1. Document Control

• Document Title: Risk Assessment and Management Policy

• Document Identifier: POL-ALL-011

• Version Number: v1.0

• Approval Date: <23 June 2025>

• Effective Date: <23 June 2025>

• Review Date: <23 June 2026>

• Document Owner: <Chief Risk Officer>

• Approved By: <Executive Risk and Compliance Committee>

2. Purpose

The purpose of this Risk Assessment and Management Policy is to define a consistent and structured approach for identifying, evaluating, mitigating, and monitoring risks that could affect the confidentiality, integrity, availability, and regulatory compliance of 's systems, data, and operations.

Risk management is a fundamental component of ’s governance framework, enabling informed decision-making and resource prioritization. This policy ensures alignment with ISO/IEC 27001:2022 Controls A.5.4–A.5.7 and SOC 2 Trust Services Criteria CC3.1 and CC3.2, both of which mandate organizations to assess and address risks systematically and proportionately.

3. Scope

This policy applies to all business units, processes, assets, and personnel that contribute to or are affected by 's information systems, products, or services. It includes:

• Enterprise, operational, and IT security risks

• Legal, regulatory, and reputational risks

• Vendor and third-party risks

• Physical and environmental risks

• Emerging threats (e.g., AI misuse, zero-day vulnerabilities)

All employees, contractors, and vendors involved in risk management activities must adhere to this policy and the associated procedures.

4. Policy Statement

shall maintain a formal Risk Management Program to:

1. Identify and document risks through regular assessments, audits, and threat intelligence.

2. Analyze risks by assessing likelihood and impact using a standardized risk scoring methodology.

3. Prioritize risks and assign treatment strategies: mitigation, acceptance, transfer, or avoidance.

4. Implement controls and track risk treatment plans to completion.

5. Monitor risk status and control effectiveness through ongoing reviews and metrics.

6. Review and update risk registers at least annually or after significant events, such as new threats, incidents, or major system changes.

7. Report significant risks and mitigation status to senior management and the Board.

Risk management activities must be documented, traceable, and integrated into the company’s broader compliance and business planning processes.

5. Safeguards

implements the following safeguards to enforce this policy: