Risk Management Philosophy

The Board acknowledges that risk management provides strong support and basic guarantee for the high-quality and sustainable development of the Group. The Board regards risk management as proactive measures for creating corporate efficiencies, and thus it vigorously promotes risk management responsibilities of the Board, management and all staff members as well as its entire business system.

The Board has established a risk management structure by adopting the “Three Lines Model” for the Group which was published and updated by the Institute of Internal Auditors (the “IIA”), under which the Group has integrated risk management with its strategic goals and has formed its risk management practice to be “Comprehensive, Focused, Dynamic and Continuous”.

At a strategic level, the Board regularly studies and clarifies the comprehensive risk indicator system in monitoring material risks associated with the Group’s businesses through the Risk Management Committee. At an operational level, the Group has also taken a dynamic approach to set up key risk checkpoints based on the internal and external changes of the Group, implemented major risk prevention in all aspects and ensured management bears their responsibilities in relation to dynamic monitoring of ongoing risk management and control during daily operating activities. The Board plays a leading role for building a “Prudent, Progressive and Responsible” risk management culture of the Group.

Risk Management Committee

The Risk Management Committee is delegated by the Board with responsibilities to oversee the Group’s overall risk management structure and to advise the Board on the Group’s risk-related issues. The Risk Management Committee is also responsible for approving the Group’s risk management policies and assessing the effectiveness of the Group’s risk controls. For information on work highlights 2022 of the Risk Management Committee, please refer to the “Risk Management Committee Report” set out in this annual report.

Risk Management Framework

Based on the standards regarding the risk management framework of the Committee of Sponsoring Organizations of the Treadway Commission (including standards being updated from time to time) and the latest ISO31000 Risk Management Guidelines for internal control and risk management, the Group has established a risk management framework closely following the “Three Lines Model” published and updated by the IIA.

Source: The IIA’s Three Lines Model — An update of the Three Lines of Defense (July 2020)

An important feature of the updated new Three Lines Model is the shift of the emphasis from value protection and risk reduction to value creation and contribution to the achievement of strategic objectives. This perspective suggests a more proactive role for risk management in identifying opportunities in emerging risks to be seized and exploited for potential future growth and for business decision-making. The Board believes the updated model will better facilitate the Group’s strategic development in attaining its corporate goals.

The Three Lines Model is more principle-based with greater focus on the importance and role of governance and clarity of roles and responsibilities. It is supported through three components:

1. Governing body (the board and its sub-committees) which is responsible and accountable for the stakeholders.
2. Management (the first and second line roles) which is responsible for actions to manage risk and achieve organizational objectives.
3. Internal audit (the third line roles) which is responsible for providing independent assurance.

The roles of three lines are as follows:

• First line: Business risk management — This group provides control self-assessment during the course of business activities. Each of the operational departments and business units, as well as personnel holding the respective business position, shall be the first response unit for handling matters within their terms of reference for risk identification and management.
• Second line: Supervision and support for risk management — This group provides the policies, framework, tools, techniques, and support to enable risk management and compliance in the first line. They include the departments responsible for the functions of internal audit, legal affairs, compliance, finance, human resources, information technology, safety and environmental protection monitoring, shall assist the front-line business departments to assume joint responsibilities for overseeing, inspecting and evaluating the effectiveness of those works relating to the implementation of risk management.
• Third line: Independent assurance — The internal audit function that sits outside the risk management processes of the first two lines. Its main roles are to ensure that the first two lines are operating effectively and to advise on all matters relating to the achievement of objectives. The Group’s Internal Audit Department and Supervision Department shall be responsible for auditing the results of the risk management works and issuing an independent audit report and supervisory report.

In 2022, in conjunction with the post-pandemic risk management, the Group, in collaboration with all business departments, continued to carry out scheduled annual major risk prevention and mitigation works and risk assessment, prevention and control for major decision-making so as to ensure the management of major risks through coordination of joint management and joint prevention, and to continuously integrate risk management awareness and concepts into the business operation. In addition, the Group’s Audit Center has made use of big data to commence the standardized development of audit, risks and internal control procedures, thereby optimizing the Group’s risk management network. During the year, the Group also established a database of approved organizations providing risk assessment consultancy services for onshore investment projects to ensure prompt response to consultancy needs and to improve the quality of assessments.

Risk Management Mechanisms and Procedures

Having concluded from the practical experience for a long period, the Group has developed a set of risk management mechanisms and procedures that operates steadily, which mainly comprises (i) comprehensive risk management, (ii) targeted risk management for major investment projects, and (iii) specific risk management targeting key risk areas.

(i) The procedures of comprehensive risk management are as follows:

• Phase 1: Formulating risk management policies, strategies and risk assessment standards — The Board shall determine risk policies in respect of the Group’s governance, culture and development strategies, and shall take these policies into consideration when determining its business targets. The Risk Management Committee shall be entrusted by the Board to determine the risk management strategy of the Group, while the Group’s Internal Audit Department shall establish common risk assessment standards and set up the risk score sheet for the Group.
• Phase 2: Comprehensively collecting first-hand information for risk management and risk identification — Each department/business unit shall extensively and continuously collect internal and external information in relation to risks of the Group and risk management thereof and identify potential risks that may have an impact on the key processes of their operations.
• Phase 3: Conducting risk assessment and establishing comprehensive risk management ledger — Each department/business unit shall assess and score risks identified along with their impact on the business and the likelihood of their occurrence. All risks of the Group and its subordinated units shall be recorded in the risk management ledger.
• Phase 4: Risk follow up treatment as well as tracking and update of risk management ledger on a quarterly basis — Based on the assessment, each department/business unit shall propose measures for monitoring and treatment of risk identified and determine the responsible person for the risk. All this information shall be fully recorded in the risk management ledger and updated on a quarterly basis to ensure risks are controllable.
• Phase 5: Risk reporting and monitoring — Each department/business unit shall monitor their own risk mitigating works and summarize and report the comprehensive risk management condition to the Risk Management Committee bi-annually, so that it can keep abreast of the distribution and changes of comprehensive risks on a continuous basis, evaluate the effectiveness of the risk management works and recommend measures for improvement. The Risk Management Committee submits the “Risk Management Report” and the “Sustainability Report” to the Board annually.

 

(ii) The risk management procedures targeting major investment projects are as follows:

• Project Initiation and Feasibility Study Stage: Business departments and all supporting departments for risk management shall conduct work such as feasibility study and due diligence for their investment projects, so as to fully identify and assess the risks of the investment projects and the risk cost thereof, and put forward strategies and measures against material risks.
• Investment Decision Stage: Before making investment decisions, the relevant departments shall prepare the risk assessment report for specific projects based on the feasibility study and the due diligence report with a view to disclosing the risks of the investment project and the impact of the risk factors, and recommend preventive measures.
• Construction Stage: The relevant departments shall conduct risk analysis on the conditions for commencement of construction, including analysis on compliance risks relating to aspects such as land, environment and energy conservation, technical risks relating to the construction design plan and risks relating to construction management, etc. Construction work will only be commenced after establishing feasible responsive measures and passing the compliance evaluations.
• Management through closed-loop tracking: A closed-loop tracking mechanism will be implemented for the risk analysis and evaluation conclusion for each of the above stages to ensure all risks are controllable and under control.

 

(iii) The specific risk management procedures targeting key risk areas are as follows:

• Identification and selection of key risk areas: The management shall hold regular meetings to identify new, non-traditional and typical risks arising in the course of strategic development of the Company, and commence specific risk assessment on such area.
• Commencement of specific risk investigation, research and assessment: Prior to the assessment, the functional departments shall collect data, determine risk checkpoints, verify and identify risks on-site and discuss with the business management departments (brainstorming). The identified risks shall be quantified and a risk management ledger shall be established according to risk level. Responsive measures shall be formulated against such risks based on the risk strategy.
• Compilation of risk assessment report and put forward management advice: The risks assessed and responsive measures thereof shall be submitted to the relevant business management department for consideration and review. The relevant business management department shall put forward management advice for responsive measures relating to high-and mid-level risks, formulate risk assessment and management report upon discussion with the functional departments, and provide guidance to the responsible business unit to commence its risk management works.
• Management through closed-loop tracking: Risk checkpoints identified through the specific risk assessment shall be included in the risk management ledger. Through the integration of specific monitoring and dynamic monitoring, comprehensive tracking and prevention of risks shall be in place, and various requirements relating to risk management and control shall be incorporated into corporate management and corporate procedures.

 

(iv) Other regular risk management procedures

• Information system security: The Group shall conduct specific risk assessments in such areas as network security, financial sharing system, and information confidentiality on an ongoing basis and put forward detailed management advice from time to time, thereby ensuring the risks are controllable and under control. Meanwhile, it shall continue to develop the information platform for compliance management. Information technology shall be used to manage the compliance review and assurance procedures for decision-making, contract execution, procurement and capital management.
• Risk management responsibility appraisal: The Group shall require all business units to establish a comprehensive risk management responsibility system and fulfill their risk prevention and mitigation responsibilities. The Group shall incorporate all risk control requirements into its management and operation procedures while including risk management responsibilities as a factor in annual performance appraisal, with the aim of raising the risk prevention awareness of all business units and encouraging them to plan for and implement risk prevention measures proactively.

 

During 2022, focusing on the Group’s strategic vision of becoming a “World-class Green and Low-carbon Energy Provider” and the mission of “Lower Carbon Empower Better Life”, the management, the Risk Management Committee and the Board have identified five major risks of the Group upon risk assessments based on the changes in recent and mid- to long-term internal and external conditions, including market risks, supply chain risks, financial risks, risks relating to green transformation and innovative development, and risks relating to the compatibility between operational control and management mechanisms and transformational development. Details of the relevant risks are as follows:

Rating of the identified risks: HighMiddleLow