2019 UEM Edgenta Annual Report

122 Statement on Risk Management and Internal Control a. Set / clarify business objectives: Understanding of what the objectives are for the Company and its group of companies. b. Establish context: Establish the context and boundaries within which the Group operates. c. Identify risks: Risk(s) are those internal or external factors which could affect / influence the achievement of business objectives either positively or negatively. d. Assess risks: Prioritise risks by evaluating the potential impact on business objectives if a risk were to materialise together with the likelihood of occurrence. The Group adopts the following risk rating matrix to articulate the relationship between risk impact and likelihood. Risk Rating Likelihood Risk Impact Insignificant Minor Moderate Major Catastrophic Certain Medium Significant Significant High High Likely Medium Medium Significant Significant High Possible Low Medium Medium Significant High Unlikely Low Medium Medium Significant Significant Remote Low Low Medium Medium Significant e. Respond to risks: The Group adopts the 4Ts strategy in responding to the identified risks and qualify these according to the acceptable levels. f. Monitor, review and report risks: Risk events and trends to be continually scanned, assessed and monitored and similarly risk responses are monitored continuously to ensure that risk responses are operating as designed and expected. g. Communicate: Communication is required for an effective risk management programme. Changing business condition continuously alter the risk profile of an entity, hence, frequent and explicit conversation about risk is vital to maintain continued awareness and management of key risks. Terminate Avoidance by not to proceed or continue with a particular activity or seeking alternative means to achieve objective Treat Mitigation plans established to reduce the likelihood & impact Take Intentionally taking risk due to inherent / unavoidable risk or to pursue / sustain higher returns, with informed approval by appropriate level Transfer Transfer the risk by moving the risk to 3 rd party but accountability still resides with Risk Owners