Risk Management Outline

As a Kampala-based multi-sector services company engaged across business, infrastructure, resources, social development, trade and related activities, Jopetnah may face strategic, operational, financial, compliance, reputational, HSE and external risks. Effective risk management supports informed decisions, protects value and strengthens resilience.

This Outline describes the Company’s overall approach. It is intended to be practical and proportionate to the organisation’s current size and complexity while providing a foundation that can mature as the Company grows.

• Establish context – Understand objectives, scope, stakeholders, assumptions and the operating environment.
• Identify – Recognise events or conditions that could affect objectives, people, projects, assets, reputation or compliance.
• Assess – Consider likelihood and potential impact and determine the significance of the risk.
• Treat – Select appropriate responses such as avoiding, reducing, transferring or accepting risk within approved tolerances.
• Monitor & review – Track controls, residual risk, indicators and changes in the risk environment.
• Communicate & report – Escalate significant risks and emerging issues to the people responsible for decisions and oversight.

Risk treatment should be selected according to the nature and significance of the risk. Controls should be practical, assigned to accountable owners and reviewed for effectiveness.

• Avoid – Do not undertake an activity where the risk cannot reasonably be brought within acceptable limits.
• Reduce – Lower likelihood or impact through controls, procedures, training, diversification or other measures.
• Transfer / Share – Allocate appropriate risk through contracts, insurance, specialist arrangements or other lawful mechanisms, while recognising that accountability may remain with Jopetnah.
• Accept – Retain a risk where it is understood, within appropriate tolerance and subject to proportionate monitoring.
• Escalate – Refer material or rapidly increasing risks to the appropriate level of management or oversight.

• Board / Oversight – Provides oversight and direction on significant risks and the organisation’s overall risk approach.
• Managing Director – Has overall management responsibility for the framework, major risk escalation and ensuring appropriate accountability.
• Departmental Heads & Project Leads – Identify, assess, treat and monitor risks within their areas and escalate material issues.
• Company Secretary / Relevant Control Functions – Support governance, documentation, compliance and escalation processes as assigned.
• All Personnel – Remain alert to risks, follow controls and promptly report incidents, concerns and emerging risks.

Where appropriate, significant activities and projects should maintain documented risk information identifying the risk, cause or trigger, potential consequence, existing controls, risk owner, planned treatment, target date and residual risk.

Management may use key risk indicators, incident trends, control reviews, project reviews, financial information, compliance checks and other relevant information to identify emerging concerns. Material changes or risks outside approved tolerance should be escalated promptly.

Risk management should consider the organisation’s ability to continue critical activities during disruption. Depending on the nature of the activity, continuity measures may include alternative suppliers, backup information, delegated responsibilities, communication arrangements, emergency contacts, recovery priorities and contingency resources.

The level of formal continuity planning should be proportionate to the criticality and exposure of the activity and should be reviewed as the Company’s operations evolve.

Risk management is supported by and integrated with other governance and operational controls, including:

• Code of Ethics & Business Conduct
• Anti-Corruption & Anti-Bribery Policy
• Conflict of Interest Policy
• Health, Safety & Environment (HSE) Policy
• Procurement Policy
• Whistleblowing / Speak-Up Policy
• Sustainability, ESG & Corporate Responsibility

This Outline will be reviewed periodically and refined as the Company’s scale, complexity, activities and risk profile evolve. Significant incidents, material changes in operations, regulatory developments or major changes in the external environment may trigger an earlier review.

Effective date: September 2026  |  Version: 1.0  |  Approved by: Managing Director