Mitr Phol conducts business in accordance with good corporate governance principles, business ethics, and a systematic approach to risk management, ensuring efficient, transparent, and accountable operations. This approach supports long-term sustainable growth and builds confidence among stakeholders. The Company has established corporate governance policies and guidelines that define the roles and responsibilities of directors, executives, and employees at all levels. The Mitr Phol Code of Conduct serves as a guiding framework for all personnel in collectively driving the organization forward.
Mitr Phol requires its Risk Management Policy and Charter to be reviewed every three years or whenever significant changes occur. The Company also aims to embed a strong risk management culture as a foundation across the organization. Mitr Phol has been committed to promoting knowledge and understanding among employees, encouraging them to recognize risk management processes as valuable tools in their operations.
In 2025, key initiatives undertaken to strengthen this culture included:
Raising awareness of the updated risk management policy among directors, executives, and employees through various channels, such as internal communications and business unit risk management representatives.
Risk trends and key issues impacting the Company are shared with directors and executives on a quarterly basis. In addition, basic risk management training is provided to employees at the officer level and above through the Company’s designated learning platform.
Raising knowledge and awareness of domestic and international risk trends relevant to the Company and its employees through infographics and 12 podcast episodes on the Shared Point GRC Channel, which has over 1,000 followers.
Improving business continuity readiness through Business Continuity Plan (BCP) drills conducted at 10 locations to strengthen preparedness and response to potential threats, as well as expanding BCP development to two additional locations within the Group.
Mitr Phol has adopted the COSO Enterprise Risk Management Integrated Framework as a key tool for designing its risk management process. The Company emphasizes effective, transparent, and sustainability-aligned risk management practices. The Board of Directors has delegated oversight of the implementation of the Risk Management Policy and framework to the Risk Management Committee. The Committee is responsible for monitoring the overall risk management process and the adequacy of measures for managing key risks within the defined risk appetite. The Risk Management Department is responsible for communicating the policy opinions, and recommendations from the Board and the Committee to relevant business units and coordinating organization-wide implementation. It oversees risk management across five key risk areas: strategic, operational, digital and technology, financial and legal and regulatory compliance. The Department also reviews, monitors, and reports significant risks to the Risk Management Committee and the Board of Directors to ensure they are informed of the Company's risk management performance on an annual basis. The Risk Management Department reports directly to the Governance, Risk, and Compliance Division under the Corporate Sustainability Sub-Business Group, which operates independently from the core businesses.
Mitr Phol management structure is designed with clearly defined roles and responsibilities for each unit, based on the"Three Lines of Defense" model. This approach ensures independence among operational processes, promotes transparency in collaboration between executives and employees at all levels, and aligns with international standards. It supports effective risk management through the following structure:
Multiple threats have the potential to disrupt operations and lead to business interruptions. To address these risks, Mitr Phol Group has implemented a Business Continuity Management System (BCMS) based on the ISO 22301:2012 standard. This system is designed to cover risk identification, strategic and prevention development, preparedness, response, communication, and recovery. The Company conducts annual reviews and drills of its Business Continuity Plan (BCP) to ensure organizational readiness in responding to various threats. These activities are aligned with current risk assessments, including natural disasters, cyber threats, terrorism, and pandemics. In addition, these activities raise awareness among executives and relevant employees of the importance of their roles and responsibilities and the communication protocols established under the plans.
In 2025, Business Continuity Plan (BCP) reviews and drills were conducted in 10 locations, and BCP development was expended to 2 additional locations to ensure coverage across the Group, including both factory sites and the Company's head office. These exercises were led by the Risk Management Department in collaboration with the Safety, Occupational Health, and Environment Department, and covered the Emergency Response Plan (ERP), Business Continuity Plan (BCP), Recovery Plan (RP), and Crisis Communication Plan, involving executives, employees, and relevant stakeholders. The Company also supports all factory sites in establishing clear and practical BCP procedures that can be readily implemented. In addition, a BCP handbook has been developed to guide the implementation and regular review of location-specific business continuity plans.
The Company raises awareness among personnel that integrating risk management into operations enables the organization to effectively manage risks at all levels, while promoting operational efficiency and sustainable growth. Accordingly, Mitr Phol has established a Risk Management Policy, which was reviewed and approved by the Board of Directors, to provide a framework and methodology for identifying, assessing, and managing potential risks within the organization, and communicates through various channels to stakeholders.
The Company also provides tailored risk management training and education for the Board of Directors, the Risk Management Committee (both executive directors and non-executive directors), executives, and employees at all levels, based on their roles and responsibilities. This is delivered through a variety of formats and communication channels, including expert guest lectures, workshops, internal PR materials, and the Mitr Samphan internal magazine, aiming to encourage employee engagement in preventing and managing organizational risks.
In 2025, the Risk Management Department organized quarterly guest lectures by external experts on various topics, including Safety Transformation: Transforming Mindsets for Sustainable Accident Management, and Scenario Planning for Organizations. Business Continuity Plan (BCP) training was provided to new employees, while BCP drills for employees at the officer level and above. A total of 4,300 employees received annual risk management training. In addition, the Risk Management Department produced 12 episodes of the GRC Podcast Series and communicated strategic risk trends bi-weekly through the SharePoint GRC Channel, which serves as a modern and accessible communication channel.
