Risk Management Policy
SAL’s risk management policy is based on applying best practices to manage all risks that could negatively impact the Company. This includes its vision, strategy, customers, assets, departments, objectives, employees, and operations. Enterprise Risk Management (ERM) is integrated into strategic, operational, and business management responsibilities and is part of the strategic and business planning processes.
The Company’s risk management policies aim to:
- Ensure risk management is a standard management practice.
- Protect the Company from negative events by reducing risk exposure, mitigating severity, and controlling losses.
- Ensure the Company’s efficiency in performing its mission, achieving its goals, and serving customers.
- Reduce risk costs and their effects on the Company.
- Protect the interests of the Company, Board of Directors, Shareholders, and Stakeholders.
- Adhere to internationally accepted industry best practices.
Risk Appetite
SAL aims to ensure that risks are taken in a systematic and thoughtful manner. Personnel throughout the organization should be clear on what risks must be taken to achieve strategic goals and what risks should be avoided. SAL will not accept any risk that significantly hampers the achievement of its strategic goals and objectives. Any risk above SAL’s risk appetite should be brought to the attention of the Board and immediately responded to by management.
The risk appetite encompasses:
- Risk philosophy
- Risk attitude (seeker, averse, neutral)
- Risk and return relationship
- Mitigation preferences
- Risk treatment priorities
- Acceptable impact thresholds
- Risk appetite categories
Risk Categories
SAL has identified the following risk categories:
- Financial: Risks that could lead to an adverse financial impact.
- Operational: Risks resulting from inadequate internal processes, people, systems, or external events that impact daily operations. This includes the risk of not attracting or retaining top talent.
- Reputational: Risks impacting the Company’s image and brand.
- Strategy: Risks impacting SAL’s ability to achieve its mission, goals and strategic objectives.
- Health, Safety & Environment: Risks impacting the health and safety of employees, contractors, customers and the environment.
- Regulatory, Legal & Compliance: Risks of loss from non-compliance with regulations and legal actions.
- Security: Risks impacting the security of SAL stations, aircrafts, cargo and airport infrastructure.
- Information Technology: Risks impacting IT operations within the Company.
- Cybersecurity: Risks impacting the cybersecurity environment at SAL.
Risk Appetite Statements
While its strategic appetite is considered moderate through pursuit of opportunities guided by the principles of risk return optimization, SAL has a low risk appetite for financial, operational, reputational, IT and cybersecurity risks. The Company has zero appetite for health, safety and environment and security risks. Investments are supported by defined metrics. SAL aims to provide secure and satisfying transport, logistics and cargo services.
Risk Assessment and Evaluation
Inherent risks are evaluated based on their impact on the organization’s objectives and likelihood of occurrence. The impact is the level of consequence that a potential risk can have on the achievement of business or functional objectives. Likelihood is the probability of a risk event materializing. SAL uses a 5×5 matrix to evaluate risks. Any residual risks ranked 15 or above on the 5×5 Risk Assessment Criteria Matrix (RACM) are considered intolerable and reported to the Board of Directors.
Risk Impact Measurement
Impact is measured across all risk categories. Senior Executives Presidents, Chiefs, and VPs, Department Directors, and Management utilize risk impact guidance in making decisions, allocating resources, and gauging performance.
Responsibilities
The Enterprise Risk Management Department is responsible for ensuring compliance with the following:
- Risk appetite should be approved by the CEO, Risk Management Committee, and the Board of Directors.
- Risk appetite should be aligned with SAL’s strategy, values, and objectives, and linked to key performance indicators.
- Responsibility for applying risk appetite should be distributed across all employees, subject to monitoring by the enterprise risk management department.
- Risk appetite statements can be quantitative or qualitative, based on the risk type and the extent to which the appetite can be quantified.
- The Risk Management Department, in collaboration with management, is responsible for monitoring all risk exposures, action plans, risk mitigation measures, and responses to financial risks. SAL integrates strategic objectives in its initial phases to address various aspects, including regional political conditions, the business environment, market conditions, and customer needs.
Moving Forward
As part of Enterprise Risk Management enhancement and optimization at SAL, the 2025 plan includes integration of Key Risk Indicators to proactively analyze the trends and address ensuing risks. The plan also includes incorporating further digitization and availing latest technology tools such as AI.