STRUCTURE AND MECHANISM OF CORPORATE GOVERNANCE

1. Risk identification
   The purpose of risk identification is to find, identify and describe risks that can help or hinder the organization in achieving its goals. Relevant, adequate and up-to-date information is important in identifying risks. The Company identifies risks regardless of whether the source of the risk can be controlled or not.
2. Risk Analysis
   The purpose of risk analysis is to understand the nature of the risk and its characteristics, including, if possible, the level of risk. Risk analysis involves a detailed consideration of the uncertainties, sources of risk, impacts, possibilities, events, scenarios, controls and the effectiveness of those controls. Risk analysis can be carried out with varying levels of detail and complexity, depending on the purpose of the analysis, the availability and reliability of the information and the availability of resources. Risk analysis provides input for risk evaluation, for decisions on whether risks need treatment and how to treat them, as well as on the most appropriate risk treatment strategies and methods.
3. Risk Evaluation
   The purpose of risk evaluation is to support decision making. Risk evaluation involves comparing the results of risk analysis with the established risk criteria to determine whether additional action is required.

Risk Treatment

The purpose of risk treatment is to select and implement risk treatment options. Risk treatment includes an iterative process of:

1. Formulation and selection of risk treatment options;
2. Planning and implementation of risk treatment;
3. Assessment of the effectiveness of treatment;
4. Decision making whether the remaining risk is acceptable; and
5. Implementation of further treatment, if the option is not accepted.

Monitoring and Review

The form of monitoring and review consists of:

1. On going monitoring
   The risk owner unit continuously monitors all factors that affect the risk and environmental conditions of the company. If there is a planned organizational change or a changing external environment, changes are most likely to occur in:
1. The scope and context;
2. The risk that occurs or the priority level of risk;
3. Existing control system/control media; and
4. Risk handling.