Risk Management of PT Alamtri Resources Indonesia Tbk

The business and operational activities of PT Alamtri Resources Indonesia Tbk, which are performed by its subsidiaries, are exposed to various risks that may negatively impact on the company’s operational continuity and business sustainability. Thus, AlamTri and its subsidiaries (“the AlamTri Group”) must identify the risks in order to prepare a set of effective risk management strategies to be implemented in a wellstructured, systematic, and consistent manner by all levels of the organization. These strategies must be applied in each of the company’s activities, particularly in making operational and financial decisions significant to the business sustainability, to support the company in increasing shareholder value through sound business growth

Risk Management Policy of PT Alamtri Resources Indonesia Tbk 

AlamTri has established Risk Management Sponsor Committee, Risk Management Unit, and Risk Champions to support risk management comprehensively and consistently across the AlamTri Group companies, which includes policy promulgation, guidelines, guidance, and other activities related to risk management. Risk Champions are the personnel appointed to represent the Risk Management Unit on job sites to identify, report, and monitor the implementation of risk mitigation at their work unit and build a culture of risk awareness.

AlamTri has adopted ISO 31000:2018 – Risk Management Guideline, consisting of 3 (three) main components:

1. Risk management principle:
   1. Integrated
   2. Structured & comprehensive
   3. Adjusted
   4. Inclusive
   5. Dynamic
   6. Best available information
   7. Human and cultural factors
   8. Continuous improvement
2. Risk management framework, consisting of:
   1. Leadership and commitment
      1. Issuing risk management statement or policy
      2. Ensuring resource availability
      3. Determining authority, responsibility, and accountability
      4. Adjusting and implementing all components of the framework
   2. Integration of risk management into the entire business processes, through:
      1. Planning, implementation, and achievement of company targets and goals
      2. Business process and project management
      3. HSE management
      4. Crisis management
      5. Internal audit
   3. Design

      With the philosophy “make it clear, make it simple”, risk management is designed to consist of three levels: strategic, tactical, and operational.

   4. Implementation

      Risk management is implemented by top-down and bottom-up approaches to ensure the integration of the parent company and subsidiaries’ risk management using ORMP approach (objective, risk, mitigation and planning).

   5. Evaluation

      The management determines the risk management targets, regularly measures the progress through maturity level assessment and risk culture survey, reviews the policy and technical guideline, and monitors the effectiveness of risk management framework and process.

   6. Risk management improvement

      The evaluation outcome is followed up to improve risk management continuously.

3. Risk management process, consisting of:
   1. Communication and consultation b
   2. Determination of scope, context, and criteria
   3. Risk identification, analysis, and evaluation
   4. Risk treatment
   5. Risk monitoring and review
   6. Recording and reporting

Three Lines of Defense Model

The three lines of defense model is used to ensure checks and balances. This model consists of:

1. First line: consisting of all subsidiaries responsible for managing risks.
2. Second line: consisting of all corporate functions excluding In-ternal Audit Division, responsible for providing risk expertise, support, monitoring, and evalua-tion, including determining the policy, standard, technical guidelines, and other risk management tools.
3. Third line: consisting of Internal Audit Division, responsible for providing independent and objective assurance on control (governance, risk management, and internal control). Additional assurance may also be obtained from external parties such as external auditor.

Risk Profile of PT Alamtri Resources Indonesia Tbk

Throughout the year, the risk management team monitors, analyzes, and measures the level of each risk identified in the company’s business and operational activities. Risk level movements are monitored and recorded monthly to analyze trends and predict the potential direction of the movements (up, down, or stable) of the risks. As of the end of 2024, the company identified ten (10) main risks, consisting of two (2) risks at a critical level—project risk and Occupational Health, Safety, and Environmental (OHSE) risk– and eight (8) risks at a high-level–macroeconomic risk, industry risk, regulatory changes, weather conditions, community relations, business disruption, product quality, and production disruption.

Specific Information can further be found in our 2024 Annual Report.

Climate Change Response Strategy

AlamTri integrates climate-related risks into risk management to ensure operational resilience and business sustainability as physical risks, such as extreme weather, floods, and droughts, can disrupt the supply chain and operations. To mitigate these impacts, AlamTri has implemented strategies that include comprehensive insurance and a Business Continuity Plan (BCP) to maintain business stability.

Additionally, a crisis management policy ensures readiness in the face of emergencies. The Crisis Management Team (CMT) has developed a Crisis Management Plan for all subsidiaries and designed a five-year training program to enhance preparedness for disasters, with drills conducted periodically to ensure the Company can respond, recover, and resume operations effectively after a crisis.

Survey on Risk Culture

The risk culture survey at the Alamtri Group is conducted by involving an independent party. The most recent survey (in 2023) resulted in a risk culture score of 4.25 out of 5.00 (higher than 4.00 in 2017), indicating a strong risk culture across both management and employees, although there are some areas of improvement, such as risk management competencies. Going forward, this survey will be implemented once in four years. Several initiatives taken by the company to foster positive risk attitude and culture include training programs to enhance the employees’ knowledge and skills, as well as updating risk management infrastructure to ensure effectiveness.