Risk and Crisis Management
Supporting the SDGs
Goals and Performance Highlights
2025 Target
2025 Performance
Business Challenges and Opportunities
The energy and infrastructure business involves long-term and capital-intensive investments and is highly influenced by a range of external factors. As a result, the Company faces challenges arising from regulatory uncertainties, evolving government policies, technological changes, supply chain volatility, as well as the impacts of climate change and natural disasters.
These factors may affect project implementation plans, construction schedules, operating costs, and the Company’s ability to achieve its targeted power generation capacity. If risks are not managed effectively, they may adversely affect investment returns, revenue stability, and stakeholder confidence. At the same time, these challenges present opportunities for the Company to strengthen its proactive risk management approach, enhance business resilience, and improve its readiness to respond to crisis situations. The establishment of an effective risk management framework and a robust Business Continuity Plan (BCP) helps minimize the impacts of unexpected events, supports operational continuity, and maintains cash flow stability. These measures also strengthen the confidence of investors and financial institutions, enabling the Company to access funding sources, maintain a balanced core business portfolio, and expand into new growth opportunities (New S-Curve) in a stable and sustainable manner.
Management Approach and Value Creation
Risk Management Policy
The Company recognizes the importance of systematic risk management under the principles of good corporate governance. Effective risk management supports efficient operations, enables the sustainable achievement of organizational objectives, and strengthens the Company’s ability to adapt to evolving societal contexts and rapidly changing challenges, which may create new business opportunities.
The Company has therefore established an Enterprise Risk Management (ERM) Policy as a common framework and guideline for both the Company and its subsidiaries to ensure a consistent approach to risk management across the organization. The policy aligns with applicable laws, regulations, regulatory requirements, principles of good corporate governance, and anti-corruption measures. The policy promotes the integration of risk management and internal control systems into operational processes at all organizational levels. It defines appropriate roles, duties, and responsibilities for managing and controlling risks, enabling the Company to systematically identify, assess, manage, monitor, and control risks in a comprehensive and interconnected manner. This framework ensures that risks are maintained within acceptable levels across key dimensions, including strategic, operational, financial, and compliance risks, as well as environmental, social, and governance considerations.
Risk Management Structure
The Company has established the Risk Management Committee and the Risk Management Working Team to oversee, set policies, establish guidelines, and formulate the framework for risk management operations. They also monitor and support the organization’s risk management to ensure its efficiency and effectiveness.
Scope of Duties and Responsibilities
| Risk Management Structure Component | Authority and Duties |
|---|---|
| Board of Directors | Oversees the implementation of risk management across the organization through the Risk Management Committee and ensures that risk management is conducted appropriately and consistently. Reviews risk management results and provides guidance for further improvement. |
| Audit Committee | Supports the Board of Directors in overseeing risk management by reviewing and ensuring that the risk management system and internal control processes are appropriate and effective. |
| Risk Management Committee | Ensures that key business risks are regularly identified, assessed, and managed through effective risk mitigation measures. Oversees the management of sustainability risks (ESG) to support preventive and corrective actions and identify business opportunities. |
| Executive Committee | Oversees the implementation of the risk management policy and promotes its continuous application across the Company and its subsidiaries. Reviews risk management practices and the effectiveness of the internal control system. |
| Chief Executive Officer | Ensures that the organization strictly complies with the risk management policy and continuously monitors its implementation. Promotes risk awareness and fosters a risk management culture across the organization. |
| Risk Management Working Team | Implements the risk management policy and reviews the identification, analysis, and assessment of risks across all business units. Monitors the implementation of risk management plans at both operational and organizational levels. |
| Risk Management Department | Establishes and maintains the risk management system, develops risk management plans, reports and evaluates performance against these plans, and reviews them to support continuous improvement. |
| Executives and Employees | Identify, analyze, assess, and prioritize risks within their responsible units and establish Key Risk Indicators (KRIs). Implement appropriate risk mitigation measures as part of their operational responsibilities. |
| Internal Audit Department | Reviews the effectiveness of internal control systems through annual internal audits, focusing on key business processes based on risk factors, and monitors the implementation of corrective actions for identified issues. |
Risk Management Approach
The Company’s risk management practices follow the principles of the Enterprise Risk Management – Integrated Framework developed by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). To support effective implementation, the Company has established a Risk Management Working Team, comprising executives from all business functions, to ensure that risk management is comprehensive and interconnected across the organization. The Company’s risk management framework covers key risk categories, including Strategic Risk, Operational Risk, Financial Risk, and Compliance Risk, as well as sustainability-related risks such as Environmental, Social, and Governance (ESG) risks and Emerging Risks. Risk management results are reported on a quarterly basis to review and monitor risk mitigation measures, ensuring that risks remain within acceptable levels.
Risk Management Procedures
The Company continuously assesses and reviews potential risk issues that could impact operations, considering both internal and external factors alongside impact and likelihood analyses. Risks are prioritized and mapped on the Enterprise Risk Matrix, covering all risk categories. The systematic risk management process ensures that residual risks are efficiently controlled and maintained at an appropriately acceptable level.
Risk Identification
Consistent identification of risk factors across all business activities from both internal and external sources. This covers strategic, financial, construction management, legal compliance, information technology, and other operational risks, as well as sustainability (ESG) risks, including corruption risks.
Risk Assessment
Evaluating and prioritizing risks by assessing the likelihood of occurrence and the severity of potential impacts, mapping them onto the Enterprise Risk Matrix.
Risk Response
Formulating measures to prevent and mitigate potential impacts, responding effectively to the specific risks and opportunities of each category.
Risk Monitoring and Control
Establishing Key Risk Indicators (KRIs) and assigning responsible personnel for tracking and reporting, ensuring potential risks are maintained at a low or acceptable level.
Communication and Reporting
Utilizing modern information technology in the risk management process to communicate and report risk data. The Company ensures that employees at all levels have comprehensive access to risk information, confirming the efficiency and adequacy of the risk management process.
Sustainability Risk Issues
Under the Enterprise Risk Management (ERM) framework, the Company has integrated sustainability risk considerations into its risk management processes at all organizational levels. This approach supports business growth while ensuring comprehensive Environmental, Social, and Governance (ESG) responsibilities. The assessment covers both existing risks and emerging risks arising from rapidly evolving global contexts, considering their potential impacts on business operations, operational continuity, and stakeholder expectations.
Environmental Dimension
The Company places significant emphasis on climate-related risks, including both climate adaptation and climate mitigation. Climate-related risks and opportunities are assessed across the short, medium, and long term to strengthen the Company’s resilience to climate variability while capturing opportunities from the transition to a low-carbon economy.
Social Dimension
The Company evaluates risks related to human rights, labor practices, occupational health and safety, community impacts, and supply chain responsibility to ensure that business operations do not create adverse impacts on stakeholders.
Governance Dimension
The Company emphasizes risks associated with corporate governance, legal and regulatory compliance, business ethics, transparency, and anti-corruption. This also includes cybersecurity and personal data protection, which may affect the confidence of investors, business partners, and regulatory authorities.
In addition, the Company continuously monitors emerging sustainability risks, such as changes in environmental regulations, labor standards, digital technologies, and evolving stakeholder expectations, which may influence future business models. In 2025, the Company identified and prioritized material sustainability risks relevant to its business and established appropriate risk management measures, as summarized below:
Sustainability Risk Issue
Rapid business expansion may lead to a shortage of specialized talent, creating gaps in knowledge and operational experience. This could impact project quality, safety, project management efficiency, and project delivery. Market competition increases the risk of losing high-potential employees. A lack of succession planning could affect long-term management continuity.
Risk Management Measures
- Implement proactive workforce planning aligned with project expansion.
- Continuously develop technical, managerial, and leadership skills.
- Promote employee engagement and retention of high-potential staff.
- Establish a Succession Plan for critical positions.
Sustainability Risk Issue
Operations involving labor, project sites and supply chains carry direct and indirect human rights risks (e.g., discrimination, labor rights violations, unfair treatment). Projects in community areas may cause conflicts if community and stakeholder rights are not adequately considered, potentially leading to reputational damage, project delays, or legal disputes.
Risk Management Measures
- Execute human rights policies covering employees, suppliers and communities.
- Promote Diversity, Equity and Inclusion (DEI).
- Provide grievance mechanisms and whistleblower protection.
- Engage with communities and support local hiring.
Sustainability Risk Issue
Energy system installation and construction projects involve numerous subcontractors, posing risks of illegal labor practices, non-compliance with labor standards or unsafe working conditions. Furthermore, the nature of construction work, working at heights and handling high-voltage electricity increases the risk of severe accidents if occupational health and safety (OHS) oversight is inadequate. These risks could lead to loss of life and property, project disruptions, legal liabilities and reputational damage.
Risk Management Measures
- Audit subcontractors’ employment status and compliance with labor laws
- Appoint site safety officers and professional-level safety officers.
- Strictly enforce occupational health and safety (OHS) standards during operations.
Sustainability Risk Issue
Procuring raw materials, equipment and components from external manufacturers poses risks associated with human rights violations, such as illegal labor, forced labor or unfair working conditions in suppliers’ production processes, which may occur in the upstream tiers of the supply chain. These risks could negatively impact the Company’s credibility regarding social and environmental responsibility, as well as its relationships with customers, investors and business partners.
Risk Management Measures
- Assess and screen suppliers based on human rights and labor standards prior to registration.
- Audit production processes and employment conditions.
- Continuously evaluate supplier performance.
Sustainability Risk Issue
The development of energy and infrastructure projects may raise concerns or face opposition from local communities if the public perceives that the projects will impact the environment, health, livelihoods or local resources. Misunderstandings or inadequate communication can lead to complaints, protests or social pressure, potentially causing projects to be delayed, suspended or canceled, thereby damaging the corporate image and stakeholder trust.
Risk Management Measures
- Communicate with and listen to community feedback from the initial stages.
- Organize CSR activities and support local employment.
- Build long-term relationships with stakeholders in project areas.
Sustainability Risk Issue
Developing power plants and infrastructure may involve utilizing lands that were formerly agricultural or natural areas, potentially impacting animal habitats, biodiversity, ecosystems, and local community livelihoods. If site selection and impact assessments are not comprehensive, it may lead to community conflicts, environmental complaints or legal constraints affecting project execution.
Risk Management Measures
- Select project sites carefully and in strict compliance with the law.
- Conduct Environmental Impact Assessments (CoP / IEE / ESIA) and strictly enforce preventive measures.
- Engage with communities prior to project development.
Sustainability Risk Issue
Acquiring land use rights for project development carries risks of land ownership disputes or insufficient consent from local stakeholders. If communication and engagement processes are not inclusive, they may lead to complaints, opposition or litigation, affecting project continuity and long-term relationships with communities.
Risk Management Measures
- Enter into legally valid contracts with landowners.
- Transparently communicate project information and listen to community feedback.
Sustainability Risk Issue
Operations involving high-voltage electrical equipment, machinery and factory production processes entail risks of accidents such as electrocution, explosions or mechanical failures. Inadequate safety controls could result in severe injuries or fatalities, property damage, production disruptions and subsequent impacts on legal liability, corporate reputation and the quality of life of stakeholders.
Risk Management Measures
- Establish an Occupational Safety, Health and Environment Committee (OHS Committee).
- Appoint professional-level safety officers.
- Provide standard Personal Protective Equipment (PPE) and conduct regular safety training.
- Continuously inspect and maintain equipment and workspaces.
Sustainability Risk Issue
The reliance on digital systems for controlling power generation and managing data increases vulnerability to cyberattacks, system disruptions and critical data breaches. These events could adversely affect business continuity, stakeholder confidence and legal liability.
Risk Management Measures
- Deploy and maintain cybersecurity defense systems (e.g., Firewall, IDS/IPS, Encryption).
- Regularly update system security patches.
- Implement Two-Factor Authentication (2FA) for critical systems.
- Formulate and annually test the IT Disaster Recovery Plan (IT DRP).
- Conduct vulnerability assessments and penetration testing via independent agencies.
- Strictly comply with the Personal Data Protection Act (PDPA).
- Provide continuous cybersecurity and data protection training for employees.
Sustainability Risk Issue
Intensifying climate change leads to climate variability and extreme weather events, such as floods, severe storms, rising temperatures and erratic rainfall, which can directly impact the operations of power plants, factories and office buildings. These risks include damage to infrastructure, power generation disruptions and increased maintenance costs. For the renewable energy business, weather fluctuations also affect generation efficiency. Moreover, climate risks may disrupt the supply chain, hinder access to project sites and affect long-term construction or operational continuity.
Risk Management Measures
- Design elevated solar farm structures based on 100-year flood statistics.
- Adapt operational strategies to align with future climate trends.
- Analyze long-term wind speed data prior to investing in wind energy projects.
- Secure comprehensive disaster risk insurance for projects in high-risk areas (e.g., Japan).
- Systematically compile and analyze corporate greenhouse gas (GHG) emissions data to prepare corporate GHG inventory reports and establish emission reduction measures.
- Construct earth dikes and drainage systems around project areas.
Detailed information regarding the Company’s material risk issues, including both existing and emerging risks, as well as mitigation and control guidelines, is disclosed in the 2025 Annual Registration Statement (Form 56-1 One Report) under the section “Risk Factors for the Company’s Business Operations”.
Business Continuity Management
The Company has established a Crisis Management Plan (CMP) and a Business Continuity Plan (BCP) to prepare for potential disruptions arising from various events, including natural disasters, earthquakes, major accidents, public protests, terrorism, pandemics, asset theft, and cyber threats that may affect business operations.
These plans are developed based on a Business Impact Analysis (BIA) and the prioritization of critical business processes to ensure that the Company can maintain operational continuity, minimize potential impacts, safeguard stakeholder interests, and preserve corporate credibility. The crisis and emergency management framework consists of the following key phases:
Risk Management
Incident Response
Damage Recovery
The Company conducts annual testing of the Business Continuity Plan through simulation exercises to evaluate the effectiveness of the plan and assess personnel readiness. In 2025, the Company conducted emergency response drills for fire incidents and chemical spill scenarios, as well as testing the IT Disaster Recovery Plan (IT DRP) against cyber threats. These exercises help ensure that executives and employees clearly understand their roles and responsibilities during emergencies. Observations and improvement opportunities identified during these exercises are systematically reviewed and incorporated into the continuous enhancement of crisis response and business continuity measures to ensure alignment with evolving risks.
Risk Management Culture
The Company promotes and instills risk management as an integral part of its corporate culture. Employees at all levels are encouraged to be aware of and actively participate in continuously identifying, analyzing, assessing and prioritizing risks related to their responsibilities. This collective effort aims to prevent and mitigate potential impacts on business operations, thereby enhancing competitiveness and driving long-term sustainable growth.
The Company has established a comprehensive risk management process encompassing risk identification and assessment, the determination of Risk Appetite, the formulation of response measures, as well as regular risk monitoring and review. Risk issues and management measures are reported to the Risk Management Committee and the Board of Directors on a quarterly basis. Furthermore, the Internal Audit Department, which operates independently and reports directly to the Audit Committee, is tasked with evaluating the adequacy and effectiveness of the risk management process to ensure compliance with relevant standards.
In terms of capacity building, the Company continuously conducts risk management training and practical workshops for directors, executives and employees to reinforce their understanding of material risks in both business operations and sustainability (ESG) dimensions. The Board of Directors receives regular reports on risk management, business continuity management and crisis management, enabling them to refine their knowledge to support their strategic oversight role. For executives and employees, the Company integrates sustainability-related risks (ESG-related risks) into daily operations through analytical workshops focusing on key internal and external opportunities and threats. The assessment outcomes are utilized to inform business development and strategic decision-making, ensuring readiness to handle both short-term and long-term volatility. Moreover, the Company links Key Risk Indicators (KRIs) to the performance evaluations of executives and employees at certain levels, creating incentives for effective enterprise-wide risk management.
Additionally, the Company provides specialized training, such as anti-corruption risk, while concurrently communicating and reinforcing the risk culture through various channels. These include meetings, training sessions, new employee orientation, the e-Learning system, internal communications, as well as public disclosures via the Annual Registration Statement (Form 56-1 One Report) and the Sustainability Report. This ensures comprehensive access to information and encourages active participation in the risk management process across all levels.
Stakeholders Directly Impacted
Employees
Suppliers
Customers
Business Partners
Shareholders and Investors
