Risk management and internal control

The corporate risk management and internal control system effectively operate and are improved on an ongoing basis at the Company.

On an annual basis, the Board of Directors determines the risk appetite of the Company in quantitative and qualitative terms, risk appetite includes restrictions on principal activities and its compliance is monitored every quarter.

The Risk Register, Risk Map, KRI (key risk indicators) and the Action Plan for the Management of Key Risks are prepared every year and submitted to the Company’s Board of Directors for approval. After considering the results of performed work on identification of “Samruk-Energy” JSC group’s risks for 2019, 34 risks involved in operations of “Samruk-Energy” JSC group of companies were identified and assessed, KPI thresholds were updated, risk owners updated risk factors and activities aimed at their mitigation.

Risks from the Risk Register were re-evaluated in connection with some of the events that occurred in 2018 (second-tier banks’ rating downgrade, the weakening of the national currency), potential factors that could affect the Company’s operations (reduced electricity consumption, increased wear of energy producing facilities), as well as on the basis of reports of “Samruk-Energy” JSC Internal Audit Service inspections. According to the results of this revaluation, 13 risks were included into the key zone of the Risk Map for 2019:

Quarterly reports on management of key risks and plans for mitigating them are drafted and submitted to the Company’s Board of Directors for approval (after prior approval by the Risk Committee of the Company and the Audit Committee of the Board of Directors) every quarter.

The Company’s Board of Directors actively discusses non-compliance with restrictions on principal activities of the Company and negative changes in key risks on the Company’s Risk Map.

Key changes in 2019 (key risks mitigation)

Risks of ongoing/ future investment projects and investment programs of SA (without changes)

The main deviation in the underspending with regard to investment projects occurred at «Bogatyr Komir» LLP due to the suspension of access to debt financing by EDB for the implementation of the project on transition to cyclical-andcontinuous method due to US sanctions against the Russian UC RUSAL (50 % co-shareholder «Bogatyr Komir» LLP)

Actions: an alternative debt financing for the project implementation is sought

The risk of workplace accidents that caused damage to the health and life of employees in the performance of their duties (no changes)

10 work-related accidents have been reported since the beginning of 2019, including 1 fatal accident

Actions: in accordance with the work plan «Occupational health and safety and environmental protection» department

Foreign exchange risk (without changes)

Reduction of currency commitments

Actions: monitoring changes in foreign exchange quotations, activities on refinancing of current loan

Credit risk (without chnages)

Unstable situation in second tier banks

Actions: monitoring of compliance with limits on counterparty banks, as well as regular evaluation of STB stability

The risk of non-fulfillment/untimely update of the Company’s long-term development strategy (reduction by probability)

Updating of the Company’s long-term development strategy for 2018–2028

Actions: monitoring the execution of the action plan for the implementation of the Company’s Development Strategy and KPI set

The risk of violation of covenants of external creditors and listing requirements (reduction by probability)

Actions: monitoring compliance with covenants, as well as financial sustainability ratios, actions aimed at reducing the level of debt burden and interest payments

The risk of failure to fulfill the electricity sales plan (without changes)

Actions: daily participation in preparation of daily schedules of electricity supply to the wholesale market and participation in centralized auctions, attracting consumers of Kazakhstani wholesale market

The risk associated with transformation program implementation (increase by probability)

Falling behind with the Roadmap of Business Transformation Program

Actions: monitoring the execution of the Roadmap

The risk of occupational accidents and disasters (without changes)

Actions: conducting major and current repairs, periodic inspections of equipment’s technical condition, provision of briefings and emergency training for operating staff of an enterprise

The risk of tariff setting (reduction by probability)

Obtaining individual capacity tariffs by subsidiaries

Actions: monitoring the tariff policy of «Samruk-Energy» JSC group of companies, the work on obtaining of necessary tariff levels in the authorized bodies, participation in working groups on legislation amendments

The risk of human resources of the Company’s group (increase by probability)

Actions: Personnel reserve relations, cooperation with educational organizations on training of specialists in priority areas for power and coal sectors, arrange workshops and and trainings for the Company’s employees, introducing the principles of meritocracy, motivation system development

The risk sanctions (reduction by probability)

Removal of sanctions from RUSAL UC

Assets sale and reorganization risks

Measures: in 2019, «AZhC» JSC, «APP» JSC, «AES» LLP were excluded from the list of assets subject to privatization, with keeping these assets in the Company’s perimiter as part of the privatization of the Company as a whole

The effectiveness of risk management and internal control systems is regularly assessed – in 2018, the independent auditcompany conducted a corporate governance diagnostics,based on which the Company developed a CorporateGovernance Improvement Plan, which includes actions aimedat the improvement of risk management and internal controlsystems. The Board of Directors monitors the implementationof this Plan on a quarterly basis.

In an age of high world technology and improved worldpractices, many enterprises find themselves in a complexmarket environment, undergoing frequent transformationsthat destroy traditional business ideas and require newsolutions.

As a result, companies faces many challenges in managingmultiple everyday processes, which creates areas of potentialrisk and leads to the need for the development of newor improved systems to enhance the flexibility of an entity’sbusiness.

One of the priority areas of the risk management systemas part of the improvement of the Company’s corporategovernance in accordance with the Company’s strategy isthe implementation of the project “Introduction of the new riskmanagement model” included in the Transformation Program.

The project “Introduction of the new risk management model”has been transferred to “Samruk-Energy” JSC operations frommid-2019.

The project “Introduction of the new risk management model”consists of 3 integrated subsystems subject to the followingchanges:

— risk management system (system improvement);

— internal control system (refinement of the systemin terms of design assessment and testing the operatingeffectiveness of control procedures);

— a system for ensuring business continuity (introductionof the system).

The effective implementation of the project “Introductionof the new risk management model” contributes to raisingthe rating of the effectiveness of the corporate riskmanagement system (rating BB – based on the resultsof the audit of independent corporate governance diagnosticsof “Samruk-Energy” JSC group of companies).