Risk and Crisis Management
Supporting the Sustainable Development Goals
Targets
- Communicate and raise awareness on Personal Data Protection (Personal Data Protection Policy) to 100% of employees at all levels by 2026
- Communicate and raise awareness on information and information system security to 100% of employees at all levels
Performance
Challenges and Opportunities
The information and communication technology (ICT) and telecommunications industry is undergoing rapid changes from both domestic and international factors. Fluctuations in the global economy, inflation, and interest rates affect investment decisions of both the public and private sectors, as well as the operational costs of businesses. At the same time, competition in the industry has become increasingly intense in terms of pricing, technology, and the ability to deliver end-to-end integrated projects.
Another significant challenge is the rapid advancement of technology, such as digital communication systems, intelligent networks, cybersecurity, and digital solutions for enterprises. This requires companies to continuously develop expertise, personnel, and innovation, as well as manage risks related to regulations, standards, and governance. Nevertheless, these challenges also present business opportunities for companies to expand their role toward becoming comprehensive digital solution providers. The application of modern technologies in project design, installation, and management helps improve efficiency, reduce costs, and appropriately meet customer needs.
In addition, the development of standardized risk management systems and corporate governance helps strengthen confidence among customers, partners, and stakeholders, as well as enhance competitiveness and support the company’s stable and sustainable long-term growth.
Management Approach and Value Creation
The Company has systematic and continuous risk management under a risk management process that is standardized across all departments, by utilizing information technology to enable speed in communication and processing, as well as requiring monitoring and evaluation, together with regularly adjusting the risk management plan periodically in order for operations to achieve the objectives.
Risk Management Process
The Company has applied the COSO Enterprise Risk Management - Integrated Framework 2017 (2017 COSO ERM) together with the sustainability approach (Environmental, Social and Governance: ESG) in the risk management process, by applying various risk management tools such as the determination of the level of risk the organization is willing to accept (Risk Appetite), risk assessment and prioritization using a risk map (Risk Map), risk monitoring through a risk management plan (Mitigation Plan), and key risk indicators (Key Risk Indicator: KRI). The risk management process consists of 8 steps as follows:
Risk Factors Affecting the Company’s Business Operations
| Risk Category | Risk Description | Business Impact (Inside–Out) | Business Impact (Outside–In) | Risk Level |
|---|---|---|---|---|
| Environmental | Energy consumption in data centers and ICT equipment e-waste | Carbon emissions from construction activities and data center operations | Increasingly strict environmental regulations and rising energy costs | High |
| Social | Shortage of technology workforce, safety risks in installation projects | Career development and local employment opportunities | Growing societal expectations for corporate responsibility and workplace safety | Very High |
| Governance | Cybersecurity risks, compliance issues and fraud | Governance and data risk management | Legal risks related to PDPA and ESG disclosure requirements | Very High |
| Technology | Technology obsolescence | Adoption and integration of new technologies | Risks from rapid technological change and skill gaps | Medium–High |
| Economics and Financial | Fluctuations in project costs and supply chain disruptions | Value creation through large-scale projects | Supply chain risks and financial cost volatility | Medium |
Establishing a Risk Culture in the Organization
The Company places importance on instilling a risk management culture throughout the organization by defining clear policies and operational guidelines, together with the use of competency assessment indicators (Competency) to evaluate and monitor performance, in order to strengthen confidence in achieving objectives effectively.
In addition, the Company also promotes employees at all levels to recognize the importance of risks and to have systematic management in place to appropriately cope with changes and challenges, by requiring quarterly risk reviews, including monitoring newly emerging risks (Emerging Risk) to cover both internal and external factors in terms of environmental, social, economic, and governance aspects.
In this regard, the Risk Management Committee plays a role in supervising, monitoring, and providing recommendations to ensure that risks remain at an acceptable level, as well as driving key specific policies such as business continuity management, personal data protection, and anti-corruption, in order for risk management to become a part of the organizational culture in a sustainable manner.
Business Continuity Management (BCM)
The Company recognizes the importance of being prepared to respond to and mitigate the impacts of crisis situations while ensuring the continuity of business operations. This approach aims to maintain confidence among customers, employees, investors, shareholders, business partners, communities, and society. The Company’s Business Continuity Management policy follows best practices and provides a comprehensive framework for developing and implementing business continuity plans, which include the following objectives:
