Risk Management

Policy

Table of Contents

SECTION 1:	RISK MANAGEMENT FRAMEWORK	3

1.1	Policy statement	3

1.2	Purpose and scope	3

1.3	Definitions	3

1.4	Principles	4

1.5	Outcomes	4

1.6	Delegations, Roles and Responsibilities	4

1.7	Policy implementation	6

1.8	Risk management	6

SECTION 2:	RISK MANAGEMENT PROCESSES	7

2.1	Communication and consultation	7

2.2	Establishing risk context	8

2.3	Risk identification	8

2.4	Risk assessment	9

2.4.1	Risk matrix	10

2.4.2	Risk likelihood	10

2.4.3	Risk impact	10

2.4.4	Risk rating	11

2.5	Risk treatment	11

2.6	Risk management plans	12

2.7	Risk monitoring and reviewing	13

2.8	Reporting and record-keeping	13

2.8.1	Risk register	13

SECTION 1:	RISK MANAGEMENT FRAMEWORK

1.1	Policy statement

Masader Al-Jazeera Trading Co (‘Company’) is committed to effective Risk Management as a strategy for protecting the Company, board, employees, workers, clients, stakeholders, and the community from unnecessary injury, loss or damage relating to the business and activities the Company undertakes.

1.2	Purpose and scope

This policy aims to provide guidance to the Company in applying risk management processes across the Company’s operations, to ensure that, so far as reasonably practicable, the Company’s goal and identified outcome areas can be achieved.

This policy applies to all of the Company’s staff, workers, Board members (Personnel).

This policy encompasses but is not limited to:

Identifying, assessing and treating risks

Ongoing risk monitoring and review

Communication and consultation

Record-keeping

Specific risk areas.

1.3	Definitions

Activity Risk File (“ARF”)	A folder/file (electronic and/or hardcopy) containing risk management data.
Board	Means the Company’s Board of Directors
Risk Management	risk management is concerned with improving the quality and safety of services by identifying the circumstances and opportunities that put clients at risk of harm and then acting to prevent or control those risks
Impact	Actual or potential impact that would or may occur
Likelihood	Probability or chance of an incident occurring
Company	Masader Al-Jazeera Trading Co
Personnel	The Company’s staff, workers, Board members, volunteers,
Risk	Chance of something happening that will Impact on objectives, measured in terms of likelihood and impact
Risk Assessment	Process of analysing and evaluating the likelihood and impact of potential risks
Risk Incident	Realisation or occurrence of a risk impact
Risk Management	Process of identifying, assessing and judging Risks, assigning ownership, taking actions to mitigate them, and monitoring and reviewing progress
Risk Register	A Risk Register is a tool for documenting risks, and actions to manage each risk. The Risk Register is essential to the successful management of risk. As risks are identified they are logged on the register and actions are taken to respond to the risk
Risk Treatment	Identifying and implementing actions to eliminate risks or reduce impacts

1.4	Principles

The following principles guide Masader Al-Jazeera Trading Co’s risk management policy and procedures:

Risk management applies to all aspects of the Company’s business and activity

Risk management is a shared responsibility of all staff, management and Board members

Risk management is a continuous improvement process where the Company continually strives to reduce and manage the likelihood and negative impact of risks

Staff and Board membersare provided with training and other support to assist them in managing risk in their roles.

1.5	Outcomes

The outcomes of this policy are that: Masader Al-Jazeera Trading Co

Makes informed business, operational and service delivery decisions while remaining fully aware of risks and impact

Staff, management and Board members understand their roles and responsibilities in relation to risk management

Risks and risk impact are minimised through compliance with relevant regulatory, legal and financial obligations, and implementation of risk treatments.

1.6	Delegations, Roles and Responsibilities

Board of Directors	Endorse and ensure compliance with the Risk Management Policy Ensure compliance with relevant legislation Lead and support the CEO to manage risk Monitor and contribute to internal risk treatment strategies and activities, including regular review of the Risk Register
CEO/Manager	Lead the implementation of the Risk Management Policy Identify and assess new risks and implement risk treatments Lead, monitor and update identified risks and risk treatment Ensure risk assessments are undertaken
Risk Management Committee	supporting the Board of Directors in the implementation of the Risk Management Policy; communicating significant risks to Board of Directors, client, delivery team and relevant stakeholders as appropriate; monitoring the effective implementation of this RMP; allocating appropriate resource to undertake risk management activities
Risk Management Officer	The risk management Officer is responsible for: supporting the Board in the implementation of the Risk Management Policy; demonstrating leadership in, and acting as the focal point for risk management; developing, implementing and maintaining the RMP and associated processes; maintaining the activity risk file (ARF); ensuring consistency of risk related data; driving best practice and continuous improvement through the provision of facilitation, training and guidance;
Risk Owners	Risk owners are responsible for: managing owned risks, including definition, evaluation and treatment; managing risk treatments for owned risks including costs, programme, effectiveness and Fallback; ensuring that data relating to owned risks, including risk treatment data, is robust and well maintained; participating in reviews and workshops as appropriate;
Delivery Team Personnel	Delivery team personnel are responsible for: actively identifying and raising risks (threats and opportunities); accepting ownership of risks, where appropriate; undertaking assigned risk treatment activities; participating in reviews and workshops where requested; participating in risk training where the need is identified;

1.7	Policy implementation

This policy is developed in consultation with the Company’s staff and approved by the Board of Directors.

All Personnel are responsible for understanding and adhering to this Risk Management Policy.

Specific monitoring and support activities undertaken include:

Risk management issues are part of the Work Health and Safety updates as standing agenda item in staff meetings

Review of the risk register is a standing agenda item for board meetings

This policy is to be part of staff orientation processes

This policy should be referenced in relevant Masader Al-Jazeera Trading Co policies, procedures and other supporting documents, where relevant, to ensure that all relevant staff are familiar with it and that it is actively used

This policy will be reviewed in line with the quality improvement program every year, following a risk incident and/or following relevant legislative changes.

This policy is implemented in combination with all the Company’s policies and procedures.

1.8	Risk management

The Company develops and implements risk management strategies and processes informed by this policy and in compliance with relevant legislation.

SECTION 2:	RISK MANAGEMENT PROCESSES

This section ensures that Masader Al-Jazeera Trading Co develops and implements consistent risk management strategies and processes to effectively manage and treat risk, in order to safely enhance the Company’s operation and achieve its strategic goals.

This section provides guidance on the plans, processes and tools that the Company adopts in order to identify, assess, treat and monitor risks.

This section ensures that the Company:

Provides reliable administrative tools and reporting methods

Confirms that the Risk Management strategy and activities are informed by its Personnel, clients and the broader community

Ensures that risk management processes support and enhance the services provided to its clients

Has a structure for the continuing review of risk

Provides ongoing safe operations for Personnel, clients and the broader community.

2.1	Communication and consultation

Communication and consultation is undertaken with the Company’s Personnel to ensure understanding and engagement in risk management.

Communication mechanisms include:

Orientation processes for new Board members, staff, and clients entering the service

Agenda items and discussion at staff and team meetings,budgets, client related incidents

Regular staff and supervisor meetings to review work plans and activities, together with incident management

CEO/Manager reporting to the Board, and regular review of the Risk Register.

The Company implements diverse consultation methods to seek feedback from its clients and Personnel. This may include:

Staff and Board leadership and participation in policy development

Staff and Board leadership and participation in risk management and risk incident review

Client meetings

Workshops

Surveys

Communication and consultation is undertaken with external stakeholders (if appropriate) as part of Masader Al-Jazeera Trading Co business. Mechanisms include:

Briefing and planning meetings as part of project development, implementation and evaluation

Strategic planning

Performance reporting to funding bodies

Annual reports

Surveys and evaluations

2.2	Establishing risk context

Risk management considers the context in which Masader Al-Jazeera Trading Co operates and how these characteristics and capabilities influence and inform risk responses. This could include assessing:

Strategic or external context:	Operational, regulatory, financial and political environment Business drivers Opportunities and threats Stakeholders.
Companyal or internal context:	The Company’s goal and outcomes Companyal culture Strengths and weaknesses within the Company Existing systems and processes Stakeholders Available resources.
Risk management context:	The Company‘s size, Companyal structure and location Governance structure Management expertise service delivery Workforce capacity Assets.

2.3	Risk identification

Masader Al-Jazeera Trading Co identifies risks through formal and informal processes such as: targeted consultation, observation of workplace practice, monitoring of regulatory requirements, Company system reviews, regular audits, analysis of information gathered relating to incidents and strategic and project planning.

Company risks are categorised and summarised as follows:

Type	Area/item compromise
Strategic	Goal and intended outcomes of the Company Intellectual property Reputation Company and sector positioning Resourcing, growth and improvement
Compliance	Entity legislation (e.g. incorporations, co-operatives or others) Contractual obligations Insurance Taxation Employment legislation (refer to the Human Resources Policy)
Financial	Fraud Income, budget and expenditure operations Debt collection Governance and management by Board
Operational	Governance Service delivery General equipment, resources and facilities Human resource management Information management Break-in, theft, and fire
Market/ environmental/ external risks	Natural disasters or major storms Changes in government and/or government policy Major legislation change

2.4	Risk assessment

The risk assessment matrix, risk likelihood and rating tables below are applied to all identified risks to determine their level of risk based on two categories: likelihood and impact.

Risk assessment also includes reviewing existing controls, whether specific to that risk or by default.

2.4.1	Risk matrix

Likelihood	Almost certain	Low Medium	Medium	Medium -High	High	High
Likely	Low	Low - Medium	Medium	Medium -High	High
Possible	Low	Low	Medium	Medium -High	High
Unlikely	Low	Low	Low - Medium	Medium	Medium -High
Rare	Low	Low	Low	Medium	Medium -High
Minimal	Minor	Moderate	Significant	Severe
Impact

2.4.2	Risk likelihood

Rating	Description
Almost certain	90% or greater probability	Expected to occur in most circumstances
Likely	50-90% probability	Will probably occur in most circumstances
Possible	20-50% probability	Could occur at some time
Unlikely	10-20% probability	Not expected to occur
Rare	<10% probability	Would occur only in exceptional circumstances

2.4.3	Risk impact

Rating	Description
Severe	Business objectives and/or continuing viability is threatened	sustained disruption; significant reputational damage; litigation highly likely and costly; significant financial loss.
Significant	Business objectives are not met	medium-term disruption; adverse publicity; probable litigation and difficult to defend; significant financial loss.
Moderate	Business objectives may be threatened	short term disruption; reputational damage; litigation possible; significant financial loss.
Minor	Business objectives require monitoring	short term disruption; litigation unlikely; moderate financial loss.
Minimal	Business objectives unlikey to be affected	no significant disruption, adverse publicity unlikely, litigation unlikely financial loss modest

2.4.4	Risk rating

The risk rating assists Masader Al-Jazeera Trading Co in determining if the risk is acceptable or unacceptable. A low rating risk may be expected and acceptable with minimal treatment response, whereas a high rating risk is not acceptable and therefore requires a response to minimise or eliminate risk.

High	Requires immediate action to mitigate the risk
Medium-High	Requires short-term action to mitigate the risk
Medium	Requires medium-term action to mitigate the risk (work within other priorities)
Low-Medium	May require attention
Low	Manage by routine procedure

2.5	Risk treatment

Risk treatment involves identifying and implementing actions to eliminate risks or reduce their impacts. In treating risk the Company, board and staff members ensure that:

The cost of implementing risk treatments is balanced with the expected and actual risk reduction outcomes

If eliminating risk is to discontinue an activity, remove an identified risk item, or avoid new or potential risks

Risk reduction activity involves implementing reasonable and practical steps to reduce risks and minimise loss, injury or harm.

Major risks and their responding treatments are logged in the Company’s Risk Register

Risks that are substantially mitigated by the existence of a specific Compan policy may not be required to be recorded in the Risk Register

Risk specific to client service delivery are managed under a risk management framework

Risks specific to individual projects are identified and responded to through project implementation; these may not be required to be recorded in the Risk Register.

Risk Treatment should adopt the hierarchy for controlling Risks:

Eliminate the hazard

Substitute the hazard for something safer

Isolate the hazard from people

Use engineering controls

Use administrative controls

Use personal protective equipment.

The diagram below depicts the Company’s risk management process.

Monitor and review Identify risk Strategic Compliance Financial Operational Market/environmental Assess risk Likelihood Impact Existing controls Risk rating Treat risk Identify and implement actions Eliminate risk Reduce risk impact Establish risk context Strategic/external Companyal/internal Risk management Communicate and consult

2.6	Risk management plans

Masader Al-Jazeera Trading Co implements risk management plans for specific activities that carry likely or almost certain risk which are inherent in working with our clients. The plans provide specific guidance to staff in managing concerns that are likely to arise when providing direct client services.

2.7	Risk monitoring and reviewing

Masader Al-Jazeera Trading Co monitors and reviews risks and their treatment strategies as part of effective risk management and ongoing quality improvement.

Monitoring and reviewing activities include:

Re-consideration of the contexts, rating, treatment and responsibilities.

Risks identified through the Company’s Risk Register are reviewed and updated monthly by the Risk Officers.

The Board reviews the Company’s Risk Register annually through Board and other relevant meetings.

Previously identified risks may become de-activated through a monitoring and review process, where the likelihood and impact of loss, injury or harm is assessed as non-existent or negligible.

risk is monitored and reviewed regularly through case meetings and action plans , and supervision]. Risk management plans are developed and regularly reviewed for the delivery of services to those areas where risk is likely or almost certain.

The Company’s risks are also reviewed and their status is updated following a risk incident, such as a incident, workplace accident, cuts to funding, damage to reputation, or not meeting taxation compliance requirements.

2.8	Reporting and record-keeping

Risks identified in the Company’s Risk Register are reported to the Board annually by the Managing Director in the scheduled Board meetings. Related discussion and outcomes are recorded in Board and relevant minutes.

Risk management discussion and outcomes from staff meetings are recorded in meeting minutes.

2.8.1	Risk register

The Company’s Risk Register details risks, their rating, controls and treatments, as well as responsibilities and timeframes.

All risks listed in the Risk Register are allocated a unique risk identification number.

De-activated risk identification numbers are maintained on the Risk Register for reference as required.

Doc.Type :	Policy	Doc.Type :	Risk Management Policy
Reference No.:	Issue Date:	20 Fab 2024
Issue No.:	1

Policy Approval
Name	Mr. Wael Al-Yousifi	Name	Mohamed Hamza	Name	Ahmed Hassan
Capacity	Member of the Board of Directors and Managing Director	Capacity	Head of Legal, Corporate Governance Compliance & Risk	Capacity	Executive Director
Signature	Signature	Signature