Risk Management Procedure

SG2X EMPLOYEE HANDBOOK POLICES

|

1

RISK MANAGEMENT PROCEDURE [COMPANY NAME] integrated risk management policy is a continuous, proactive and systematic process to understand, manage, and communicate risk across the organization.

[COMPANY NAME] process requires making strategic decisions that contribute to the achievement of our company's objectives. Risk management is the process of identification, analysis and acceptance or mitigation of uncertainty in decisions. Overall, [COMPANY NAME] risk management policy highlights the importance of scanning for new risks, assessing risks on the likelihood and impact, developing risk response strategies, and identifying accountabilities for managing, reporting and monitoring risks.

[COMPANY NAME] follows a five-step risk management cycle for development projects and investments based on the Government of Canada’s Integrated Risk Management Policy, Treasury Board Secretariat guidance and international risk management standards (ISO 31000)i: Step 1: Identify and define risks ●

In this step, [COMPANY NAME] will scan the internal and external environment and identify the key risks that could affect the achievement of the expected outcomes.

[COMPANY NAME] will take into consideration the integration of environment, gender equality, and governance themes where relevant.

Step 2: Determine effect of risk on outcomes ●

[COMPANY NAME] will determine how the identified internal and external risks will affect the immediate, intermediate and ultimate objectives of the company.

Step 3: Identify risk responses ●

[COMPANY NAME] will provide a brief summary of the risk response approaches to be used to manage or prevent the identified risk event, ensuring that the risk responses are financially and technically feasible, and well-designed to reduce the impact and/or likelihood of the identified risks. The response will also be realistic in terms of timely implementation in reaction to needs and will be action-oriented and comprehensive.

Step 4: Assess level of risks ●

For each risk, [COMPANY NAME] will establish the residual risk level. Residual risk is the level of risk after risk responses have been taken into account. [COMPANY NAME] will state the level of likelihood that the risk will occur and its potential impact using the three-point scale.

Step 5: Monitor, update and report ●

As time passes, the project or investment’s context will likely change as will the risks to the achievement of expected results. Risks may disappear or shift, and new risks may

SG2X EMPLOYEE HANDBOOK POLICES

●

●

●

●

|

2

arise, which will necessitate adjusting risk definitions and the corresponding risk responses.

As such, [COMPANY NAME] will regularly review the risk analysis; risks will always be reassessed, and the corresponding consequences/responses updated if the operating context changes abruptly.

[COMPANY NAME] acknowledges that reviews do not necessarily require that the entire risk analysis be re-done from scratch, but a scan of the various elements (context, expected results, risks and responses, risk levels) will be conducted to ensure this information is current and fitting. Risk responses will also be tracked for effectiveness and adjusted when necessary.

Monitoring risks involves identifying whether the likelihood of each risk occurring, or its potential impact, is increasing or decreasing. If a risk trend proves to be unstable, [COMPANY NAME] will adjust the risk response(s) accordingly.

Aside from updating the risk analysis, [COMPANY NAME] will keep tabs on situations that could become risks to the initiative and bring forth this information in a timely manner.

It is important to note that this cycle is repetitive. Once Step 5 is performed, the process returns to Step 1. Regular monitoring (Step 5) must be conducted which could potentially lead to revisions of risks, responses and risk levels (Steps 1-4).

i

The language included in this section was sourced from Global Affairs Canada