Risk Governance Framework at Contact Energy

This document is a technical report detailing the risk governance framework implemented at Contact Energy. The framework aims to integrate risk management into significant activities to create and protect value. The report outlines the responsibilities of the Board and the Audit and Risk Committee in managing risks, including identifying material risks and setting risk tolerance limits. It describes the operational risk management functions based on the three lines of defence model, where business units are accountable for managing risks. The second line of defence includes a dedicated risk management function that supports and monitors compliance. Additionally, the report covers compliance oversight by the legal team and the role of the Business Assurance team in internal audits. It emphasizes the importance of a proactive risk culture and the continuous improvement of risk management processes. The report also includes specific activities planned for enhancing risk capability and maturity in the upcoming fiscal year.