Pakistan Stock Exchange

Risk Management Policy Extracts

September 2020
Table of Contents

Purpose
Scope
Key definition
Mandate and commitment
Policy statement
Risk Categories
Risk Management
Framework
Governance structure
Risk management process
Roles and responsibilities
Communication of the
policy
Review of the policy
 Purpose

 The purpose of this policy is creation and protection of values. It improves performance, encourage
innovation and support the achievement of objective.
 The purpose of making this policy is to create and proactive environment where risks are managed
in responsible and systematic manner which may Assis the BOD of the PSX in implementing an
effective framework for managing risk
 This includes integrating risk management principle into key decision making, core activities and
process.

Scope

This policy is a part of overall risk management framework of PSX and applies to all departments.

Mandates and Commitments

PSX's Board unequivocacally commits to sustain strong, efficient and effective risk management across PSX's
and supported by the risk management team. Hence, the Board shall:

 Retain the responsibility for risk management whilst delegations the oversight to the Board 's Audit
Committee.
 Align risk management objectives with strategies of PSX.
 Assign accountability for the maintenance of the Risk Register, and the execution of Risk
mitigation action and operational activities to the Managing Director.
 Conduct review of this policy once in every three years of earlier if required to ensure that it
remains appropriate to PSX's operating context.
 Ensure that necessary resources are allocated to Risk Management.

PSX's commitment to Risk management is confirmed by the BOD's approval of the Risk Management Policy.

POLICY STAEMENT

PSX is committed to making Risk informed decision by identifying, analyzing, prioritizing and mitigating the
risk that may have an impact on PSX achieving its strategic goals, operational day to day activates and
projects.
For PSX to fulfill its Commitments, the following principles should be followed/adhered:

 Risk management should be an integral part of all PSX activates.

 A structural and comprhensive approach to risk mangement will contibute to consistent and
comparible Approach.
  The RMF and processes are customized to the PSX's external/internal content related objectives.
 Appropriate and timely involvement of stakeholders enables their knowledge, views for critical
decisions. This results in improved awareness and informed Risk Mangement.
 Risk can emrge, change or disappears as PSX's external/ internal contexts changes. Risk
mangement anticipates, detects, acknowledges and responds to those changes and events in an
appropriate and timely manner.
 Risk mangement explicitly takes into account any limitation and uncertainties associated with such
information and expectations. Information should be timely, clear and available to relevant
stakeholders.
 Human behavior and culture may significantly influence all aspects of risk mangement at each level
and stage.
 Risk management practices are continually improved through learning and experiences.

RISK CATEGORIES

PSX is exposed to various type of risks including, strategic, business, credit, market, liquidity, operational, IT
and security and compliances risk etc.
Following are the description of these risks which the mangement of PSX ensure effectively.

Risk Category Description

Strategic and Business The risk of material adverse changes to PSX's business performance,
risk development prospects and ability to deliver its strategy, caused by changes in
business, economic, competitive, regulatory or political environment due to
political instability, poor insight of mangement and failure of future incentives.

Credit risk The risk that a counterparty will not settle and obligation in full value.

Market Risk The risk resulting in adverse movement in market rates or prices such as
foreign exchange rates, interest rates and equity prices impacting PSX's
investment portfolio.

Liquidity risk The risk of being unable to fulfill obligation on due date.

Operational Risk The risk of financial, legal and reputational loss or inability to deliver products
or services on timely/affective manner due to failed internal process.

Information technology Technology failure includes service outage or projects which goes over budget
and fails to meet the goals set out in its business plan etc.

Information Security risk The risk of financial, legal and reputational loss or inability to deliver products
or services on timely/affective manner due to unauthorized access, use,
modification or destruction of organizational data/system.

Compliance Risk The risk of loss resulting from breach of applicable laws and regulations.

Reputational Risk The risk of damage of PSX's brand and reputation and associated risk to
 profitability, capital or liquidity arising from any unethical action which could
be perceived by the stakeholder to be inappropriate or inconsistent with the
values and beliefs of PSX.

RISK MANAGEMENT FRAMEWORK

The purpose of the RMF is to assist PSX in integrating risk management into significant activates and
function. The effectiveness of risk management will depend on its integration into the governance of the
organization, including decision-making.

GOVERNACE STRUCTURE OF PSX

To ensure the effectiveness of PSX's RMF, the BOD relay on adequate lune function.

 The first line- most directly aligned with the delivery of services to stakeholders. It is
responsible for identifying, assessing and managing risk i.e. operational mangement.
 The second line- provide complementary expertise, support and monitoring mangement risk.
-Development, implementation and continuous improvement so risk mangement policy.
-Achievement of risk mangement objective
-Provide analyst and reports to board committee.
 The third line- provide independent assurance to BOD over adequacy and effectiveness of
governess.

RISK MANGEMENT PROCESS

Following is an overview of the risk mangement process that should be applied to key decision

Communication and The management of PSX need to be made aware that whenever significant
consolation decision need to take place and that should be supported by risk assessment and
need to be communicate the outcome to decision makers.

Scope context and Establishment and understanding the context of decision, planning the approach
criteria to be taken the criteria for risk evaluation.

Risk basement The purpose of risk basement is to finds, recognize and describe risks that might
help or prevent PSX from achieving its objective.

Risk treatment It involve process of:

-Formulating and selecting risk treatment option
-planning and budgeting
-assessing the effectiveness of treatment to be implement
 -deciding whether the risk is acceptable
Monitoring sniff review The results of monitoring and review should be incorporated with PSX
performance mangement.

Recording and Reporting should enhance the equality of dialogue with stakeholder and support
reporting top management and oversight bodies.

Roles and Responsibility

BOD
 -To ensure formulation and maintained of PMF
 -Review and approve
 -To ensure necessary resources
 -To ensure key dictions are made after proper
understanding.
 -To regular review any significant risk issue

Audit committee
 -To ensure that proper system is installed.
 -To ensure that timely access to inform is
made available
 -Monitoring and review and all controls'-
 -To review policy and provide
recommendation

CEO
 -ensure that RMF is implemented
 -Ensure there is periodic review of policy and
implementation
 -Provide timely disclosure for significant risk
 -Allocate resources necessary to perform business
activities.

Risk management depart

 -To design and implement RMF
 -Review policy of exchange
 -Provide risk management
training
 -Periodic reporting to audit
committee

Compliance unit
  to ensure compliance with applicable laws
 to provide summary data nor report
findings.
 Ensure regulatory enforcement are
implemented.

COMMUNICATION OF POLICY

The RMD will be responsible for initial awareness to all staff

The HR will be responsible in providing policy to new staff.