1. Document Control

• Document Title: Risk Assessment Procedure

• Document Identifier: PRC-ALL-001

• Version Number: v1.0

• Approval Date: <24 June 2025>

• Effective Date: <24 June 2025>

• Review Date: <24 June 2026>

• Document Owner: <Chief Risk Officer>

• Approved By: <Enterprise Risk Management Committee>

2. Purpose

The purpose of this procedure is to define a structured and repeatable approach for identifying, evaluating, and managing risks that could impact the confidentiality, integrity, availability, or compliance posture of . Conducting periodic and event-driven risk assessments enables proactive mitigation of threats to the organization’s assets, operations, and stakeholders.

This procedure aligns with SOC 2 Trust Criteria CC3.1 and CC3.2, which require entities to identify, assess, and respond to risks related to their objectives. It also conforms to ISO/IEC 27001:2022 Control A.5.4, which mandates the implementation of risk assessments to guide decision-making and control selection.

3. Scope

This procedure applies to all departments, business units, and technical environments across , including third-party services and cloud-based infrastructure. It encompasses operational, strategic, information security, compliance, reputational, and financial risks.

The procedure is mandatory for all risk owners, system owners, and department heads responsible for services, assets, or operations under 's control. External vendors with access to sensitive data or systems may also be required to participate in risk assessments.

4. Policy Statement

shall perform formal risk assessments at least annually and upon significant change events, such as:

• Introduction of new systems, vendors, or services

• Organizational restructuring

• Regulatory changes or breach events

• Launch of new products or technologies

The risk assessment process must include:

1. Risk Identification – Documenting threats and vulnerabilities across business processes and assets.

2. Risk Analysis – Evaluating likelihood and impact using a standardized scoring model.

3. Risk Evaluation – Prioritizing risks against risk tolerance levels and organizational objectives.

4. Risk Treatment – Determining appropriate actions: mitigate, transfer, accept, or avoid.

5. Documentation – Logging all findings, risk decisions, and action items in the central Risk Register.

6. Review and Monitoring – Regularly tracking risk status, effectiveness of controls, and reassessment needs.

5. Safeguards