Key impacts, risks and opportunities

Corporate risk governance and internal control system effectively perform its roles and is regularly improved at the Company.

The risk management system allows the Management Board and the Board of Directors to effectively manage and allocate resources in priority areas to ensure the level of risks acceptable to the Company and to get the most return on such investments by identifying, assessing, managing, and monitoring risks.

The organization of the internal control system involves the creation of a management system by the Company, which is capable of quickly responding to risks, controlling over the main and auxiliary business processes and daily operations of the Company, as well as immediately informing the management of the appropriate level about any significant shortcomings and areas for improvement.

The Board of Directors sets the Company's risk appetite both in quantity and quality terms every year; the risk appetite includes restrictions on core activities, and compliance with such restrictions is monitored every quarter.

The owners of key business processes update the risk and control matrices regularly, including the process of preparing financial statements, and then they submit them to the Board of Directors of the Company for review and approval. The Risk Register, the Risk Map, KRP (key risk indicators) and the Action Plan for managing key risks are formed annually and submitted for consideration and approval by the Board of Directors of the Company. After considering the results of performed work on identification of “Samruk-Energy” JSC group’s risks for 2021, 33 risks involved in operations of “Samruk-Energy” JSC group of companies were identified and assessed, KPI thresholds were updated, risk owners updated risk factors and  activities aimed at their mitigation. According to the results of revaluation, 10 risks were included into the key zone of the Risk Map for 2021 (in 2020 – 10 key risks):

Key changes in 2021 (mitigation of key risks)

During the process of formation and development of business processes, many innovative solutions have been created to manage possible and potential risks.

As practice has shown, in any business processes there are risks that need to be assessed and prevented.

Works on implementation of the project "Introduction of the new risk management model" have commenced since November 2018; the project is an important part of corporate governance, and consists of 3 integrated subsystems subject to the following changes:

1. risk management system (system improvement);
2. internal control system (refinement of the system in terms of design assessment and testing of the operational efficiency of control procedures);
3. business continuity support system (system implementation).

At year-end 2021, as part of implementation of the project "Introduction of the new risk management model" (the Project), several activities have been carried out in stages, such as:

1. subsidiaries and affiliates that are key in the implementation of the Project were identified;
2. the plan for implementation of the Project was determined, which outlines the activities for “Samruk-Energy” JSC and its key subsidiaries and affiliates;
3. the processes that are involved in the implementation of the Project (production and IT processes) have been identified;
4. people responsible for ensuring the continuity of operations as part of the Project at “Samruk-Energy” JSC were appointed in and its subsidiaries and affiliates, appointed  (“Ekibastuz SDPP-1 named after Nurzhanov” LLP, “Ekibastuz SDPP-2” JSC, “Almaty Power Plants” JSC, “Moynak Hydropower Plant” JSC, “Alatau Zharyk Company” JSC, "Shardarinsk hydropower plant" JSC, “AlmatyEnergoSbyt” LLP);
5. the processes identified at SA ("Ekibastuz SDPP-1 named after Nurzhanov” LLP, “Ekibastuz SDPP-2” JSC, “Almaty Power Plants” JSC, “Moynak Hydropower Plant” JSC, “Alatau Zharyk Company” JSC, "Shardarinsk hydropower plant" JSC, “AlmatyEnergoSbyt” LLP) were allocated into criticality groups;
6.  internal regulatory documents have been developed (Internal control arrangement and implementation rules, business continuity rules) at subsidiaries and affiliates (Ekibastuz SDPP-1 named after Nurzhanov” LLP, “Ekibastuz SDPP-2” JSC, “Almaty Power Plants” JSC, “Moynak Hydropower Plant” JSC, “Alatau Zharyk Company” JSC, "Shardarinsk hydropower plant" JSC, “AlmatyEnergoSbyt” LLP)
7. Business continuity plans and business continuity recovery plans were developed at “Samruk-Energy” JSC and its SA (Ekibastuz SDPP-1 named after Nurzhanov” LLP, “Ekibastuz SDPP-2” JSC, “Almaty Power Plants” JSC, “Moynak Hydropower Plant” JSC, “Alatau Zharyk Company” JSC, "Shardarinsk hydropower plant" JSC, “AlmatyEnergoSbyt” LLP)
8. Draft Methodology for testing the internal control system was developed on the basis of existing Rules for arrangement and implementation of internal control for key subsidiaries and affiliates as part of the Project implementation;
9. Draft Methodology for testing the business continuity management system was developed on the basis of existing Business Continuity Rules for key subsidiaries and affiliates as part of the Project implementation;
10. trial testing of internal control and business continuity management systems was conducted at “Ekibastuz SDPP-2” JSC, “Almaty Power Plants” JSC, “Moynak Hydropower plant” JSC, “Alatau Zharyk Company” JSC; 
11.  awareness raising activities were held regularly during the reporting period as part of the Project activities;
12. inspections of the Project implementation activities were carried out (off-premise).