The Enterprise Risk Management (ERM) Policy provides a structured framework for identifying, assessing, managing, and monitoring risks that could affect the organization's ability to achieve its objectives. It ensures that risk management is embedded into decision-making, planning, and daily operations.

Purpose

The policy aims to:

• Promote a consistent and proactive approach to risk management across all levels.
• Safeguard assets, reputation, stakeholders, and long-term sustainability.
• Enhance strategic and operational decisions while ensuring compliance with applicable laws, regulations, and standards.

Scope

The ERM Policy applies across all departments, business units, projects, and activities within the organization. Every employee — from the Board to operational staff — shares responsibility for identifying, reporting, and managing risks in their area of work.

Risk Management Framework

The policy follows international standards (e.g., ISO 31000) and includes the following core steps:

• Risk Identification: Recognizing internal and external threats and opportunities that may impact objectives.
• Risk Assessment: Analyzing likelihood and impact to prioritize risks for action.
• Risk Response: Selecting appropriate strategies — avoidance, mitigation, transfer, or acceptance.
• Monitoring & Reporting: Regular review, tracking, and transparent communication of risk status.
• Continuous Improvement: Learning from incidents and near-misses to strengthen organizational resilience.

Roles and Responsibilities

• Board of Directors: Provides oversight, approves risk appetite, and ensures accountability at the highest level.
• Executive Management: Implements risk strategies, integrates ERM into daily operations, and ensures policy compliance.
• Risk Management Committee: Coordinates enterprise-wide risk processes, evaluates risk reports, and advises leadership.
• Employees: Identify and report risks in their areas of work, and follow risk controls in day-to-day activities.

Risk Categories

Key risk categories include: strategic, operational, financial, compliance, reputational, technological, and environmental risks. The organization also considers emerging risks and opportunities. changes.

Reporting & Communication

A clear reporting structure ensures timely escalation of risks. Regular risk registers, dashboards, and reviews are maintained, and results are communicated across all levels.

Conclusion

The ERM Policy establishes a culture of risk awareness, accountability, and continuous improvement. By embedding risk management into the organization’s strategy and daily operations, Covenant Microfinance Bank Ltd supports sustainable growth and builds resilience against uncertainties.