Risk Management Policy 1
Purpose
The purpose of the Risk Management Policy is to embed a risk management competence across the entire Mercury enterprise. This Mercury group-wide capability provides a consistent method of identifying, assessing, controlling, monitoring, and reporting on existing and potential risks faced by the Mercury Group. The policy describes the Group’s approach to risk and risk management. All Mercury employees are responsible for managing risk in accordance with the Risk Management Policy.
2
Scope
This policy applies to all Mercury business activities, including subsidiaries and Mercury-controlled Joint Ventures (the Group).
3
Policy
Mercury has a consistent and systematic approach for managing risk across the Group. This approach aims to increase risk awareness; ensure the appropriate identification and management of risks; and make the business risk profiles transparent to allow for risk comparison and aggregation. Mercury maintains a risk management framework, overseen by the Risk Assurance Officer, which outlines the procedures applying under this policy. This framework includes Mercury’s risk tolerances (Risk Appetite Statements), risk classification methodology (Risk Matrix) and consistent risk recording. All parts of Mercury’s business are required to implement and use this common risk management framework. Mercury reviews the risk management framework annually. Proposed changes are assessed and endorsed by the Risk Management Committee and the Risk Assurance and Audit Committee before their final approval by the Board. Mercury accepts some commercial risks in order to achieve its strategic objectives and to deliver enhanced shareholder value. These are embodied in the Mercury’s Risk Appetite Statements, which are set and regularly reviewed by the Board. Mercury actively anticipates and manages risks, taking all reasonable measures to contain potential hazards in line with applicable risk tolerances. The external and internal risks facing Mercury are dynamic and always changing. In response, management proactively:
utilises experience across the Group through knowledge sharing;
deals with ambiguity, uncertainty and increasing complexity;
prioritises, makes decisions, and implements solutions on a timely basis;
communicates and reports on risks in a transparent and timely manner;
recognises and acts on opportunities as they occur;
works to ensure results despite changing business environments; and
fosters organisational resilience to deal with significant unforeseen events and impacts.
Risk management is integrated into all of Mercury’s strategic and operational planning, budgeting processes and day-to-day operations.
Risk Management Policy | Reviewed by Board of Directors | 14 May 2024| Page 1 of 2