Risk Management Statement

Bursa Malaysia's comprehensive risk governance structure establishes clear responsibility for risks and ensures reasonable assurance to the Board that business risks are explicitly identified and managed. It is premised on three lines of defence comprising:

• the risk taking divisions acting as the 'first line of defence' and have primary responsibility for managing specific risks assumed by them in their day-to-day operations and ensure that controls and processes are consistent with our risk management framework, corporate policies and practices;
• the RMC assisted by the Corporate Risk Management (CRM) Division as the 'second line of defence' conducts risk oversight and supports the risk policy and framework; and finally
• in the 'third line of defence', the AC assisted by Group IA provides assurance for Bursa Malaysia's identification and management of risks, adherence to internal risk management policies and guidelines and compliance with risk-related regulatory requirements.

This risk governance structure also includes a Risk Management Policy approved by the Board. This Policy and subordinate risk management guidelines, procedures and standards are continually reviewed and enhanced to ensure they provide effective governance of our risk-taking activities. Supplementing the above are risk awareness briefings to ensure staff understand the framework, requirements and expectations and possess the requisite knowledge and skills to effectively manage risks. Management also assesses the adequacy of their risk management through "control self assessment" sessions and provide individual assertions to the CEO on their accountability and responsibility for managing risks under their purview.

A web-based ERM System was implemented this year to facilitate and enhance risk reporting and monitoring. Risk Champions, Risk Facilitators and other relevant staff were trained to use the system. Such training on the use of the system for risk reporting purposes will be a continuing process.