RISK MANAGEMENT POLICY AND PRINCIPLES 1 (17) Board of Directors 20 January 2011 RISK MANAGEMENT POLICY Orava s goals and tasks of the Risk management The central short-term goal of Orava is to distinctly improve the profitability and competitiveness and to secure the financial position of business demands. The primary task of Orava s risk management concept is to support the realisation of these goals. As part of corporate governance, risk management is a systematic tool for the Board of Directors and the operative management to monitor and assess the realisation of the goals, threats and opportunities affecting the company operations. The task of Orava s risk management is also to support in adapting to the changes in business and risk environment. Principles of risk management Risks are factors that threaten the company in reaching its set goals. They are measured by their impact and the likelihood of them occurring. The business units and the support functions identify and assess their risks. Risk management is a continuous process, which is integrated in the corporate strategic process, operative planning, daily decision making and monitoring operations. Risk management is also part of the internal control system. Orava only considers taking risks after careful assessment of the risk in relation to its gain. The aim of risk management is to systematically identify and evaluate risks and to manage them in a cost-effective way by: Ensuring that all identified risks affecting personnel, customers, products, reputation, property, intellectual property and operation are always managed as required by law and otherwise in accordance to best knowledge and justifiable taking into consideration the prevailing financial situation. Fulfilling the expectations of stakeholders (owners, customers, personnel, suppliers and the community) Securing the management of the total risk exposure and minimising the total risk Secure continuous operation without interruptions Promoting the effective utilisation of possibilities and profit potentials
RISK MANAGEMENT POLICY AND PRINCIPLES 2 (17) Roles and responsibilities Board of Directors monitors and is responsible for ensuring that the Orava risk management process functions and is comprehensive. Defines the risk bearing tolerance continuously, according to the current conditions. Operative management responsible for achieving the set goals and controlling and managing risks that threaten them. The operative management is committed to fully support the implementation of the risk management work, and to ensure the performance of the risk management process and the availability of sufficient resources. Risk management (part of Finance and administrative function), - supports the management and the business units in implementing the risk management policy. Responsible for instructions and advice to the units, and monitoring the practical implementations of the process. Business units and support functions - identify and assess, within their area of responsibility, the significant risks in their planning processes and prepare themselves accordingly and take necessary corrective measures, as well as report in agreed manner. Reporting Based on the significance of the risks and goals, the risks and the efficiency and results of risk management activities are reported to the operative management quarterly, and the Board at least once a year. Confirmation and review of the risk management policy Orava s Board of Directors has confirmed this risk management policy. The risk management policy is reviewed annually to ensure that it corresponds to the current conditions and changes that have occurred in the business environment. The main principles and responsibilities have been presented in detail in the following Orava Risk Management Principles.
RISK MANAGEMENT POLICY AND PRINCIPLES 3 (17) Index RISK MANAGEMENT PRINCIPLES 1. Preface 4 2. Concept of risk 5 3. Risk environment 6 4. Concept of risk management 7 5. Risk management process 8 6. Structure and responsibilities of risk management 9 7. Risk evaluation and risk treatment 10 8. Risk tolerance / level and decision-making 11 9. Risk reporting (internal and external) 12 9.1 Internal reporting 12 9.2 External reporting 12 10. Special risks / project risks 13 11. Responsibilities of risk assessment, risk transfer and loss prevention 14 11.1 Acquisitions of Real Estate Property 14 11.2 Financial Risk Management 14 11.3 Delegation of Authority and Procurement rights 15 11.4 Data security 15 11.5 Physical security 15 11.6 Personnel-related security 15 12. Concluding remarks 175
RISK MANAGEMENT POLICY AND PRINCIPLES 4 (17) 1. Preface Risk management is an essential part of Orava s strategic and operative planning as well as a daily decision-making process and internal controls. The major changes in our business environment have also lead to significant changes in the risks we face. The focus of risk management has changed from traditional hazard risks to the comprehensive and systematic examination of risks concerning the entire business environment. The comprehensive identification, assessment and effective treatment of critical and relevant risks are essential from both our own and our stakeholders point of view. It is a prerequisite for functioning corporate governance that Orava s risk management is implemented systematically, comprehensively and reliably. Companies at the forefront of this highly competitive environment are those who can control risks and are better prepared than their competitors. In addition, a company s capability to take advantage of business opportunities better than their competitors is an asset in this competitive environment. The purpose of this document is to confirm Orava s risk management principles and responsibilities. Orava s CFO is responsible for updating this document. Board of Directors will review and confirm this document on a yearly basis.
RISK MANAGEMENT POLICY AND PRINCIPLES 5 (17) 2. Concept of risk Risks can be perceived from company s point of view as uncertainties, threats or opportunities. Traditionally, a risk is defined as a threat of loss i.e. the probability of an unwanted incident. Risks can be grouped differently, based on several criteria: Emergence of risks; internally or external to a company Effect of risks; direct or indirect Object of the risk; property, operative performance, financing etc. Economical or other consequences Probability of occurrence Time Horizon The risks, if realized, can cause deviations to set business goals and jeopardize the implementation of the strategy. The occurrence of major risks can have a negative effect on the shareholder value and, in the most adverse situations, threaten the entire continuity of business operations. However, basic business activities are a premeditated appetite for risks and are thus a normal part of any business. Deliberate and conscious appetite for risk can provide the possibility to achieve the set goals and implement the strategy in most cost-efficient manner i.e. risks also represent a clear potential for a profit. Time horizon of risk assessment is mainly 5-10 years.
RISK MANAGEMENT POLICY AND PRINCIPLES 6 (17) 3. Risk environment The risks affecting our business activities can be categorised as: strategic, operational, finance and hazard risks; they can result from factors both external and internal to the organisation. Some specific risks can have both external and internal drivers. Orava uses the following grouping of risks: 1. Strategic risks (Internal & External) Examples: - Strategic objectives are not achieved - Chosen strategy is not effective - Customer/Demand factors are not interpreted right - Competitor s actions 2. Business risks - Focus is on wrong customers/customer groups - Price structure is not effective - Product portfolio is not right 3. Operational risks (process, HR, IT) Examples: - Processes are not effective - HR processes are not effective - Information systems do not provide adequate data for decision making 4. Financial risks Examples: - Liquidity risk - Foreign exchange risk - Volatility of real estate valuations 5. Hazard/Event risks Examples: - Fire - Work safety violations
RISK MANAGEMENT POLICY AND PRINCIPLES 7 (17) 4. Concept of risk management Risk management is a systematic and continuous activity, which identifies, assesses and controls the risks affecting the company by reducing, avoiding or transferring the adverse economical or other consequences of the risks. Risk management is a tool for the Board and operative management to systematically examine and anticipate threats, possible loss and any positive aspects that might result. By using the tool, the company will be able to prepare itself for all possible outcomes in the most appropriate way. By applying systematic risk management practices, the approved risk levels are determined and compliance with them monitored. The ratio of risk costs and risk control costs should be optimized, given the prevailing circumstances. Risk management is a comprehensive and continuous process of its own and part of the company s strategy process, operative planning and daily decision-making.
RISK MANAGEMENT POLICY AND PRINCIPLES 8 (17) 5. Risk management process Risk management process, comprising different sub-processes, is a continuous systematically proceeding assessment and controlling tool, which supports both the company s planning and strategy process and the management system. Risk management process is a tool for management and owners to evaluate and manage both short term and long term risks in a holistic way that supports the achievement of company s strategic objectives. Orava s Risk management process is linked with Orava s goals, strategy and governance, and is a continuous process and includes at the following steps: - Setting targets for risk management and defining the principles and the process - Identification of key targets - Risk assessment (Identification, measurement, cause and consequence analysis) - Decisions/actions regarding risks (action plan to reduce, eliminate, transfer, benefit ) - Follow-up and reporting of risk management activities
RISK MANAGEMENT POLICY AND PRINCIPLES 9 (17) 6. Structure and responsibilities of risk management Body / Function Board of Directors CEO and Executives CFO Business units, support functions Responsibility Monitors and responsible for ensuring that the Orava risk management process functions and is extensible. Confirms the risk management policy. Defines the level of risk bearing / risk tolerance and re-evaluates these on a continuous basis, as part of the company strategy and target setting. Responsible for achieving the set goals and controlling those risks that threaten them. Responsible for risk management process, allocating adequate resources to the risk management work and reviewing and confirming the risk management principles. In charge of risk management. Responsible for continuous development of risk management process, defining operating principles and overall process. Plans, coordinates and develops the risk management process. Responsible for the implementation of the risk management process. Evaluates the result of risk reporting. Prepares a summary based on the evaluation for the CEO and the Board of Directors. Identify and assess risks within their own area of responsibility. Make suggestions on how to manage risks. Reports in accordance to agreed guidelines and time schedules. Reporting To owners in line with strategy reporting and annual financial statements To Board of Directors in board meetings at least each December To Chairman of the Board/CEO in each quarter To CEO/CFO in each quarter
RISK MANAGEMENT POLICY AND PRINCIPLES 10 (17) 7. Risk evaluation and risk treatment Risks are estimated by determining the probability and consequence for every risk, by using a scale of 1-4: The consequences of the risks should be stated in euros. It can, however, be difficult or even impossible to measure some risks in terms of money. The scope of time as examining the risks is the strategic planning period.
RISK MANAGEMENT POLICY AND PRINCIPLES 11 (17) 8. Risk tolerance / level and decision-making The board decides on the company s risk tolerance. The company s risk tolerance is defined at regular intervals based on several elements, and the situation at stake at each specific moment. The following should be assessed and taken into consideration when defining the risk tolerance: Impact on equity ratio and other critical key figures Impact on the shareholder value Impact on the image Legal impacts Impact on safety level etc. Ratio between potential loss and profit
RISK MANAGEMENT POLICY AND PRINCIPLES 12 (17) 9. Risk reporting (internal and external) 9.1. Internal reporting Business units and named support functions include risk analysis as a part of their annual business planning and strategy processes; operative management monitors this. Risk analysis is also a part of the daily decision making process and the short-term planning. Risk analyses and evaluations are carried out as self-assessments. The development of risks, changes in the risk environment and measures to control the risks are reported to the operative management every quarter. 9.2. External reporting Orava reports on its risk management, key risks and changes in the risk situation: Always in compliance with the Companies Act Always in accordance with good Corporate Governance In the Annual Report In compliance with local press release practices At financing and investment meetings Otherwise when required CEO is responsible for external risk management reporting in collaboration with the Executives and in compliance with the agreed guidelines.
RISK MANAGEMENT POLICY AND PRINCIPLES 13 (17) 10. Special risks / project risks At Orava, special attention is paid to comprehensive risk management regarding special and project risks during the different stages of an important project. We prepare ourselves for risks according to the following list - Agreement negotiations with international banks - Agreement negotiations with institutional investors - Investment projects - M&A - Etc.
RISK MANAGEMENT POLICY AND PRINCIPLES 14 (17) 11. Responsibilities of risk assessment, risk transfer and loss prevention The main principles are that: The Executives or the operational management are responsible for the strategic risks as well as for associated risk assessment and risk transfer. The business units / support functions are always responsible for their own operational risks and for loss prevention, unless other procedures have been agreed upon. The business units are especially responsible for real estate assets and their fire protection, environmental protection, work safety etc. CFO is especially responsible for HQ s fire protection, environmental protection, work safety, general security (including information security) and business interruption risks. Risk transfer, by means of insurance, is primarily used in hazard risks. 11.1. Acquisition of Real Estate Property Risk management in property acquisitions, responsible: Board of Finance To be defined. 11.2. Financial Risk Management Risk management in finance, responsible: CFO To be defined. Group cash reserves, responsible: CFO Orava invests part of its cash reserves in short-and long-term European bond funds and stock funds. Cash reserves are allocated to different funds according the Cash Reserve Investment Policy approved by the Board of Directors.
RISK MANAGEMENT POLICY AND PRINCIPLES 15 (17) 11.3. Delegation of Authority and Procurement rights Responsible: CEO / Procurement Manager A version of Delegation of authority and procurement rights for Orava is to be defined soon and to be approved by the Board of Directors. The compliance with these rules will be principally monitored by Executives. 11.4. Data security Responsible: IT Manager The description of risk management procedures concerning data security are to be defined. 11.5. Physical security Responsible: Asset manager, CEO, Boards of directors of residential To be defined. Responsible for Office: Administration manager CFO is responsible for the physical security of the office. NDAs are required from all subcontractors/service providers. Assets and personnel are fully covered with insurances. Furthermore Orava has an insurance against damages caused by its personnel. Management and board of directors have a liability insurance. Orava has decided not to take any business interruption insurance. 11.6. Personnel-related security Responsible: CFO During the recruitment process the work history of the applicants is checked and, if so indicated in the recruitment form, a security report is asked from the police. Health of the applicant is also checked and in most cases psychological tests are conducted to help in the selection process.
RISK MANAGEMENT POLICY AND PRINCIPLES 16 (17) CEO has a nominated deputy and also other members of the executives have agreed substitutes to fill in for instance during holidays.
RISK MANAGEMENT POLICY AND PRINCIPLES 17 (17) 12. Concluding remarks The risk management principles comply with the basic principles confirmed in the Orava Corporate Governance policy. CFO is responsible for updating this document and making any required corrections.