#### 4. GOVERNANCE
#### 4.1 Principles
To ensure the continuous and systematic execution of ESG risk management within the SCB[x] Group, the company integrates the governance structure for managing ESG risks into the enterprise risk management system, operating within the ESG Risk Management Framework. This integration is conducted under the supervision of the Risk Oversight Committee and the Risk Management Committee, in collaboration with relevant functions.
The Board of Directors, executives, and related functions assume pivotal roles in overseeing ESG risks, recognized as among the most significant risks facing the SCB[x] Group. Their involvement includes delineating roles and responsibilities for the function designated to oversee the management of environmental, social, and/or governance risks. This is in addition to aligning with SCB[x]'s risk management policy, tailored to accommodate the distinctive characteristics of ESG risk issues. The application of the "Three Lines of Defense" framework for ESG risk management is considered, with specifics outlined as follows:
- The first line of defense encompasses business and support functions associated with key ESG risks. Their responsibility is to identify these risks and oversee their operations in adherence to established regulations or systems. They operate in compliance with internal control rules and appropriate risk management measures.
- The second line of defense involves functions such as risk management, compliance, and sustainability. Their duties include providing advice, support, and testing methods for relevant functions in managing ESG risks.
- The third line of defense comprises independent functions, including the internal audit function. They are tasked with reviewing and evaluating the adequacy of the company's risk management controls. Additionally, they assess the efficiency of the risk management system and report their findings to the Audit Committee and the Board of Directors.
#### 4.2 Roles, Duties, and Responsibilities
To proactively address ESG risks, the organization must delineate the roles and duties of relevant functions in alignment with SCB[x] Financial Group's Risk Management Policy, outlined as follows:
#### 4.2.1 Roles, Duties, and Responsibilities of SCB[x] as the Parent Company:
1) Board of Directors
(1) Review and approve SCB[x] Financial Group's ESG Risk Management Policy, endorsing periodic reviews and updates in the event of significant changes.
(2) Evaluate and approve ESG risk management policies of group companies that deviate from the risk management framework established by the parent company, especially when identified as significant risk issues by the Risk Oversight Committee.
(3) Oversee and endorse the management's strategy for handling ESG risks, fostering a risk-aware culture that addresses ESG risks appropriately. This includes establishing a robust process to efficiently identify, assess, manage, and monitor ESG-related risks, ensuring optimal allocation and control of resources, and managing residual risks to maintain an acceptable level.
2) Risk Oversight Committee
(1) Supervise group companies to establish appropriate ESG risk management policies and strategies, particularly for significant ESG risks, including emerging risks by serving as a Center of Excellence with support from Risk Management, Sustainability, and other relevant functions.
(2) Consider and approve the review of SCB[x] Financial Group's ESG Risk Management Policy in case of significant changes, prior to seeking approval from the Board of Directors. Also, assess and approve the review of the policy in the case of insignificant changes, reporting such alterations to the Board of Directors for acknowledgment.
(3) Consider ESG risk management policies of group companies for consistency with the risk management framework established by the parent company. If significant risk issues are identified, present them to the Board of Directors for further consideration and approval.
(4) Consider and approve the Group ESG Risk Appetite before submitting it for approval from the Board of Directors.
(5) Regularly review the adequacy and effectiveness of ESG risk management policies and strategies, including acceptable levels of ESG risks. This review should occur at least once a year or in the event of significant changes that might impact on the group's status or reputation. Ensure efficient and effective implementation of these policies and strategies.
(6) Report to the Board of Directors on the status of ESG risks, the effectiveness of the risk management, control, and monitoring system, and adherence to a corporate risk culture by highlighting significant factors, problems, and areas for improvement to align with the Group's risk management policies and strategies.
3) Executive Committee
(1) Consider and approve the determination of the Group ESG Risk Appetite, aligning it with the Group's business plan and business operations strategy.
(2) Consider ESG risk management policies of group companies for consistency with the risk management framework established by the parent company, especially in cases where there are issues related to business reasons. If significant risk issues are identified, present them to the Board of Directors for consideration and approval.
4) Risk Management Committee
(1) Review and approve the company's ESG risk management strategy, aligning it with the Financial Group's risk governance framework approved by the company's Board of Directors.
(2) Screen ESG risk management policies and guidelines for financial group companies, as well as requests for exemptions from compliance with the group's risk management policy or framework by group companies. Present these to the Risk Oversight Committee or other subcommittees/Board of Directors.
(3) Monitor and ensure that the company and group companies adhere to ESG risk management in line with the Group's risk management policy and strategy, considering the business context. Conduct follow-ups on risk dashboards and report major incidents to ensure that risk level measurements remain within acceptable levels. Analyze and develop strategies to manage emerging risks or those likely to surpass acceptable levels.
(4) Present an annual review of the adequacy and effectiveness of ESG risk management policies and strategies, including acceptable risk levels, to the Risk Oversight Committee or when significant changes occur.
(5) Review the Consolidated Risk Reports on ESG risks of the financial group, obtaining approval from the Board of Directors before submission to relevant regulatory agencies.
(6) Report to the Risk Oversight Committee on the status of ESG risks, the efficiency of risk management, and adherence to corporate risk culture by highlighting significant factors, problems, and areas for improvement to align with the Group's risk management policies and strategies.
5) Risk Management Function
(1) Ensure that group companies adhere to the group's risk management policy guidelines and operate within the acceptable risk levels set by the Group.
(2) Serve as a Center of Excellence, offering guidance and overseeing the risk management practices of group companies to ensure compliance with regulations set by the Bank of Thailand or specified by regulatory agencies. Ensure alignment with the Group's established risk management policy.
(3) Track and gather ESG risk information from each company to enhance risk management guidelines. Regularly report the Group's overall risk profile to the Risk Management Committee and the Risk Oversight Committee by highlighting key risks and providing insightful information on a routine basis.
6) Sustainability Function and Other Functions Designated to Support ESG Risk Management
(1) Develop an ESG risk management policy and strategies and determine the Group's ESG Risk Appetite. Present these for approval to the Board of Directors, reviewing them at least annually or when significant changes occur. Support the oversight of group companies to ensure compliance with the Group's ESG risk management policy guidelines and alignment within acceptable risk levels.
(2) Present the Group's ESG risk management strategy to the Risk Management Committee for consideration and approval. Conduct regular reviews, at least annually, or when significant changes occur.
(3) Support group companies as a Center of Excellence by providing guidance and oversight in ESG risk management. Ensure compliance with criteria set by the Bank of Thailand or regulatory agencies, as well as best practices in ESG for each group company. Assist in compliance with the Group's specified risk management policy, including monitoring emerging risks, impacts from potential risks, and changes in relevant laws and regulations. Present manuals, guidelines, and common scenarios for managing such risks.
(4) Support the monitoring and collection of information on various risks for each company to enhance risk management guidelines. Contribute to the regular reporting of the Group's overall risk profile to the Risk Oversight Committee by highlighting key ESG risks in the reporting.