Enterprise Risk Management (ERM) in Manila Water

We operate in a regulated and dynamic business environment where uncertainties abound. We are accountable to our regulators, shareholders, employees, and customers, among others, even as profitability, sustainable development, and corporate social responsibility are expected to be continuously enhanced. To achieve our corporate objectives, we recognized the need for the active identification and management of risks inherent in our business.

We continue to implement the Enterprise Risk Management (ERM) Program based on a globally accepted approach, the ISO 31000:2018, which has been cascaded across the Company including subsidiaries in our NEZ PH and International businesses to ensure the attainment of our objectives.

The ERM Program operationalizes our Manual of Corporate Governance which mandates the Board of Directors (BOD) to ensure the presence of organizational and procedural controls. This should be supported by an effective management information system and risk management reporting system.

In addition, our Board Risk Oversight Committee (BROC) provides oversight to management functions relating to strategic, financial, operational, compliance, legal, environmental, social, and other risks facing the company. This involves the periodic disclosure of significant risk exposures and related risk management activities.

In its Report to the BOD for the year ended December 31, 2024, the BROC confirmed that it had discussed significant risk exposures, related risk-mitigation efforts and initiatives, and the status of the identified mitigation plans. The report indicates that the review of the BROC was conducted in the context that Management is primarily responsible for the risk management process. The BROC meets quarterly to discuss matters related to risks, i.e., risk analysis and mitigation, as well as a discussion of top and emerging risks.

The President is the comprehensive risk executive and is ultimately responsible for ERM priorities, strategies, tolerances, and policies. He chairs the Enterprise Risk Management Executive Committee (ERMEC) composed of Senior Leadership Team (SLT) members including the Chief Risk Officer (CRO).

The ERMEC was established to oversee and ensure the efficient and effective management of our enterprise risks while the leadership team of each strategic business unit (SBUs) provides oversight and input to the President and to the Board on all relevant information regarding risks. This is to enable the formulation of better and more informed decisions.

The success of the ERM program depends heavily on the framework which will provide the core principles and processes to meet the needs of the business.

FRAMEWORK AND PROCESS

The ERM Framework is grounded in a strong and sustained commitment of senior management to risk management and is facilitated by defining risk management policies and objectives. This helps ensure legal and regulatory compliance by providing the necessary allocation of resources to risk management and by communicating the benefits of risk management to all stakeholders. Correspondingly, the ERM process is designed to be an integral part of our management, practices, and culture.

ERM STRUCTURE

MANAGEMENT OF TOP ENTERPRISE RISKS

The ERMEC determines the most significant risks facing the Company. The Senior Leadership Team (SLT) together with the CRO convene as the ERMEC. The SLT consists of: 1) President and CEO; 2) Chief Administrative Officer and Chief Operating Officer (COO) for Non-East Zone (NEZ) International Business; 3) Chief Regulatory Officer; 4) COO for East Zone (EZ); 5) COO for NEZ in the Philippines; 6) Chief Finance Officer and 7) Chief Legal Counsel and Chief Compliance Officer.

For both Manila Water EZ and NEZ businesses, risks are being managed by the strategic business units’ (SBUs) respective Leadership Teams (LT), headed by their COOs. They oversee the effective risk management in each respective business unit within the SBU. They are responsible for establishing, maintaining, and reviewing procedures at management and tactical levels to identify, assess and measure, and mitigate risks in accordance with the Company’s enterprise risk management policy.

The management of top enterprise risks is cascaded down to the department level and delegated to respective Risk Owners. Risk Owners formulate and commit to a risk management plan, monitored by the ERM department, which defines specific action points, accountability, milestones and timeline. The status of the Top Enterprise Risks is regularly discussed at the ERMEC and the respective SBU LTs. Finally, the findings are reported to the BROC.

The Chief Risk Officer

The CRO oversees the entire risk management function and leads the development, implementation, maintenance, and continuous improvement of the ERM program, processes, and tools. The CRO is the Vice Chairman of the ERMEC. She also leads the Enterprise Risk Management (ERM) Department in facilitating the ERM process. This involves collecting and analyzing key business risk information for reporting to the ERMEC and the BROC.

Enterprise Risk Management Department

The ERM Department is responsible for the development of risk management tools, methodologies and processes, as well as the sustained implementation of the ERM Program across the Company. It acts as the primary driver of developing a risk-aware culture and ensures that key risks are identified and managed by respective risk owners. With the ERM mindset continuously being assimilated into our culture and practices, ERM has been embedded in key decision-making processes.

2024 RISK ASSESSMENT

The Risk Assessment was conducted using both top-down and bottom-up approaches to determine the top enterprise risks for 2024. A year-end reassessment was also implemented to gauge the effectiveness of mitigation methods and strategies.