Transurban FY26 Corporate Report Governance and risk
Risk management Transurban integrates risk management processes into our strategic planning, operations, business activities, functions and processes through the implementation of an organisational wide proactive enterprise risk management framework.
How we manage risk The Enterprise Risk Management (ERM) Framework sets out the principles and requirements for managing risk and provides a structured approach for identifying, assessing and monitoring risks and opportunities. This framework is designed to support strategic decision making, regulatory compliance, organisational resilience and effective risk oversight. The ERM Framework is intended to operate alongside organisational processes and policies. These activities support the company’s resilience, sustainability and long-term value creation. The framework is overseen by the Board and the Audit and Risk Committee (ARC) and managed by the CEO, Executive Committee, and senior management supporting the identification, assessment escalation and reporting of key risks. Risk strategy • Risk classification: The ERM Framework facilitates the proactive identification of risks, distinguishing between threats and opportunities, for all business endeavours. • Risk appetite: Transurban's Risk Appetite Statement is approved by the Board and specifies the level of risk the company is prepared to accept, tolerate, or avoid in pursuit of its strategic objectives. This statement is critical in guiding decision-making attitudes and behaviours, enabling the company to navigate uncertainty and capitalise on opportunities. • Key risk indicators: To ascertain that Transurban operates within its defined risk appetite thresholds, the Risk Appetite Statement is connected to Key Risk Indicators and Key Performance Indicators (KPIs). These metrics are used to measure both risk management effectiveness and current business performance against financial and non-financial risk parameters. Performance against these indicators is continuously tracked and reported to the Board to provide early insights into risk exposures and facilitate informed decision-making. • Risk culture: Transurban is committed to fostering a risk-aware culture that supports decision-making in line with its values, objectives, and risk appetite. The Risk Management Policy and ERM Framework establish guidance for effective risk management. The company assesses its risk culture annually through its 'Our Voice' employee survey, evaluating employees' understanding of risk, the effectiveness of risk management practices, and their willingness to take considered risks within the established appetite. • Strategic business decisions: Risk management plays a vital role in identifying and leveraging positive risk opportunities that can enhance business performance and contribute to strategic objectives. Through comprehensive risk assessments, scenario analysis, and strategic planning, Transurban identifies and evaluates opportunities within its existing and potential growth markets, aiming to maximise returns and improve the certainty of outcomes.
Risk governance Transurban adopts a Three Lines of Accountability model, aligned with the ASX Corporate Governance Principles and Recommendations , to support governance, risk management, compliance and assurance across the organisation. The model provides a foundation for clear accountabilities and oversight, while ongoing enhancements continue to strengthen risk, compliance and assurance practices across the business. • First line: Operational Management is responsible for the identification, assessment, ownership, and day-to-day management of risks arising from business activities. This includes designing, implementing, and maintaining effective internal controls to support the management of risk within the Board-approved risk appetite. • Second line : the Risk function, together with other oversight functions, is responsible for establishing and maintaining the risk management framework, policies, and standards. These functions provide independent guidance, challenge, and oversight, and undertake review, and analysis to assess whether risks are being effectively managed and that first line controls and assurance activities are operating as intended. • Third line: the Internal Audit function provides independent and objective assurance to the ARC on the adequacy and effectiveness of risk management, internal controls, and governance processes. Internal Audit operates in accordance with a risk-based audit plan approved by ARC. Additional independent assurance may also be provided by external parties, including the external auditor and other specialist assurance providers where appropriate. The Board, in conjunction with the ARC, is responsible for overseeing the implementation of an effective system of risk management and internal control. The ARC reviews and recommends to the Board updates to the Risk Management Policy, ERM Framework and Risk Appetite Statement. The ARC and the Board also receive an annual assessment of the ERM Framework undertaken by Transurban’s Internal Audit team. Where opportunities for improvement are identified, these are also overseen by the ARC. ARC also oversees various risk management activities, compliance efforts, business resilience initiatives, privacy incidents, and ethical business practices, including whistleblower reporting. Additionally, the Board and ARC share oversight of the strategic cybersecurity program and cyber risk management activities.
80
Made with FlippingBook Digital Publishing Software