Risk Governance

Banpu has a defined risk management structure that integrates the Board of Directors, management, and operational units to embed risk management into decision-making at all levels, in line with enterprise-wide risk management principles.

Risk management is overseen by the Audit Committee and ESG Committee at the Board level, and by the Risk Management Committee at the management level. These bodies continuously monitor risks and mitigation plan performance under our risk appetite framework, with regular Board reviews and approvals. When risks approach or exceed acceptable levels, reporting and mitigation measures are escalated accordingly.

At the operational level, risk management is governed by the Senior Vice President of Enterprise Risk Management, who is the executive responsible for implementing the risk management framework, policies, and processes across business units, as well as monitoring, assessing, and reporting significant risks and mitigation plan progress to management and relevant committees. Business executives serve as risk owners and are responsible for identifying, assessing, and managing risks across operations.

Banpu adopts the Three Lines Model: operational units and frontline employees serve as risk owners (First Line), risk management and relevant functions establish the enterprise-wide risk management frameworks, policies, and oversight (Second Line), and Internal Audit provides independent assurance (Third Line). This structure supports effective governance and risk management in line with international standards.

Additionally, the Company promotes risk and compliance awareness through training programs, e-newsletters, and employee engagement activities across all levels of the organization. As part of its improvement efforts, an internal audit of the risk management process is conducted every 2 years to ensure effectiveness and adherence to best practices.