Enterprise Risk Management Policy

1. Purpose and intent

Establishes a consistent approach to identifying, assessing, treating and monitoring material risks. This policy is intended to provide a consistent reference for decisions, conduct and controls. It should be read alongside applicable laws, contractual obligations and relevant internal procedures. Where requirements differ, the applicable legal requirement and formally approved internal control take precedence.

2. Scope and application

Applies to strategic, financial, operational, legal, compliance, people, technology, environmental, safety and reputational risks across relevant activities.

Business partners are expected to observe equivalent standards where these are relevant to the services they provide or the activities they undertake on the organisation’s behalf. Application should be proportionate to role, activity, risk and applicable legal requirements.

3. Core principles

• Ownership: each material risk should have an accountable owner.
• Proportionality: assessment and controls should reflect likelihood, impact and context.
• Integration: risk should inform decisions, projects, contracts and change.
• Escalation: material exposures and control failures should be raised promptly.
• Learning: incidents, near misses and emerging issues should inform reassessment.

4. Minimum standards and controls

The following controls describe the expected minimum approach. Specific procedures, approval limits, forms and technical controls may be established separately and updated through controlled internal documents.

• Identify risks and opportunities before material decisions or changes.
• Assess inherent exposure, existing controls and residual risk using a consistent method.
• Define treatment actions, owners, due dates and target residual exposure.
• Escalate risks that exceed approved tolerance or require authority beyond the owner’s remit.
• Review risks after incidents, control failures, regulatory changes or material changes in context.

5. Roles and accountability

Leadership establishes risk appetite and oversight expectations. Managers own risks within their areas. Risk or assurance functions, where designated, support methodology, challenge and reporting.

Any person who is uncertain about the application of this policy should seek guidance before taking action. No individual may override a legal obligation or approved control without appropriate authority and documented justification.

6. Reporting and escalation

Concerns, suspected breaches, control weaknesses and incidents should be raised promptly through the relevant management or designated reporting channel. Urgent threats to health, safety, the environment or the security of information must be escalated immediately. Reports should be handled fairly, sensitively and in accordance with applicable privacy and records requirements.

7. Monitoring, assurance and review

Risk registers, action status, incidents, assurance findings and emerging trends should be reviewed at planned intervals. Significant changes should be escalated without waiting for the next review.

Where improvement actions are identified, they should be assigned to an accountable owner, given a proportionate target date and monitored to closure. Material changes in law, risk, organisational context or operating arrangements should trigger an earlier review.

8. Non-compliance

Failure to follow applicable requirements may result in corrective action, additional training, restricted authority, disciplinary measures, contractual remedies or referral to relevant authorities, depending on the circumstances and applicable law. Any response should be proportionate and follow fair process.

9. Related policies and standards

Corporate Governance; QHSE; Information Security; Business Continuity; Compliance.

Additional policy requirements

The following provisions expand the practical expectations set out in this policy. They should be applied in conjunction with applicable law, approved internal procedures, contractual obligations and the circumstances of each activity.

Risk ownership

Each material risk should have an identified owner with sufficient authority to coordinate assessment and treatment. Ownership does not transfer accountability away from management or the relevant governing authority.

Assessment methodology

Risks should be described in terms of cause, uncertain event and potential consequence. Assessment should consider likelihood, impact, velocity, existing controls, residual exposure and interdependencies. Both downside threats and material opportunities may be considered.

Risk appetite and escalation

Risk acceptance must remain within approved authority and documented tolerance. Exposure beyond tolerance, significant control failure or a rapidly deteriorating risk should be escalated promptly, even where financial impact is not yet quantified.

Treatment options

Responses may include avoidance, reduction, transfer or informed acceptance. Treatment plans should identify actions, accountable owners, resources, due dates, dependencies and evidence of completion. Insurance or contractual transfer does not remove the need to manage underlying exposure.

Monitoring and reporting

Risk profiles should be reviewed when circumstances change and at suitable intervals. Reports should identify trends, emerging risks, overdue actions, control effectiveness and assumptions. Scenario analysis may be used for material or interconnected exposures.

Learning and assurance

Incidents, near misses, audit findings and business changes should inform risk reassessment. Independent review may be appropriate for material controls or areas where self-assessment alone is insufficient.

10. Document governance

This web page is a public policy statement. The controlled internal version, where formally approved, is maintained through the organisation’s document-control process. Approval status, document owner, effective date, review cycle and revision history must be confirmed in the controlled document register before this text is represented as a formally issued internal policy.