Risk and Crisis Management

Our risk management process is developed based on ISO Standard 31000:2018. and consists of 6 key steps as shown below. The process are scalable – It can be applied at most levels within an organization.

PTTEP aims to integrate risk management into its business activities and decision-making which cover core business activities including products and services of PTTEP such as strategic planning management, investment and divestment decision-making, capital project management, operations and business process management including business continuity management, and ESG management. In addition, the Company implements risk management both in the corporate level and operational level to ensure that all key risks are managed in accordance with risk appetite, allocates necessary resources for managing risk in proportion to the level of risk and cost benefit consideration, and monitors the progress of risk mitigation plans together with Key Risk Indicators (KRIs) which serve as a tool for early warning for timely executing prevention activities and properly setting up additional mitigation measures.

Risk Management Process

1. Scope, Context, Criteria

PTTEP provides a foundation for understanding how risks may impact our operations and guides subsequent risk management activities. Establishing the scope, the context and criteria is the process to define the objectives and understand the external and internal business context. A common understanding of these points is the key to success in risk management.

2. Risk Assessment

PTTEP conducts comprehensive risk assessments covering Strategic & Portfolio Risks, Financial & Market Risks, Political and Legal/Regulatory Risks, Operational Risks, and Emerging Risks. We evaluate the levels of identified risks using criteria based on impact and likelihood:

Risk Rating Scale

PTTEP establishes common rating scales for two dimensions which are impact and likelihood to align understandings among relevant parties regarding how to measure as per the rating scales.

• Likelihood criteria : Llikelihood of some kind of risks is rated based on comparable occurrence to normal situation or experiences of risk owner. The degree of likelihood is subjective and possibly not in line with frequency probability but make sense in term of risk management. The 5-rating scale below provide brief criteria scale of likelihood.
  • Almost certain (5) : Event has occurred frequently in E&P industry OR occurred more than once per year at the same location OR is expected to occur in PTTEP.
  • Likely (4) : Event has occurred several times per year in the E&P industry OR more than once per year in PTTEP OR occurred at the same location OR is likely to occur in PTTEP
  • Possible (3) : Event has occurred several times in the E&P industry OR occurred once in PTTEP OR may occur in PTTEP
  • Unlikely (2) : Event has occurred few times in the E&P industry OR is unlikely to occur in PTTEP
  • Rare (1) : Event occurrence is remote and/ or never heard of in the E&P industry
• Impact category : PTTEP identifies 7 key categories of impact with 5-point rating scale to examine a level of severity. Impact is categorized as 1) Net Income/Net Present Value/Expected Monetary Value 2) People 3) Property damage 4) Project cost & schedule 5) Legal and compliance 6) Environment and 7) Image and reputation.

3. Risk Treatment

The process of risk treatment is developed to Take, Treat, Transfer and Terminate, in line with our risk appetite and tolerance levels.

4. Monitoring and Review

PTTEP continues monitoring risks and mitigation measures which are integral to our risk management process, ensuring that we remain vigilant to changing circumstances and adapt our strategies accordingly. In addition, we also review the risk exposure at least on a quarterly basis. This emphasis on agility allows PTTEP to promptly adjust its responses to incorporate newly identified risks with significant impacts, ensuring we are well-prepared to address risk in a timely, reasonable, and efficient manner.

Moreover, PTTEP conducts both internal audit and external assessment. From the last three years, Internal audit focused on Risk Management Process. In addition, PTTEP engaged independent expert to conduct ERM Maturity Assessment in line several global standards, including ISO31000 and COSO. The scope of the assessment covers Governance & Framework, Process, Culture, and Special Topics such as 3rd-party & partnership risk management. Risk Management Tool and Software and Business Continuity Management The maturity assessment results mostly range from Level 3 (Established) to Level 4 (Embedded).

5. Communication and Consultation

PTTEP ensures all employees are informed, engaged, and empowered to contribute to the success of the risk management program.

6. Recording and reporting

The risk management process and its outcomes shall be documented and reported through risk register tool and system. Risk report supports management and committee in meeting their responsibilities by ensuring that concerned parties can make decision, manage risks effectively and efficiently. Handling the sensitive risk information should be taken into account, but not be limited to their use.

To ensure all key risks are thoroughly and completely identified and effectively managed in accordance with the Three Lines Model, the risk management unit advises and works with the First Line Roles, which carry out their duties and concurrently manage risks as risk owners. The risk management unit also coordinates with other functions especially the Second Line Roles, which support risk management assistance in their own areas of expertise. One of them is a compliance unit which shall monitor regulatory changes that may cause new risks or change risk levels. The internal audit unit, in accordance with the Third Line Roles which is made up of audit functional unit and external auditors, is responsible for independently auditing the overall performance of various management systems under the First and Second Line Roles. This includes ensuring effective and efficient implementation of risk management and providing recommendations for continuous improvement. Furthermore, the risk management unit and the internal audit unit shall exchange information to ensure that key risks are identified and managed continually.

PTTEP integrates strategic risk management into the strategic planning process. This involves assessing strategies from a risk perspective to support the selection of strategies that align with and drive the achievement of the company’s objectives within an acceptable risk level. Strategic risk management also encompasses the ongoing monitoring and reporting of key strategic assumptions, as well as the progress of relevant situations, to evaluate whether the implemented strategies remain viable in a dynamic environment. Furthermore, the Risk Management Department closely monitors emerging situations that may affect the organization’s strategies and provides quarterly reporting to the management and relevant committees. This enables timely review, adjustment, or revision of strategies in response to changing circumstances.

In the process of corporate risk management, PTTEP considers both internal and external contexts that affect the achievement of the Company’s objectives and strategies and may cause risks with high impact at the corporate level, such as significant global events, audit findings, and Risk Management Committee and management concerns. Meanwhile, key risks that are identified and assessed by risk owners will be simultaneously considered to escalate with corporate criteria. All Corporate Risks will be consolidated to formulate our Corporate Risk Profile (CRP) for monitoring and reporting to the management, Management Committee (MC) and Risk Management Committee (RMC). If there is any significant change, it will be promptly alerted to all relevant committees for managing risks in a timely manner. In addition, emerging risks with potential impacts on future business operations are regularly monitored and reported.

PTTEP has successfully implemented and benefited from the web-based Risk Register System (RR System). The system enables risk owners to quickly identify and analyze risks and enhance risk information communication throughout the organization. It also helps the Company to easily consolidate and escalate key risks to Corporate Risks. In 2024, the Company enhanced the Risk Register system by introducing a strategic risk module, perspective on risks beyond those arising from work plan implementation. This improvement has enabled the Company to effectively manage risks and avoid any major issues (No Surprise Problems) due to unregistered risks and to allow all relevant parties to monitor the risk management anywhere and anytime promptly and conveniently. In addition, PTTEP continues to strive for more efficient and faster risk management including developing a Chat Bot to suggest risks and to search for complete risk information leads to manage risks that may arise as a problem and thus will affect the organization's goals.

In 2024, we leveraged a risk matrix to assess key threats to our organization. This matrix considered both the likelihood of a risk occurring and the potential impact it could have. Based on this analysis, we identified mitigation actions to ensure each risk falls within our acceptable risk tolerance level. Furthermore, this example demonstrates our ongoing commitment to proactive risk management through this cyclical process.

With the current situations, such as changes in business environment and advanced technology as well as the rising of stakeholder expectations regarding the Company’s regulations compliance and more intensive environmental impact mitigation measures, PTTEP, therefore, keeps monitoring situations and assessing emerging risks that may affect the Company’s business operations in the future and report to the management and relevant committees in order to follow up and update risk mitigation plans as well as to adjust corporate strategy efficiently. These would also enhance our competitiveness and create an opportunity to continue our business with sustainable growth.

Based on the enterprise risk factors, PTTEP has identified emerging risks. Hence, the prioritization of these emerging risks is based on the existing risk factors. Currently, PTTEP has identified and keeps monitoring emerging risks as follows.