At HMCL we maintain a robust, three-tiered governance structure to ensure that risk management is both comprehensive and objective.

This risk governance structure ensures the strategic, enterprise-level integration of business functions by proactive identification and detailed assessment of potential risks, followed by the development and implementation of effective mitigation strategies. Continuous monitoring is then performed to guarantee the ongoing effectiveness of these mitigation actions.

We are in the process of establishing our Risk Appetite to systematically assess and delineate the level of risk that our organization is willing to undertake in pursuit of its strategic objectives. This approach is under development to evaluate the potential impact and probability of each identified risk, which will enable us to define precise tolerance levels.

Risks that pose an immediate and substantial threat to our operations or reputation will be assigned a low tolerance level, while risks integral to achieving our long-term strategic growth and innovation will be assigned a medium to high tolerance level, reflecting our considered willingness to embrace a greater degree of risk in these critical areas.

Risk Appetite thresholds are key to facilitating informed decision-making and prioritizing risks effectively. By ensuring that risk management strategies are aligned with the organization’s overarching strategic goals, we can optimize our overall risk management and mitigation efforts. This approach empowers us to strike a necessary balance: managing potential adverse consequences while capitalizing on opportunities, thereby undertaking the appropriate level of risk needed to achieve our objectives.

We will categorize the Risk Appetite for identified risks into five qualitative levels (Very Tolerant, Tolerant, Moderate, Averse, and Zero) aligning with quantitative Risk Tolerance levels (Most Probable: 25%-<50%, Probable (10%-<25%), Possible (5%-<10%), Occasional (2%-<5%), and Rare: <2%) for a consistent evaluation.

The established Risk Tolerance levels will be used as a benchmark to assess the potential impact and severity of all identified risks. This evaluation will detail the probability of an event occurring and will be conducted at both the inherent and residual risk levels.