Risk Management
Importance and Mission
The Company places a high importance on organizational risk management since it is essential to the organization's long-term viability. It is a tool that helps organizations in being prepared for current and future challenges. It also helps in strengthening security, reducing risks, and promoting confidence among all stakeholders.
SDGs in the Risk Management
Goals and Performance Highlights
Goals
Develop a comprehensive risk management system to support sustainable business operations aligned with organizational strategies.
Manage risks in alignment with economic, social, and environmental changes
Performance Highlights 2025
The Risk Management Committee oversees and reviews the Enterprise Risk Management (ERM) system in accordance with international standards.
Proactive risk identification, assessment, and management to strengthen enterprise-wide risk management.
Management Approach
The Company has set risk management policies for the entire organization following the enterprise risk management of the Committee of Sponsoring Organizations of the Treadway Commission (COSO ERM 2017) and the Thai Corporate Governance Code for Listed Companies - 2017. Additionally, anti-corruption measures have been implemented, with the Company Group receiving certification as a member of the Thai’s Private Sector Collective Action Against Corruption (CAC). This ensures that the Company Group manages risk effectively. The company has developed policies and risk management manuals to guide operations as follows:
01
Establish a clear risk governance framework and balance system for effective risk management. The Board of Directors has assigned the Risk Management Committee to establish the framework and risk management policies, as well as the risk management plan. The Audit Committee has been assigned to oversee and ensure that risk management follows the risk management plan and policies. The Risk Management Committee meets at least once a year, while the Audit Committee meets at least four times a year. The outcomes of meetings of both subcommittees are subsequently presented and discussed with the Board of Directors to communicate key risks and to link risk management with the internal control system. The Risk Management Committee met to review risks related to strategies, objectives, targets, and alignment with acceptable risks, and to provide recommendations on emerging risks on February 27, 2025.
02
Develop a risk management plan covering all aspects to achieve the vision, mission, strategic plan, and business plan. The organizational risks include: 1) strategic risks, 2) operational risks, 3) regulatory and compliance risks, 4) fraud and corruption risks, 5) financial risks, 6) emerging risks, and 7) ESG risks.
03
Promote a risk management culture to build understanding, awareness, and shared responsibility regarding risks, controls, and the impact of risks on the Company Group throughout the management and operations process.
04
Implement processes, guidelines, and measures for risk management of appropriate international quality, including continuous identification, analysis, evaluation, prioritization, management, control, monitoring, reporting, assessment, and communication of risk-related information across the entire Company.
05
In assessing and analyzing risks, measure both qualitative aspects such as the reputation and image of the Company, and quantitative aspects such as losses, revenue decreases, and expense increases with the consideration of the likelihood and impact.
06
Establish risk limits to confine potential damage within levels acceptable to the Company. Appropriate risk management measures (4Ts: Tolerate, Treat, Terminate, Transfer) are considered for each risk, and warning signs are defined to prompt actions if risks exceed the set limits.
07
Implement a Three Lines of Defense Model for effective risk management and control. In this case, internal control systems are defined across three lines: 1) First Line: all employees are responsible for their risk management, 2) Second Line: the management oversees operators and report to executives, managing directors, and the Board of Directors, and 3) Third Line: internal auditors review the first and second lines to ensure that internal control system are suitable for risk management.
08
Establish a Business Continuity Plan (BCP) to guide executives and employees in responding to future crises. The aims are to ensure continuous operations of the Company Group, protect stakeholder interests, maintain organizational reputation and credibility, and sustain business operations. The BCP plan is reviewed and updated annually based on drill results to ensure system recovery within the specified targets. The Board approved the BCP on July 7, 2024.
09
Implement written operating procedures to guide executives and employees. This is considered as the operational risks control.
The risk management policy and manual will be reviewed at least once a year or when changes occur that could impact the Company’s operations. The latest review was conducted on February 27, 2025, ensuring that the policies and manual are up-to-date, aligned with current conditions, and effectively applicable to reduce the likelihood of risks and help achieve business goals.
Risk Management Process
1. Governance
- The Board of Directors approves risk management policies to provide a framework for risk management, such as establishing a risk management committee and defining the risk management process.
- The risk management governance structure includes a risk management committee, consisting of experts with diverse specializations. The committee members play a crucial role in setting policies, reviewing, and overseeing the organization’s risks.
- All members of the risk management committee are company directors. A risk management working team and responsible units are appointed, operating independently from operational and internal audit departments, following the Three Lines of Defense Model.
- The risk committee charter is used to specify the scope, authority, duties, and responsibilities, such as promoting a culture of risk management, holding risk committee meetings to monitor risk status, and reporting performance to the Board of Directors.
- The risk management committee ensures that the risk management system is robust, appropriate, up-to-date, and efficient, complying with international standards.
- The internal audit unit is responsible for auditing and evaluating the effectiveness of the internal control and risk management systems, providing recommendations for system improvement, and reporting audit results to management and the Board of Directors.
Scope Authority Duty and Responsibility of the Risk Management
2. Strategies, Objectives, and Goals
The Company has integrated risk management into its strategy, objective, and goal-setting process, including context analysis, ESG materiality assessment, and stakeholder engagement. This ensures that strategic risks—such as expanding the business to new countries, achieving Net Zero targets by 2050, and sustainable community engagement—align with acceptable risk levels.
3. Risk Management Process
The Company identifies risks linked to its goals in various areas to evaluate their severity and prioritize them. Risk response measures are then established, such as investing in clean technologies, raising awareness through leadership and employee training, and collaborating with stakeholders.
4. Monitoring and Review
- The Company’s Risk Management Working Team, consisting of experts in relevant fields, plays a crucial role in coordinating with the management. They report on risk status, review performance, and assess risks. Additionally, they use Key Risk Indicators (KRI) for early warning signals, measuring risk management performance, and supporting strategic decision-making before analyzing, filtering, and presenting to the Risk Management Committee.
- The Risk Management Committee meets to review risks related to strategies, objectives, and goals, ensuring alignment with acceptable risk levels and providing recommendations on emerging risks. For instance, in 2025, meetings were held on February 27, 2025.
- The Company recognizes that continuous improvement in risk management must be consistently integrated into management and culture. This includes practices like root cause analysis and the use of KRI alongside performance outcomes.
5. Information, Communication, and Reporting
The Company places great importance on transparent communication and reporting of risk management results to build confidence and trust among stakeholders. This includes comprehensive risk management reports covering critical information, such as risk factors that may impact operations and risk management practices, ensuring stakeholders can clearly and fully understand the information. This approach integrates risk communication into promoting understanding, knowledge, and awareness among all involved parties.
Risk Management Culture
The Group is committed to building and fostering a strong risk management culture across the organization to promote understanding, awareness, and shared responsibility through a well-defined governance structure led by the Risk Management Committee and the Risk Management Working Team. The Group integrates Risk-Based Thinking into its management system in accordance with internationally recognized standards, including ISO 9001:2015, ISO 14001:2015, and ISO 45001:2018. In addition, Environmental, Social, and Governance (ESG) considerations and anti-corruption measures in accordance with the Thai Private Sector Collective Action Against Corruption (CAC) framework are incorporated into the Company's management approach, alongside employee capability development.
In 2025, the Group conducted a structured Enterprise Risk Review and organized practical workshops based on the COSO ERM 2017 & ESG framework. Employees from various functions participated in identifying, analyzing, and assessing the likelihood and impact of risks and opportunities. The Group also applied Key Risk Indicators (KRIs) to monitor risks and review mitigation plans to support effective risk management across the organization.
Risk Factors
The Company engages in the production and distribution of electricity from renewable energy sources, such as solar, wind, biomass, and other renewable energies, both domestically and internationally. These activities involve various risks that could impact the business. This document outlines risk factors based on current information and forecasts; however, there may be other risks beyond the Company’s control that could affect future performance. Therefore, the Company places importance on identifying, assessing, controlling, and regularly reviewing risk management measures.
The following risk information highlights some significant risks that could negatively impact the business. The Company may not be aware of other risks not listed or may consider certain risks currently insignificant but could become materially impactful. These risks could adversely affect the business, cash flow, operating results, financial status, and business opportunities of the Company and its subsidiaries.
For information referencing or related to the government or the overall economy of markets in Thailand and globally, the Company relies on disclosed data or copies of official documents or other credible sources. However, the Company does not verify or guarantee the accuracy of such information or the methods by which it was obtained.
Crisis Management and Business Continuity Management System
1. Importance
The Company recognizes and prioritizes business continuity management to handle unexpected emergencies or crises that may impact operations, such as fires, natural disasters, or cyber-attacks. The Business Continuity Plan (BCP) is designed to guide executives and employees in responding to future crises, ensuring the Company’s operations remain continuous, protecting stakeholder interests, maintaining the organization’s reputation and credibility, and sustaining business continuity.
2. BCP Management Process
2.1 Policies and Organizational Structure
The Board of Directors reviewed the Business Continuity Management Policy on November 12, 2025, to set management guidelines and raise awareness among all levels of personnel. The policy appoints a Business Continuity Management (BCP) Team, comprising members from various departments, such as Strategy, Finance, Engineering, Accounting, Operations, Human Resources, and Business Development, to take on specialized responsibilities while maintaining coordination.
2.2 Planning and Impact Assessment
The Company has analyzed business impacts to assess the risks of various events, considering both the potential impact and the likelihood of occurrence. These events include natural disasters, pandemics, security and reputation events, and personnel-related incidents. Timelines for recovery and restoration have been established to ensure a swift return to normal operations.
2.3 Crisis Response and Preparedness Approaches
The Company has established procedures for handling crises before they occur, during the event, and after returning to normal conditions. This includes an emergency call tree and detailed key business recovery strategies, along with designated responsible parties. Additionally, to ensure the BCP team can effectively handle crises, the plan mandates at least annual drills to monitor, share lessons learned, and improve responses to various threats.
3. Examples of Drill Activities
In 2025, the Group conducted 14 Business Continuity Plan (BCP) drills covering key scenarios such as fire, flooding, natural disasters, cybersecurity threats, pandemics, and disruptions to key service providers to help ensure that the Group can respond to incidents and restore business operations in a timely manner.
