PROCESS RISK Process risk is the risk that the firm's business processes are not effectively acquiring, managing, renewing & disposing the assets of the businéss; are not clearly defined; are poorly aligned with the strategies driving the firm’s business model; are not performing effectively & efficiently in satisfying customer needs; are not creating value; or are diluting value by exposing significant financial, physical, information & intellectual assets to unacceptable losses, risk-taking, misappropriation or misuse. These risks affect the success with which the firm executes its business model. ‘A. Operations risk Operations risk is the risk that operations are inefficient & ineffective in executing the firm's business model, satisfying customers & achieving the firm's quality, cost & time performance objectives. 1. Customer satisfaction risk. A lack of focus on customers threatens the firm's capacity to meet or exceed customer expectation : 2. Human resources risk. A lack of requisite knowledge, skills & experiences among the firm's key personnel threatens the execution of its business model & achievement of critical business objectives. | 3. Knowledge capital risk. Processes for capturing & institutionalizing learning across the firm are either non-existent or ineffective, resulting in slow response time, high costs, repeated mistakes, slow competence development, constraints on growth & unmotivated employees. _ Product development risk. ineffective product development threatens the firm’s ability to meet or exceed customers’ needs & wants consistently over the long term. Efficiency risk. Inefficient operations threaten the firm’s capacity to produce goods or | services at or below cost levels incurred by competitors or world-class performing companies. Capacity risk. insufficient capacity threatens the firm's ability to meet customer demands or excess capacity threatens the firm’s ability to generate competitive profit margins. Performance gap risk. inability to perform at world-class levels in terms of quality, cost &/or cycle time performance due to inferior internal operating practices &/or external; relationships threaten the demand for the firm's products or services. Cycle time risk. Unnecessary activities threaten the firm's capacity to develop, produce & | deliver goods or services on a timely basis. Sourcing risk. Limited resources of energy, metals & other key commodities, raw materials & component parts threaten the firm's abilty to produce quality products at competitive prices on a timely basis. 10. Channel effectiveness risk. Poorly performing or positioned distribution channels threaten the firm’s capacity to effectively & efficiently access current & potential customers & end users. 25A. Operations risk (cont'd) MW. Partnering risk. inefficient or ineffective alliance, joint venture, affiliate & other external relationships affect the firm’s capability to compete. These uncertainties arise due to choosing the wrong partner, poor execution, taking more thar given (resulting in loss of a partner) & failing to capitalize on partnering opportunities. 12. Compliance /Regulatory risk. Non-compliance with customer requirements, prescribed organizational policies & procedures or laws & regulations may result in lower quality, higher production costs, lost revenues, unnecessary delays, penalties, fines etc. 13. Business interruption risk. Business interruptions stemming from unavailability of raw materials, information technologies, skilled labors, facilities or other resources threaten the firm's capacity to continue operations. 14. Product/service failure risk. Faulty or non-performing products or services expose the firm to customer complaints, warranty claims, field repairs, returns, product liability claims, litigation & loss of revenues, market share & business reputation. 15. Environmental risk. Activities harmful to the environment expose the firm to liabilities for 16. 17. bodily injury, property damage, cost of removal, punitive damages. Health & safety risk. Failure to provide a safe working environment for its workers exposes the firm to compensation liabilities, loss of business reputation & other costs. Trademark/brand erosion risk. Erosion of a trademark or brand over time threatens the demand for the firm's products or services & impairs its ability to grow future revenue streams. 18. 19. Plant shutdown risk. Unscheduled interruption in plant operations resulting to disruptions in product supply. Supplier reliability risk. Failure to ensure stable delivery of products & services at the right quality, quantity, time and least cost, which exposes the Company to customer dissatisfaction and losses. _ 20. Project Risk. Faulty planning or management of projects that results in ineffective and/or inefficient project results in longer duration, higher cost or inability to meet the users’ requirements. 21. 22, 23. Counter-party Credit Risks are the class of credit risks that principally occur from transactions where reciprocal obligations are made between Petron and counter-parties or customers. In FX products, two types of counter-party credit risks arise from the simultaneous exchange of currencies contemplated in FX contracts. Settlement Risk (SR) arises on the settlement or maturity date of the FX contract, vihen verification of payment from the counter-party is not received until after Petron’s own payment is already delivered. Non-delivery of payment by the counter-party exposes Petron to direct credit risk of 100% of the value of all maturing contracts - starting on the settlement date until the confirmation of receipt of counter-value funds. Pre-settlement Credit Risk (PSR) is the risk that Petron’s counter-party bank experiences a “credit event” (e.g. the counter-party fails or defaults) prior to the settlement date of a transaction and will be unable to fulfill its FX Contract obligation. PSR is the potential economic cost to Petron to replace an FX contract in the market due to a counter-party’s credit failure. 26B. Financial Risk Financial risk is the risk that cash flows & financial risks are not managed cost-effectively to a) maximize cash availability b) reduce uncertainty of currency, interest rate, credit & other financial risks, or c) more cash funds quickly & without loss of value to wherever they are needed most. Price risk. Price risk is the exposure of earnings or net worth to changes in market factors (e.y. interest rates, currency rates, etc.) which affect income, expense or balance sheet values. 1. Interest rate risk. Significant .movements in interest rates expose the firm to higher borrowing costs, lower investment yields or decreased asset values. 2. Currency/foreign exchange risk. Volatility in foreign exchange rates exposes the firm to economic & accounting losses. ‘Audit: Fluctuations in foreign currency rates, which expose the Company to foreign exchange losses. 3. Equity risk. Exposure to fluctuations in the value of equity securities or income streams from equity ownership or trading losses. 4. Commodity pricing risk. Fluctuations in commodity prices expose the firm to lower product margins or trading losses. 5. Financial instrument risk. Exposure to excessive management costs or losses due to complexity or unintended consequences of financial instrument structures. 6. Financing risk (Audit). The inability to source money to support operations & other business activities, which results to operational disruptions & lost business opportunity. Pricing risk. Inability to adjust prices to fully recover all costs in a timely manner that results in profit deterioration or loss. 7. Crude Price Volatility Risk. Fluctuations in crude prices, which expose the Company to losses due to higher borrowings, under-recovery in domestic prices and in the case of price decline, inventory loss. 8. Market risk. Adverse movement in market prices or rates resulting to loss in financial instrument. Sources are interest rates, equities, forex & commodities. Liquidity risk Liquidity risk is the exposure to loss as a'result of the inability to meet cash flow obligations in a timely & cost-effective manner. It also includes the exposure of asset valuations or traded positions to an imbalance or lack of buyers & sellers in a particular market, i.e. an illiquid market. 1. Cash flow risk. Exposure to lower returns or the necessity to borrow due to shortfalls in cash or expected cash flows (or variances in their timing). 2. Opportunity loss risk. The use of funds in a manner that leads to the loss of economic value, including time value losses & transaction costs.” 273. Concentration risk. Exposure to loss due to participation in a narrow market consisting of | a limited group of counter-parties resulting in inability to consummate transactions at | reasonable prices within a reasonable time frame. Credit risk ‘The exposure to actual loss or opportunity cost as a result of the default (or other failure to perform) by an economic or legal entity (debtor) with which the company does business. 1.__ Default risk. A counter-party to a financial transaction is unable to fulfill its obligations. 2. Concentration risk. Exposure of a significant portion of business to a company or group of | ‘companies that are similarly impacted by events. 3. Settlement risk. Different settlement times between the capital markets of the firm & its counter-parties expose the firm to a short-term risk of counter-party default on obligations. c Collateral risk. The loss of value or inability to secure control of an asset provided to a firm as a security. C. Empowerment risk Empowerment risk is the risk that managers & employees a) are not properly led b) don't know what to do when they need to do it c) exceed the boundaries of their assigned authorities d) given Incentives to do the wrong thing 1. Leadership risk. The firm's people are not being effectively led, which may result in a lack of direction, customer focus, motivation to perform, management credibility & trust throughout the firm. 2. Authority/limit risk. ineffective lines of authority may cause managers or employees to do things they should not do or fail to do things they should. Failure to establish or enforce limits on personnel actions may cause employees to commit unauthorized or unethical acts or to assume unauthorized or unacceptable risks. 3. Outsourcing risk. Outsourcing activities to third parties may result in the third parties not acting with the intended limits of their authority or not performing in a manner consistent | with the firm's strategies & objectives. Performance incentives risk. Unrealistic, misunderstood, subjective or non-actionable performance measures may cause managers & employees to act in a manner inconsistent with the firm's objectives,. strategies & ethical standards or prudent business practice. cua 5. Change readiness risk. The people within the firm are unable to implement process & product/service improvements quickly enough to keep pace with changes in the marketplace. 6. Communications risk. ineffective communication channels may result in messages that are inconsistent with authorized responsibilities or established performance measures. 7. HR risk. Lack of required knowledge, skills & experiences, which threatens accomplishment of critical business objectives. Ineffective staffing, rewards, and | manpower development strategies resulting in high employee costs, slow competence | - 28 \development, and low employee morale & productivity. __ i D. Information processing/technology risk Information processing technology risk is the risk that the information technologies used in the firm a) are not operating as intended, b) are compromising the integrity & reliability of data & information, ©) are exposing significant assets to potential loss or misuse, or d) are exposing the firm’s ability to sustain the operation of critical processes. 1. Relevance risk. Irrelevant information created or summarized by an application system | may adversely affect users’ decisions. | Integrity risk. All of the risks associated with the authorization, completeness & accuracy of transactions as they are entered into, processed by, summarized by & reported by the various application systems deployed by the firm. 3. Access risk. Failure to adequately restrict access to information (data or programs) may result in unauthorized knowledge & use of confidential information, or overly restrictive access to information may preclude personnel from performing their assigned responsibilities effectively & efficiently. | 4. Availability risk. Unavailability of important information when needed threatens the continuity of the firm's critical operations & processes. | 5. Infrastructure risk. The risk that the firm does not have the information technology infrastructure (e.g. hardware, networks, software, people & processes) it needs to effectively support the current & future information requirements of the business in an efficient, cost-effective & well-controlled fashion. E._ Integrity risk Integrity risk is the risk of management fraud, employee fraud, illegal acts & unauthorized acts, any or all of which could lead to reputation loss in the marketplace. 1. Management fraud risk. Intentional misstatement of financial statements or misrepresentation of the firm's capabilities or intentions may adversely affect external stakeholders’ decisions. 2. Employee/third party fraud risk. Fraudulent activities perpetrated by employees, customers, suppliers, agents, brokers or third-party administrators against the firm for personal gain (e.g. misappropriation of physical, financial or information assets) expose the firm to financial loss. 3. Megal acts risk. \Wlegal acts committed by managers or employees expose the firm to fines, sanctions & loss of customers, profits & reputation etc. 4, Unauthorized use risk. Unauthorized use of the firm's physical, financial or information assets by employees or others exposes the firm to unnecessary waste of resources & financial loss. : 5. Reputation risk. Damage to the firm’s reputation expdses it to loss of customers, profits & the ability to compete. 29 \INFORMATION FOR DECISION-MAKING RISK Information for decision-making risk is the risk that information used to support the execution of the business model, the internal & external reporting on performance & the continuous evaluation of the effectiveness of the firm’s business model is not relevant or reliable. These risks relate to every aspect of the firm's value creation activities. A. Process/operational information for decision-making risk Product/service pricing cisk. Lack of relevant &/or reliable information supporting pricing decisions may result in prices or rates that customers are unwilling to pay or that do not cover development & other costs or do not cover the cost of risks undertaken by the firm. 2. Contract commitment risk. \ack of relevant &/or reliable information concerning contractual commitments outstanding as of a point in time may result in subsequent incremental contractual commitment decisions that are not in the best interests of the firm. 7 a 3. Measurement (operations) risk. Non-existent, irrelevant &/or unreliable non-financial measures may cause erroneous assessments of & conclusions about operational performance. s 3 Alignment risk, Failure to align business process objectives & performance measures with enterprise-wide &/or operating unit objectives & strategies may result in conflicting, uncoordinated activities throughout the firm. B. Business reporting information for decision making risk 1. Budget & planning risk. Non-existent, unrealistic, irrelevant or unreliable budget & planning information may cause inappropriate financial conclusions & decisions. 2, Accounting information risk. Overemphasis on financial accounting information to ‘manage the business may result in the manipulation of outcomes to achieve financial targets at the expenses of not meeting customer satisfaction, quality & efficiency objectives. Z 3. Financial reporting evaluation risk. Failure to accumulate relevant & reliable external & internal information to assess whether adjustments to or disclosures in financial statements are required may result in the issuance of misleading financial reports to external stakeholders. 4. Taxation risk. Failure to accumulate & consider relevant tax information may result in ‘non-compliance with regulations or adverse tax consequences that could have been avoided had transactions been structured differently. 30Pension fund risk. incomplete &/or inaccurate information pertaining to compensation & | benefits (ie. pension plans, deferred compensation plans, retiree medical plans, etc.) may | preclude the firm from meeting its defined obligations to employees on a timely basis & result in a loss of morale & reputation, work stoppages, litigation & additional funding requirements. = Investment evaluation risk. Lack of relevant &/or reliable information supporting investment decisions & linking the risks undertaken to the capital at risk may result in poor investment decisions. ‘Regulatory reporting risk. incomplete, inaccurate &/or untimely reporting of required financial & operating information to regulatory agencies may expose the firm to fines, penalties & sanctions. ae CC. Environment/strategic information for decision-making risk a Environmental scan risk. Failure to monitor the external environment or formulation of unrealistic or erroneous assumption about environment risks may cause the firm to retain business strategies long after they have become obsolete. Business model risk. The firm has an obsolete business model & does not recognize it | &/or lacks the information needed to make an up-to-date assessment of its current | model & build a compelling business case for modifying that model on a timely basis. | Business portfolio risk. Lack of relevant & reliable information that enables management | to effectively prioritize its products or balance its businesses in a strategic context may | preclude a diversified firm from optimizing its overall performance. | Valuation risk. Lack of relevant & reliable information may preclude owners or prospective owners from making informed assessments of the value of the firm or any of its | significant segments in a strategic context. Organizational structure risk. Management lacks the information needed to assess the effectiveness of the firm’s organizational structure, which threatens its capacity to change or achieve its long-term strategies. Measurement (strategy) risk. Non-existent, irrelevant or unreliable performance measures that are inconsistent with established business strategies threaten the firm's ability to execute its strategies. Resource allocation risk. An inadequate resource allocation process & the information supporting it may preclude the firm from establishing & sustaining competitive advantage or maximizing shareholder returns (e.g. channeling scarce resources toward those opportunities that provide the best prospects for balancing risk & reward.) Planning risk. An unimaginative & cumbersome strategic planning process may result in | irrelevant information that threatens the firm's capacity to formulate viable business strategies. Life cycle risk. Lack of relevant & reliable information that enables management to manage the movement of its product lines & monitor.the evolution of its industry along | the life cycle threatens the firm's capacity to remain competitive. 31