Strategy, Sustainability and Risk

Enterprise Risk Management

As Manila Water faces greater challenges in the East Zone Concession and in its operations across the Philippines and Southeast Asia, effective risk management is critical to ensure that the Company will be able to fulfill its goals as a leader in the provision of water, wastewater, and environmental services in the communities it serves.

Risk management is consistently used as a tool for effective decision-making, planning and operations, resulting in a resilient and agile organization amidst difficulties in its regulatory and physical environment.

ENTERPRISE RISK MANAGEMENT IN MANILA WATER

Manila Water operates in a regulated and dynamic business environment where uncertainties, both detrimental and opportune to the Company, abound. The Company is accountable to its regulators, shareholders, employees and customers, among others.

Profitability, sustainable development and corporate social responsibility are expected to be continuously enhanced. In order to achieve its corporate objectives, Manila Water recognized the need for the active management of risks inherent to its business which involves the entire organization.

Manila Water continues to implement its Enterprise Risk Management (ERM) Program based on a globally accepted approach, the ISO 31000, and has been cascaded across the Manila Water enterprise which includes subsidiaries in MWPV and MWAP to ensure attainment of its objectives.

The ERM Program operationalizes the Company’s Manual of Corporate Governance which mandates the Board of Directors (BOD) to ensure the presence of organizational and procedural controls supported by an effective management information system and risk management reporting system. In addition, the Company’s Board Risk Oversight Committee (BROC) provides oversight to management functions relating to strategic, financial, operational, compliance, legal, environmental, social and other risks of the Company. This involves periodic disclosure of significant risk exposures and related risk management activities.

The President is the comprehensive risk executive and is ultimately responsible for ERM priorities, strategies, tolerances and policies. He chairs the Risk Management Executive Committee (RMEC) which is composed of top management and the Chief Risk Officer (CRO). The RMEC provides oversight and input to the President and to the Board to enable them to formulate better and informed decisions on matters related to risks.

The RMEC provides direction on the design and implementation of appropriate systems, tools and methodologies to support the ERM process and other risk management activities and designates owners of specific risks and enablers of the ERM process (ERM Champions/ Partners/ Risk Officers).

The CRO is the ultimate champion of ERM at Manila Water. Supporting the CRO is the Enterprise Risk Management (ERM) Department. It is responsible for developing risk management tools, methodologies and processes. It also leads the implementation and dissemination of ERM across the Manila Water Group in coordination with the risk owners, the CRO and ERM Champions/ Risk Owners of the business units. With the ERM mindset continuously being assimilated into the Company’s culture and practices, ERM has been embedded in the strategic, tactical and execution planning as well as in key-decision making processes. The risk management system of Manila Water is reviewed and assessed annually by Internal Audit using a risk maturity assessment framework aligned with global best practices to determine the system’s adequacy, suitability and effectiveness. An external assessment of Manila Water Company’s ERM maturity was conducted in 2018 by Ayala Corporation through Aon Philippines.

2020 ERM HIGHLIGHTS

The following changes were implemented to further improve the implementation of ERM across the enterprise:

Appointment of the Chief Finance Officer as concurrent Chief Risk Officer, and merger of the EERM and Sustainability departments.
Increase in the number of BROC meetings to quarterly, instead of semi-annually, to provide more opportunities for deeper discussions of top risks as well as provide ample attention to the risks of new business operations.
Enhanced deep dive discussions at the subsidiary level using risk driver analysis.
Commencement of the review and updating of the existing ERM policy, framework and organizational structure, with the target of BROC approval in early 2021, and subsequent rollout across the enterprise of the revised risk dictionary (including risk indicators), revised risk register templates and reporting tools.

MOVING FORWARD

In pursuit of enhancing the ERM culture in Manila Water, the following will be undertaken in the near future:

Mandatory ERM trainings for process owners across the enterprise to communicate the revisions in the revised policy, framework, risk governance structure, inter-group protocols, calendars, and assessment and reporting tools.
Integration of risk management practice with certain business processes such as CAPEX execution and further alignment of risk management with strategic planning and performance management.
Preparation of the Company’s Risk Appetite statements, and calibration of operational risk thresholds as enhancements in key risk indicators monitoring.
Giving special focus on climate-driven risks, with capacity building work to ensure readiness for disclosures using the recommendations of the Task Force for Climate-related Financial Disclosures (TCFD) for the reporting year 2022.

MANAGEMENT OF TOP ENTERPRISE RISKS

The RMEC composed of Manila Water Company’s Management Committee and CRO, determines the most significant risks facing the Company. Management of Top Corporate Risks, which have been mapped down to the department level, is delegated to the appropriate Risk Owners. For MWPV and MWAP, the RMEC is composed of the President/Chief Operating Officer, Leadership Team and the CFO/CRO. Risk Owners formulate and commit to a risk management plan, monitored by the ERM Department, which defines specific action points, accountability and timelines. The status of Top Enterprise Risks is regularly discussed at the RMEC and is reported to the BROC.

Rank	2020 Enterprise Risks	Updates and Mitigation Strategies
1	POLITICAL-REGULATORY RISK RENEWAL OF THE CONCESSION AGREEMENT WITH MWSS Failure to secure the viability of the business due to adverse political and regulatory actions	In December 2019, the President threatened to revoke the extension of the concession agreement with MWSS due to supposed onerous provisions in the original contract, and commissioned an independent review of the provisions with the objective of revising the contract. Manila Water has cooperated with the national government in the review of the provisions of the original concession agreement as well as subsequent amendments, outcomes of past disputes and its performance in the delivery of service obligations. The Company has provided all pertinent information requested and continues to engage in conversations with designated government representatives on matters related to the planned revisions in the agreement. The Company continues to faithfully deliver on its service obligations to its customers under the terms of the concession agreement still in effect and the most recent MWSS-approved business plan.
2	OPERATIONAL RISK WATER SUPPLY Failure to ensure adequate water supply and deliver 24/7 potable water at ≥7psi across the service area	To ensure adequate raw water supply especially during the dry season, Manila Water continues to implement MWSS-approved short and medium-term water source development projects such as rehabilitated and new deep wells, rehabilitation of the Alat source, and the Wawa-Calawis and Laguna Lake East Bay sources. As of end of 2020, the stored water in Angat Dam and La Mesa were at maximum levels due to the prevailing extended La Niña. Prospects for summer of 2021 are better than in 2019 when there was a drought caused by an El Niño. Nevertheless, the Company has a summer contingency plan and is scheduled to undertake drills on critical core and support processes.
3	COMPLIANCE RISK CAPEX EXECUTION Failure to execute CAPEX plan per approved business plan on a timely manner and on cost basis, leading to tariff clawback and non-recoverability of expenses.	The Company conceptualized and implemented Project Ark, a cross-functional initiative that addresses the various risk drivers and gaps that lead to the delay in the execution of major capital works across the respective project life cycles, from project development to execution. The first phase of the program addressed core CAPEX processes, policies, tools, and structures critical to being able to fast-track the water supply and used water commitments and meet CAPEX delivery targets. Among the improvements in the CAPEX organizational structure and delivery strategy are: (a) creation of a more aligned and streamlined project team structure within Corporate Project Management Group (CPMG), (b) maximizing technical talents in the organization by decentralizing project execution, (c) establishing the Supply Chain Management Group to allow for a more flexible and targeted approach to procurement, (d) implementing a more structured and holistic approach to land acquisition, and (e) applying a more efficient revised approval process. The second phase of the project specifically addressed process improvements, aimed at further improving end to end CAPEX delivery by reducing touch points and cycle times across all critical processes. This sub-program aims to improve CAPEX throughput by utilizing workflows, automation, reports, and dashboards to improve visibility and streamline coordination across all units. A comprehensive dashboard to track the realized improvements arising from each component of the initiative is already in place.
4	COMPLIANCE RISK SEWER COVERAGE Failure to attain % sewer coverage target in accordance with the service improvement plan	Manila Water has a regulator-approved target for increasing sewer coverage in order to maximize the utilization of its wastewater treatment facilities whose design years coincide with the end of concession. Since laying down sewer lines usually encounter difficulties with local governments mainly due to traffic disruption concerns, the Company identifies alternative projects and approaches that will contribute to meeting the global sewer coverage performance. At the same time, the Company updates the regulator regularly on the progress of wastewater projects, presents and justifies any deviation from the original plans, and seeks feedback. This provides the regulator an overview of the progress and the challenges that the Company experiences and serves as a venue to secure support.
5	OPERATIONAL RISK INFO SECURITY & IT DISASTER RECOVERY Failure to ensure full security of enterprise data and faster recovery of IT systems after disruptions	On IT Disaster Recovery: A Disaster Recovery Plan was drafted in 2019 to serve as guide for the annual DR Drill. On Information Security: The following were implemented by the IT Group: Information Security Education Program (ISEP), End user security (MFA, SSPR, Mobile Security), Email security (SEG), Website hardening (MWC, CWC, LAWC), Anti-spoofing protocols, Approval of Information Security Management System (ISMS) and Cybersecurity incident policy/ procedures, Implemented 2020 IT Security Projects such as BitLocker implementation, Azure Information protection (AIP) for data classification, Assigning Data Loss Prevention policies to confidential information, Continued information security awareness program thru monthly module assignment, Cybersecurity drills, Workshops with different MW groups on data classification, Web security, Identity and access management and establishment of Security Operations Center (SOC), Insurance policies and enhancement of OPSCMS IT network security.
6	COMPLIANCE RISK WASTEWATER EFFLUENT COMPLIANCE (NUTRIENT REMOVAL) Failure to comply with the DAO 2016-008 revised effluent standards in accordance with DENR deadlines	Manila Water applied a four-pronged approach to manage the compliance risk associated with the revised effluent standards: Technical Track – Identified feasible technical solutions for each facility and accelerated the implementation to comply with DENR Administrative Order (DAO) 2016-08 before the Compliance Action Plan (CAP) deadlines. DENR/Laguna Lake Development Authority Track (LLDA) – Secured environmental regulator’s approval of the submitted Compliance Action Plans and established a legal defense strategy should any challenges arise. Stakeholder Track – Secured the buy-in of concerned Local Governmentv Units (LGUs) for the individual projects and timely acquisition of necessary project permits. MWSS Track – Secured the support of MWSS on the continuing implementation of facility and network retrofit plans vis a vis any outcomes of the various stakeholder-driven developments at the environmental policy maker (DENR).

Rank

2020 Enterprise Risks

Updates and Mitigation Strategies

POLITICAL-REGULATORY RISK

RENEWAL OF THE CONCESSION AGREEMENT WITH MWSS

Failure to secure the viability of the business due to adverse political and regulatory actions

In December 2019, the President threatened to revoke the extension of the concession agreement with MWSS due to supposed onerous provisions in the original contract, and commissioned an independent review of the provisions with the objective of revising the contract.

Manila Water has cooperated with the national government in the review of the provisions of the original concession agreement as well as subsequent amendments, outcomes of past disputes and its performance in the delivery of service obligations. The Company has provided all pertinent information requested and continues to engage in conversations with designated government representatives on matters related to the planned revisions in the agreement.

The Company continues to faithfully deliver on its service obligations to its customers under the terms of the concession agreement still in effect and the most recent MWSS-approved business plan.

OPERATIONAL RISK

WATER SUPPLY

Failure to ensure adequate water supply and deliver 24/7 potable water at ≥7psi across the service area

To ensure adequate raw water supply especially during the dry season, Manila Water continues to implement MWSS-approved short and medium-term water source development projects such as rehabilitated and new deep wells, rehabilitation of the Alat source, and the Wawa-Calawis and Laguna Lake East Bay sources.

As of end of 2020, the stored water in Angat Dam and La Mesa were at maximum levels due to the prevailing extended La Niña. Prospects for summer of 2021 are better than in 2019 when there was a drought caused by an El Niño. Nevertheless, the Company has a summer contingency plan and is scheduled to undertake drills on critical core and support processes.

COMPLIANCE RISK

CAPEX EXECUTION

Failure to execute CAPEX plan per approved business plan on a timely manner and on cost basis, leading to tariff clawback and non-recoverability of expenses.

The Company conceptualized and implemented Project Ark, a cross-functional initiative that addresses the various risk drivers and gaps that lead to the delay in the execution of major capital works across the respective project life cycles, from project development to execution.

The first phase of the program addressed core CAPEX processes, policies, tools, and structures critical to being able to fast-track the water supply and used water commitments and meet CAPEX delivery targets. Among the improvements in the CAPEX organizational structure and delivery strategy are: (a) creation of a more aligned and streamlined project team structure within Corporate Project Management Group (CPMG), (b) maximizing technical talents in the organization by decentralizing project execution, (c) establishing the Supply Chain Management Group to allow for a more flexible and targeted approach to procurement, (d) implementing a more structured and holistic approach to land acquisition, and (e) applying a more efficient revised approval process. The second phase of the project specifically addressed process improvements, aimed at further improving end to end CAPEX delivery by reducing touch points and cycle times across all critical processes. This sub-program aims to improve CAPEX throughput by utilizing workflows, automation, reports, and dashboards to improve visibility and streamline coordination across all units.

A comprehensive dashboard to track the realized improvements arising from each component of the initiative is already in place.

COMPLIANCE RISK

SEWER COVERAGE

Failure to attain % sewer coverage target in accordance with the service improvement plan

Manila Water has a regulator-approved target for increasing sewer coverage in order to maximize the utilization of its wastewater treatment facilities whose design years coincide with the end of concession.

Since laying down sewer lines usually encounter difficulties with local governments mainly due to traffic disruption concerns, the Company identifies alternative projects and approaches that will contribute to meeting the global sewer coverage performance. At the same time, the Company updates the regulator regularly on the progress of wastewater projects, presents and justifies any deviation from the original plans, and seeks feedback. This provides the regulator an overview of the progress and the challenges that the Company experiences and serves as a venue to secure support.

OPERATIONAL RISK

INFO SECURITY & IT DISASTER RECOVERY

Failure to ensure full security of enterprise data and faster recovery of IT systems after disruptions

On IT Disaster Recovery:

A Disaster Recovery Plan was drafted in 2019 to serve as guide for the annual DR Drill.

On Information Security:

The following were implemented by the IT Group: Information Security Education Program (ISEP), End user security (MFA, SSPR, Mobile Security), Email security (SEG), Website hardening (MWC, CWC, LAWC), Anti-spoofing protocols, Approval of Information Security Management System (ISMS) and Cybersecurity incident policy/ procedures, Implemented 2020 IT Security Projects such as BitLocker implementation, Azure Information protection (AIP) for data classification, Assigning Data Loss Prevention policies to confidential information, Continued information security awareness program thru monthly module assignment, Cybersecurity drills, Workshops with different MW groups on data classification, Web security, Identity and access management and establishment of Security Operations Center (SOC), Insurance policies and enhancement of OPSCMS IT network security.

COMPLIANCE RISK

WASTEWATER EFFLUENT COMPLIANCE (NUTRIENT REMOVAL)

Failure to comply with the DAO 2016-008 revised effluent standards in accordance with DENR deadlines

Manila Water applied a four-pronged approach to manage the compliance risk associated with the revised effluent standards:

Technical Track – Identified feasible technical solutions for each facility and accelerated the implementation to comply with DENR Administrative Order (DAO) 2016-08 before the Compliance Action Plan (CAP) deadlines.

DENR/Laguna Lake Development Authority Track (LLDA) – Secured environmental regulator’s approval of the submitted Compliance Action Plans and established a legal defense strategy should any challenges arise.

Stakeholder Track – Secured the buy-in of concerned Local Governmentv Units (LGUs) for the individual projects and timely acquisition of necessary project permits.

MWSS Track – Secured the support of MWSS on the continuing implementation of facility and network retrofit plans vis a vis any outcomes of the various stakeholder-driven developments at the environmental policy maker (DENR).

Report of the Board Risk Oversight
Committee to the Board of Directors

For the year ended December 31, 2020

The Board Risk Oversight Committee (“Risk Committee”) was established by the Board of Directors at its August 11, 2015 meeting to provide assistance in fulfilling the Board’s oversight responsibilities in relation to risk governance in Manila Water. The Risk Committee’s roles, responsibilities and authorities are defined in the Risk Committee Charter approved by the Board of Directors during its November 26, 2015 meeting.

In compliance with the Risk Committee Charter, the Committee confirms that:

An independent director chairs the Risk Committee. The Committee has three out of four members who are independent directors.
The Committee had four meetings during the year with the following attendance rate:

Directors	No. of Meetings Attended/Held	Percent Present
Jaime C. Laya	4/4	100%
Jose L. Cuisia, Jr.	4/4	100%
Oscar S. Reyes	4/4	100%
Gerardo C. Ablaza, Jr.	4/4	100%

The Committee discussed with Management significant risk exposures, the related risk-mitigation efforts and initiatives, and the status of the mitigation plans.
Appointed the Chief Finance Officer as concurrent Chief Risk Officer, and merged the Enterprise Risk Management and Sustainability departments.
Increased the number of Board Risk Oversight Committee meetings to quarterly, instead of semi-annual, to provide more time for deeper discussions on risk analysis as well as provide ample attention to the risks of new business operations.
The review was undertaken in the context that Management is primarily responsible for the risk management process.
The Committee has reviewed the Enterprise Risk Management Process in Manila Water Company, Inc. and is satisfied that sufficient risk management systems are in place.

February 11, 2021

JAIME C. LAYA
Chairman

GERARDO C. ABLAZA, JR.
Member

JOSE L. CUISIA JR.
Member

OSCAR S. REYES
Member

Enterprise Risk Management

Report of the Board Risk OversightCommittee to the Board of Directors

For the year ended December 31, 2020

Report of the Board Risk Oversight
Committee to the Board of Directors