2.4. Care should be taken to minimise the risk of any conflict of interest that might be seen to give rise to an unacceptable influence.

Transcription

1 Terms of reference Operational Risk Committee Reference to the Committee shall mean the Nomination Committee. Reference to the Board shall mean The Board of Directors. 1. Purpose 1.1. The purpose of the Committee is to provide governance and assessment of the risk management policies both in place and required by the business; systematically monitoring the scale of operational risks facing the business over time, and, overseeing risk mitigation performance and prioritisation related to the resolution of potential risks based upon agreed risk criteria set out in the Risk Management Policies. 2. Membership, attendance and authority 2.1. The Committee shall be appointed by the Board, on the recommendation of the Nomination Committee in consultation with the Chairman of the Committee, to assist the Board in fulfilling its operational risk management responsibilities and shall comprise of two Board Directors, one of whom must be an independent nonexecutive director The Committee will appoint a Risk Manager and Deputy Risk Manager from within the Group that will be responsible for the collation, reporting and escalation of operational risks to appropriate line management and the Committee. The Risk Manager will also be accountable for the communication of policies and education of employees and partners in regard to best practice and expectations The Committee may ask the Executive Management and any relevant senior operational management to attend meetings either regularly or by invitation, but the invitees have no right of attendance Care should be taken to minimise the risk of any conflict of interest that might be seen to give rise to an unacceptable influence The Board shall appoint the Committee Chairman who shall be an independent non-executive director. In the absence of the Committee Chairman and/or an appointed deputy, the remaining members present shall elect one of their number present to chair the meeting The Committee is authorised by the Board to investigate any activity within its terms of reference and to seek any information that it requires from any employee of the Company. The Committee is authorised to obtain outside technical or independent professional advice, at the Company s expense, if it considers this necessary Membership of the Committee is for an initial term of no longer than three years. The initial term may be extended by no more than two additional three year periods Relevant training in risk reporting and related company obligations is available to members of the Committee if requested or required.

2 3. Secretary 3.1. An appropriately skilled employee of the company shall be appointed to act as the Secretary of the Committee. 4. Quorum 4.1. The quorum necessary for the transaction of business shall be two Directors and the Risk Manager or their authorised deputy. A duly convened meeting of the Committee at which a quorum is present shall be competent to exercise all or any of the authorities, powers and discretions vested in or exercisable by the Committee. 5. Frequency of Meetings 5.1. The Committee shall meet quarterly and at such other times as the Chairman of the Committee shall require Meetings will be arranged at appropriate times to support the formal reporting cycle and otherwise as required Meetings of the Committee can be requested by the external or internal auditors if they consider one is necessary to support their financial risk management processes. 6. Notice of Meetings 6.1. Meetings of the Committee shall be summoned by the Secretary of the Committee at the request of any member thereof Unless otherwise agreed, Notice of each meeting confirming the venue, time and date together with an agenda of items to be discussed, shall be forwarded to each member of the Committee, any other person required to attend and all other non-executive directors, no fewer than 5 working days prior to the date of the meeting. Supporting papers shall be sent to Committee members and to other attendees as appropriate, at the same time. 7. Minutes of Meetings 7.1. The Secretary shall minute the proceedings and resolutions of all meetings of the Committee, including recording the names of those present and in attendance The Secretary should ascertain, at the beginning of each meeting, the existence of any conflicts of interest and minute them accordingly Draft minutes of Committee meetings shall be circulated promptly to all members of the Committee. Once approved, minutes shall be circulated to all other members of the Board unless it would be inappropriate to do so. 8. Annual General Meeting 8.1. The Chairman of the Committee shall attend the Annual General Meeting prepared to respond to any Shareholder questions on the Committee s activities. 9. Duties

3 9.1. The Committee should carry out the duties below for the parent company, major subsidiary undertakings and the Group as a whole, as appropriate Risk Rating, Policy Approval and Reporting Requirements: The Committee will review and approve the Risk Management policies of the company, including but not limited to the grading and prioritisation of risks, the registration and management of known risks, the reporting on risk management progress and the method for validating risk mitigation effectiveness The Committee shall monitor the integrity of the operational practices and fitness for purpose of systems, procedures and risk mitigation strategy of the Company, including where appropriate providing commentary and advice to Internal and External Auditors, and supporting the public reporting requirements in the form of annual and half-yearly reports, interim management statements, and any other formal announcement relating to its current or future operational performance In particular, The Committee shall review and challenge where necessary the sustainability of customer facing and business operations that would impact market reputation, financial performance, liability and /or the credibility of Outsourcery Risk Awareness and Prevention Policy The Committee will establish the requirements for education and operational practice in regard to risk mitigation, and through its appointed Risk Manager, will promote a proactive risk-awareness approach throughout the organisation. In particular, the Committees actions should focus the executive management to: Improve internal risk awareness, severity assessment and risk transparency; Identify, control and monitor all major risks in an appropriate way; Ensure updates on operational KPI s and aggregate risks through a risk inventory based approach, using reliable management information on the company s overall risk situation Set and review the actions of management in the mitigation of agreed risks Enable employees to swiftly identify and raise issues of concern in regards to risk management practice or potential vulnerabilities Independent Assessment of Adequacy: The Committee shall require the business to document, and periodically demonstrate and evidence the effectiveness of technical and operational risk management solutions, policies and practices to ensure that the business maintains itself in a state of proactive readiness to identify and understand risks on a timely basis in support of Service Level Agreements and contractual

4 obligations, and successfully invoke mitigation plans as commercially appropriate to minimise the impact of any incident upon the long term success of the business Such evidence may require third party independent testing which shall be conducted on instruction of The Committee in addition to that carried out in the day to day management of the business (e.g. N+1 infrastructure failover testing, application availability testing, Penetration testing, DDoS mitigation, data security and Business Continuity testing etc) Qualification Notes The Committee is a proactive strategic committee and is not intended to replace executive management responsibility and accountability for the day to day operational execution of risk management actions or enactment of business continuity processes in the event of an incident.

5