Risk Management Cycle

1. Risk Management Cycle

2. Top Down Approach Bottom Up Approach

3. No PHASE TYPE OF ACTIVITY PROCESS DESCRIPTION PARTICIPANT OUTPUT TARGET 1 Planning Discussion Meeting Presentation Training & Briefing Internal Scheduling Discuss with PIC CSA CSA Project Time Table All RMD PIC Affco CSA Time Table Kick Off Meeting Same Perception about Risk Assessment Concept Jan 2005 2 Business Process Mapping Working team review Business Process Mapping Key Risk area identification CSA Team Business Process Key Risk area highlight Jan 2005 3 Education, Risk Interview & Risk Register Education of CSA, Interview with Dept Head & Risk Register Critical Risk Identification, Confirmation, Completion of Loss Events & Risk Impact Div. Head Dept. Head CSA Team Preliminary draft Risk Register Feb 2005 s/d Apr 2005 4 Preliminary Risk Register Completion of Risk Register Completion of Loss Events & Risk Impact, Inherent Risk, Control Activities CSA Team Preliminary Draft Register (Complet) Mei 2005 5 Pre Workshop – per Division Focus Group Discussion Risk, Control and Action Plan Divisional Assessment Div & Dept Head, Key Staffs & CSA Team Level 1 Risk Register Level 2 Risk Register & Preliminary Mei 2005 6 Pre Workshop – Director in Charge Focus Group Discussion Risk, Control and Action Plan Divisional Assessment CSA Leader + Advisor + Dir. In Charge Level 1 Risk Register Level 2 Risk Register & Preliminary Juni 2005 7 CSA Workshop Focus Group Discussion Risk, Control and Action Plan Corporate Assessment Div. Head + CSA Team, Advisor + All Director Level 1 Final Risk Register Juni 2005 8 BOD Presentation & Reporting Report Drafting & Presentation CSA Result Analysis BOD, Chiefs, Div. Head + Team Leader + Advisor CSA BOD Report & Final Risk Register Juli 2005 9 CSA Documentation Report writing Filing Prepare report & sign off Compile working documentation PIC RM & Affco PIC RM & Affco Final report & risk register Working File Juli 2005 Risk & Control Self Assessment Plan

4. Risk Identification – Asset Exposure

5. Risk Identification – Business Process

6. High High Extreme Extreme Extreme Medium Extreme Extreme High High Impact Insignificant Minor Moderate Major Catastrophic Medium Medium High High High Low Low Medium Medium High Low Low Low Medium Medium Rare (Jarang) Unlikely (Kadang 2) Possible (Mungkin) Likely (Sering) Almost Certain (Hampir pasti) Risk Exposure Matrix BAHAYA BESAR Pengaruhnya SEDANG Pengaruhnya KECIL Pengaruhnya Tidak berarti Pengaruhnya Bagaimana Pengaruh terhadap perusahaan??? Extreme Likelihood Immediate actions required High Bagaimana Kemungkinan timbulnya Resiko ini ?, Apakah JARANG, SERING………... Senior management attention required Medium Management responsibility must be specified Low Manage by routine procedures

7. PT United Tractors Tbk Corporate Audit Risk Register

8. Risk Exposure Matrix