Risk Management
GRI 2-12, 201, 403
Risk Management
GRI 2-12, 201, 403
The Board is responsible for determining the Risk Appetite and maintaining the Risk Governance Structure that facilitate the Risk Management Process to identify and analyse the Risk Profile underlying for the achievement of business objectives of the Company, and to determine how such risks should be managed and mitigated, thereby striking a balance between threats and opportunities. The Board oversees management in the design, implementation and monitoring of the risk management and internal control systems, and management provides confirmations to the Board on the effectiveness of these systems.
The effectiveness of the risk management process and internal control systems is subject to audit by internal audit, with support from external specialists where necessary.
Risk Appetite
The Board acknowledges its responsibility to determine the nature and extent of the risks the Company is willing to take in achieving the Company’s strategic objectives whilst not exposing the Company to excessive risk of financial losses, business disruption, negative reputation, regulatory incompliance and people’s health and safety. The Company has established and maintains an appropriate and effective risk management process and internal control systems to retain only risks that are manageable and at a reasonable level, whilst exploring and capturing opportunities where appropriate. In alignment with our risk appetite, the Company has established a risk assessment matrix and corporate risk register to evaluate and prioritise the key risks by taking into account of both financial and non-financial impact, as well as impact to our SD 2030 Strategy. Moreover, the Company’s vulnerability and exposure to the key risks are assessed regularly to ensure that the appropriate internal controls and mitigating measures are in place for preventing and responding to any major incidents.
Risk Governance Structure
The Board has ultimate responsibility for risk management, overseeing its design and implementation. The Board is supported by the Audit Committee.
The Company has implemented the three lines of defence model of risk governance. The model is designed to minimise conflicts of interest and ensure independent oversight of risk management.
In the first line of defence, the management of each business and operating unit identifies, analyses and reports the risks for which it is responsible. Risks are mitigated, minimised and eliminated, where practicable and economically viable. Where risk cannot be eliminated, the related economic returns are required to reflect the level of risk retained and to balance threats against opportunities. The first line of defence is supervised by the functional heads and portfolio directors.
The second line of defence led by the Executive Committee (“ExCom”) supports the first line and provides assurance to the Board that risk is being managed effectively. The ExCom chaired by the Chief Executive (also acting in the capacity of Executive Director) comprises two other Executive Directors and six executive officers. It manages all the risks to which the Company is subject and is responsible for the design, implementation and monitoring of the relevant risk management processes and internal control systems of the Company. Among each ExCom meetings in general, review of the corporate risk register will be conducted to evaluate the Company’s risk profile and exposure, to oversee the management of major risks, to identify emerging and potential risks and to analyse risk events which materialise, with a view to their resolution and to learning from them. Sensitivity analysis or deep dive sessions on contemporary risk area such as geopolitical, economic or operational issues are conducted by ExCom as appropriate. Matters of significance that arise are reported as appropriate to the Audit Committee and ultimately to the Board of Directors.
ExCom is supported by committees with specialisation in respective corporate and operating functions across the Company including investment appraisal, joint venture management, health and safety, crisis management, information security and data protection. ExCom is also supported by the risk management team headed by the Finance Director. In relation to the Company’s SD 2030 Strategy, the ESG Steering Committee has been set up and reports to the Board. The ESG Steering Committee is supported by working groups to manage the ESG risks and opportunities, including climate-related and nature-related ones with respect to the five SD pillars: Places, People, Partners, Performance (Environment) and Performance (Economic). It is also supported by the SD Communication & Engagement Committee to oversee the implementation of communication and engagement initiatives. The ESG Steering Committee reports material SD and ESG issues (including climate-related and nature-related risks and opportunities) and the progress made towards key performance indicators to the Board. The Chairman of the Audit Committee, who is also an independent non-executive director of the Company and reports to the Board, is a member of the ESG Steering Committee. Details of the responsibilities of each SD 2030 Working Groups are documented in the SD Governance section.
The third line of defence is provided by the Group Internal Audit Department to assist the Audit Committee in carrying out analysis and independent assessment of the adequacy and effectiveness of the risk management and the internal control systems through a systematic review of the processes and internal controls. Details of the scope of work is set out in Annual Report 2024.
Risk Management Process
The following diagram illustrates the key risk management processes of the Company.
Risk Identification
Risks that impact the achievement of business objectives are identified and categorised with reference to a risk taxonomy.
Risk Analysis
Risk assessment matrix is established in accordance with the Company’s Risk Appetite to evaluate and prioritise the risks, in terms of impact and vulnerability, which are documented in the corporate risk register.
Risk Mitigation
Internal control procedures and response protocols are designed, documented and implemented to manage the risks and mitigate their impact.
Risk Reporting
Risks are regularly reviewed and reported to the Audit Committee and other relevant governing parties.
Risk Monitoring
Adequacy and effectiveness of risk management and internal controls are closely monitored through regular review and discussion.
Risk Profile
The Company has established a risk assessment matrix to evaluate and prioritise its risks in terms of the impact and vulnerability. The following table provides a profile of our key risks (listed in alphabetical order), including what we consider to be Swire Properties’ principal existing and emerging risks, their possible impacts, risk trend and mitigating measures that are in place or under development.
Existing Risks and Possible Impacts | Risk Trend | Mitigation Measures |
|---|---|---|
Brand and Image The failure to maintain brand position and perception may make us less competitive. Social media, in particular, is considered as a high velocity risk which, if not properly managed, may cause disproportionate negative impact on the Company’s brand, image and reputation. |
| |
Business Disruption Severe disruption to the business caused by acts of man or acts of nature such as extreme weather and pandemics may have adverse financial effects to the Company. |
| |
Business Risks Economic slowdown and uncertainties in the cities we operate may lead to substantial decline in business activities, revenue and profit. Disruptive business models and technologies as well as demographic factors are changing the behaviour and needs of tenant rapidly, leading to a new form of demand and space design. |
| |
Climate Change Extreme weather conditions and climate change may increase the risks of physical damage to properties and adversely affect their valuation. |
| |
Cybersecurity and Data Protection Threats to customers, tenants and staff from cyber-attacks on our websites, applications, internet services, data and emails result in business interruption, financial loss and reputational damage. |
| |
Development Risks Delay in the completion of developments may have an adverse financial effect by delaying the timing of property sales and leasing. Cost inflation may also lead to significant financial impact due to economic volatilities, supply chain issues and labour shortage. |
| |
Political Risks Changes in the global and local political landscape, policies and priorities may have significant impact on the business environment. Geopolitical risk and international tensions may impact the maintenance of the optimal portfolio mix. Any trade restrictions and international sanctions may adversely affect operating costs and tenant portfolio. |
| |
Third-party Risks Misaligned interests, cultural fit and reneging on commitments of joint venture partners may lead to project delays, financial and reputational impact. Changes in financial position resulting in liquidity problems, changes in leadership and stance of joint venture partners resulting in a withdrawal or reduction of their shareholdings, contribution and commitments. |
|
Emerging Risks and Possible Impacts | Risk Trend | Mitigation Measures |
|---|---|---|
Nature and Biodiversity Risks Deteriorating natural environment and biodiversity loss may impact material availability and adversely affect construction costs. Delay in response to growing market demand for nature-inclusive design in properties may have adverse financial effects on the Company. |
| |
Supply Chain Resilience Possible supply chain interruptions arising from incidents including geopolitical events, resource outages and natural catastrophes (due to extreme weather events and climate change) that would significantly disrupt the operations and construction activities, potentially leading to increased costs, reduced productivity, and loss of customer trust. |
|
Risk level increased during the year 2024
Risk level decreased during the year 2024
Risk level remained broadly the same
Corporate Risk Register Bottom-up Pilot at Citygate
Corporate Risk Register Bottom-up Pilot at Citygate
Swire Properties’ new digitalised CRR platform offers a standard corporate-level template for updating risk details, risk scores and risk mitigation measures, making it easier to benchmark risks across the Swire Group. In early 2024, we extended the digitalised CRR to the business unit level, with a pilot run at Citygate in Hong Kong that has now been completed.
We are planning to further roll out this business unit-level digitalised risk register to other business units in phases. A second pilot is now being conducted at Taikoo Hui Guangzhou.
Geopolitical Risk Workshop
In 2023, a geopolitical risk workshop was organised for our Executive Committee members and strategic leaders focusing on key geopolitical risk scenarios that may affect the Company. Participants were divided into groups to identify and prioritise specific risk scenarios for our retail, office, residential and hotels portfolios, and to propose, review and design mitigation controls and plans. As part of the workshop, a global sanctions training session was conducted, providing an overview of the latest global sanction regimes and an analysis of their impacts on the Company.
In late 2023, leveraging the insights from this workshop, we performed initial sanctions screenings in batches for existing vendors and tenants, while in 2024, we conducted quarterly screenings for newly on-boarded vendors and tenants and half-yearly monitoring for existing vendors and tenants. No exceptions were discovered.
In November 2024, we issued our Guidelines on Sanctions Screening, to provide guidance on pre-onboarding sanctions screening and ongoing monitoring as part of our KYP (“know your partner”) procedures.
Full-scale Business Recovery Plan Drill
Every two years, Swire Properties conducts a full-scale Business Recovery Plan (“BRP”) drill exercise. The latest exercise, held in November 2023, saw our Business Recovery Team (“BRT”) members and their alternates successfully conduct a BRP crisis simulation.
Throughout 2024, we conducted various activities to further enhance BRT member education and raise the awareness level of new BRT members, alternates and other strategic leaders to improve their crisis management knowledge and experience.
We also ensure that we have portfolio crisis response plans in place and that these are up to date and effective. During the year, we aligned our Chinese Mainland portfolio crisis response plans with our Hong Kong BRP to ensure consistency.
A BRP exercise for the alternate BRT members was held in mid-November 2024, facilitated by an external consultant.
SEE MORE IN
