coordinate the annual mitigation exercise with the risk owners; and
• Compile the mitigation plans approved by the Function/BU Head for review and approval of the Risk Management Committee

Risk monitoring and reporting.

• Generate and send self-assessment questionnaires for risk owners and the mitigation plan owners.
• Collate the results for the self-assessments and submit these for assessment to the BU/Function Head.
• Compile the risk assessment results across BU/Functions and submit these for review by the Risk Management Committee.
• Coordinate the presentation of Risk Management results by the BU/Function Head to the Risk Management Committee; and
• Support the Risk Management Committee in the annual presentation of Risk Management results to the Board of Directors.

h) Reviewers

SecureXcel believes in the integrity of its people and relies on a process of self-assessments for evaluating the effectiveness of Risk Management procedures.

As an additional means of reassurance, the Risk Management Committee may appoint external consultant to provide an independent report on the efficacy of Risk Management for certain risks.

Accordingly, the external consultant shall seek input from the Risk Management Committee on the risks that it should consider for independent reporting and assurance as part of its Annual Audit Plan. Alternative means of assurance may be developed based on the directions of the Risk Management Committee. The external consultant is responsible for the following:

Providing Independent assurance on the efficacy of Risk Management in terms of:

• Extent of implementation of mitigation strategies and their efficacy.
• Effectiveness of risk mitigation.
• Reviewing the accuracy of self-assessments on risk mitigation
• Reporting on such matters as may be specifically directed by the Risk Management Committee

Annexures

Annexure 1: Risk Classification Framework

The risk classification framework provides a common risk language for articulating risks. It allows the Company to distinguish a Risk from an issue or effects of the risk the Risk Register for a BU/function is articulated in the context of the risk universe.

Risks are classified according to the source of their primary root cause. Classifying risks according to source enables the management to understand the aggregate impact of each risk and prioritize response strategies. The Company will classify risks using the following criteria: Financial, Operations, Compliance, and Strategic

Annexure 1.1: Risk Category Definitions

I. STRATEGIC

The Company’s strategy is a systematic plan that connects the current state of a Company to its desired future state. The direction of a Company is defined by its vision and goals while strategy is the path envisaged for the achievement of those objectives. The strategy of a Company is driven by the stakeholder expectations or movements, industry outlook, market dynamics as well as the way a Company is governed and guided. Strategic risks may arise from the decisions and actions a Company takes to achieve its desired future state.

II. OPERATIONS It refers to the activities of the Company in harnessing its resources to execute its business model. This category of risks includes risks related to resources and processes which come together to create products and services that satisfy customers and help achieve the Company's quality, cost, and time performance objectives.

III. COMPLIANCE

The operations of the Company are governed by numerous laws and regulations in addition to being subject to many obligations emanating from contractual agreements entered by it. This category of risks includes risks which arise due to the Company’s inability to comply with the applicable laws, regulations and contractual terms and conditions.

IV. FINANCIAL

In the pursuit of its objectives a corporate raise and manages capital as well as protects its monetary resources. Financial risks include risks relating to the way a corporation raises and manages its finances, reduces uncertainty due to market movement of currency, interest rates and commodity prices and accounting and reporting of its finances. This category of risks also includes risks arising due to fraud and error and assessing the likelihood and impact of such risks.

Annexure 1.2: Illustrative Risk Universe Framework

Below is Illustrative risk universe which has broad themes which can be used by risk owners and team members involved in the process?

Strategic

Annexure 1.3: Risk Definitions

The below table defines and explains the types of risks (not an exhaustive list) that can be identified during risk identification phases. There can be other risks which may be subsequently identified. In such cases, the risk Owners need to consult with the Designated team by Management or External Risk Management Consultant to derive the definition and use it for Enterprise Risk Management. Please read this section along with the Annexure 1.2 Illustrative Risk Universe Framework

Annexure 2: Risk Management Activity Calendar

Designated team to update the calendar at every start of financial year starting April and ending on subsequent year March.

Annexure 3: Risk Rating Criteria

Note – These criteria are subject to change, users need to refer to latest criteria which can be obtained from the designated team.

Impact

Likelihood

Management Preparedness

Velocity

Note – These criteria are subject to change, users need to refer to latest criteria which can be obtained from the designated team.

Scorecard –Heat Map

Consequence

Annexure 4: Risk Action Matrix

Rating table to be followed for classifying the risk for 2 X 2 action matrix.

Annexure 5: Risk Dashboard (example)

The following shall be details disclosed at various level as per table.

Disclosure layers

Annexure 6: Key Components of Risk Register

Below are illustrative components of Risk Register, components can be added as per the requirements of SecureXcel.

Illustrative component of Risk Register

Key Definitions

Annexure 7: Mitigation Control Effectiveness Rating

Annexure 8: Residual Risk Class and Required Action Matrix

Annexure 9: Request for Amendment Form

Request for Amendment Form

Name of the department or function requesting amendments: __________________________________________

Manual for: ____________________________________________________________

Section/s Reference: ____________________________________________________________

Policy Code: ____________________________________________________________

Policy Name: _____________________________________________________________

Description of needed amendments:

____________________________________________________________

Proposed amendments (solution):

____________________________________________________________

Proposed by: _______________________________________________________________

Reviewed by: _______________________________________________________________

Reviewed by: _______________________________________________________________

Approved by: _______________________________________________________________

Implementation Date: ________________________

Annexure 10: Key Components of KRI Dashboard

Annexure 11: Exception Approval Reporting Template

Exception Approval to ERM Policy and Procedure

Annexure 12: Risk Incident Reporting

For any risks that convert into actual events, the risk owners should report the risk to the Management, or the Risk Management Committee in the Risk Incident Reporting Template as defined. The following fields shall be included in the Risk Incident Reporting

Annexure 13: Risk Appetite Metrics and Indicators or Statements

More in Enterprise risk management

• Enterprise Risk Register: AI, ERM and Cyber Risk