Enterprise Risk Management

2022

Enterprise Risk Management Framework

Report Date: February 18, 2022

The Company’s Risk Management System

LT Group, Inc., as a conglomerate, commits to fulfill its obligations to all its stockholders and stakeholders by effectively managing the business and ensuring that the correspondent risk management process is in place.

Therefore, alongside with its growth and for good corporate governance, the Company created its Audit and Risk Management Committee composed of three (3) appropriately qualified Non-Executive Directors, the majority of whom, including the Chairman, shall be independent. These members must, in accordance with the Committee Charter, likewise have relevant background, knowledge, skills, and/or experience in the areas of accounting, auditing, or finance.

The Committee was purposely created to assist the Board in fulfilling its oversight responsibilities. As provided in its charter, the Committee shall review (i) the financial reporting process, (ii) the system of internal control and management of financial risks, (iii) the audit process, and (iv) the Corporation’s process for monitoring compliance with laws and regulations and its own code of business conduct. It shall also monitor the risk environment of the Corporation and provide direction for the activities to mitigate, to an acceptable level, the risks that may adversely affect the Corporation’s ability to achieve its goals.

To implement this, the Committee is tasked to facilitate a risk review and control assessment session with the Company as well as with its subsidiaries to determine and identify the key risk areas. This would help the Committee to provide better suggestions to the Company and recommend activities to avoid or mitigate the identified risks. The results thereof must be periodically reported to the Board so that they can accordingly make the proper business decisions.

TYPES OF RISKS AND RISK MANAGEMENT ACTIVITIES:

Cyber Data and Information Security Risk

The Company recognizes that due to the continuous improvement of technology, it may be subjected to the risk of becoming a target of cyber-attacks and data security breaches. Hence, greater security in all its malwares to protect its record and information must be implemented all throughout the Company, including its subsidiaries. This must be regularly monitored and reported to the Audit and Risk Management Committee.

Company Operations Risk

The Company acknowledges that it has a risk of acquiring losses resulting from inadequate or failed internal process, ineffective personnel and systems, as well as from external events. Since this type of risk is inherent in all the Company’s activities, products and services, the Audit and Risk Management Committee must facilitate periodical assessments to determine the functionality and effectivity of each department.

Reputational Risk

The Company believes that its stability and continuous growth is dependent on how trustworthy the public finds it to be. Hence, public opinion impacts greatly on the Company􏰀s earnings or capital. A positive or negative public opinion produces different results and affects the Company’s ability to establish new relationships or services or continue servicing existing relationships. Failing to mitigate, control or avoid this risk may expose the Company to litigation, financial loss, or a decline in its customer base. Therefore, the Company is required to exercise an abundance of caution in dealing with its customers, stockholders, stakeholders and the community.

Strategy and Implementation Risk

Adverse business decisions, lack of ability to adapt to industry changes and the improper implementation of business decisions might result negatively on the Company􏰀s earnings and capital. Hence, business strategy must be reviewed annually to ensure its effectivity and quality implementation.

Compliance Risk

The Company recognizes that its non-compliance or violation of laws, rules and regulations, prescribed practices, internal policies and procedures as well ethical standards might create a negative impact on its reputation thereby affecting its business relationships and opportunities and reduces its expansion potential.

To mitigate or avoid this risk, the Company is obligated to make certain that, in all dealings and transactions, all laws, rules, policies and procedures, as well as ethical standards are strictly and properly implemented all throughout the Company and its subsidiaries.

Fraud Risk

The Company recognizes that due to the extensive dealings with vendors and contractors, its officers and employees might experience temptation and thus commit fraud in the performance of their functions. To mitigate this risk, and to promote a culture of transparency amongst the different companies under the conglomerate as well as guide all persons within and without the Company to transact accordingly and properly, the Company established its Code of Business Conduct and Ethics which all the Directors, Officers, and employees must abide to.

Legal Risk

As a conglomerate, the Company is prone to this risk which might negatively affect its reputation once legal sanctions against the Company are made public. And, as previously stated, negative reputation might likewise affect the Company’s earnings and capital negatively. Hence, a regular review of the documents, contracts and those of similar nature are purposely done by the Company before these are entered into or executed.

Business Continuity and Disaster Recovery Risk

The Company acknowledges that unforeseen natural and man-made disaster or events of loss might refrain the Company from maintaining a state of continued and uninterrupted operation of its business. Hence, the Company shall implement a process of adopting Records Management and Retention Policies.

RISK MANAGEMENT PROCESS

The Company implements a three (3) level process, namely:

1. Strategic Level – where the Board of Directors, CEO, CFO, Corplan, C-level personnel and other Board level and Senior level committees set revenue goals, define strategic plans, define the risk philosophy, and the Company􏰀s mission and vision.

2. Transactional Level – where the Risk-Taking Personnel (RTP) (Front, Middle and Back Office) determine opportunities and take risks. The risk taking in this level must be consistent to the goals, strategies and risk philosophy set by the policy -making board.

3. Portfolio Level – where the portfolio/position are captured and evaluated by independent third party, other than the risk-taking personnel.

In each level, the risk process involves 4 main aspects of risk management, namely:

a. Risk Identification

b. Risk Measurement

c. Risk Evaluation

d. Risk Management

The performance of the Risk-Taking Personnel shall be regularly reviewed by the Senior Management and the Board of Directors through the Individual Performance Appraisal (IPA). The results of the annual review shall be used as basis in reviewing the risk appetite. The Audit and Risk Management Committee shall recommend adjustments in the risk appetite as basis of the new or revised overall business strategies.