Risk management framework and objectives
The Group Risk Policy provides a risk management framework for Fortum, the purpose of which is to support business in managing risks effectively and to ensure compliance with relevant regulations. The Group Risk Policy describes the main features of Fortum’s risk management systems which consists of principles, processes and responsibilities for managing risks which, if materialise, may have a material negative impact on Fortum’s current or future business operations, reputation, employees, the environment or third parties.
The risk management systems have been designed to support Fortum’s Board of Directors, Audit and Risk Committee, Fortum’s Executive Management as well as the operative business in fulfilling their duties in relation to risk management. The objectives of the risk management systems are to:
- Support Fortum’s Board of Directors and Fortum Executive Management (FEM) in the development of the Group strategy,
- Support business in strategy execution,
- Support business in achieving agreed targets within acceptable risk levels so that Fortum’s ability to meet financial commitments is not compromised,
- Ensure the understanding of Fortum’s material risks and uncertainties,
- Support the prevention of accidents that can have a severe effect on the health and safety of employees or third parties, and incidents that can have a material impact on Fortum’s assets, reputation or the environment.
Risk management organisation
Fortum’s Board of Directors approves the Group Risk Policy, and the President and CEO approves Fortum’s risk management instructions including an instruction for enterprise risk management which sets minimum requirements for managing risks in all categories. In addition, there are specific risk instructions covering commodity market risks, counterparty and credit risks and liquidity risks applicable for all of Fortum. Fortum’s Divisions and Corporate Functions issue risk manuals and guidelines, as needed, which detail how the Group Risk Policy and relevant risk management instructions are implemented within their organisations.
Risk Governance
The main principle is that risks are managed at source, meaning that each manager is responsible for managing risks that arise within their business operations. For each risk, risk owners are assigned to ensure that appropriate mitigation actions are taken to respond to the risk.
Fortum’s Audit and Risk Committee (ARC) is responsible for monitoring the efficiency of the company’s risk management systems, and for annually reviewing the Group Risk Policy and the Group’s material risks and uncertainties. Corporate Risk, an independent control function headed by the Chief Risk Officer (CRO) reporting to the CFO, provides instructions, methods and tools which support the business in running an efficient risk management process. Corporate Risk is responsible for assessing and reporting on the maturity of risk management in the organisation and for monitoring and reporting of Fortum’s material risk exposures to FEM, the ARC and the Board of Directors.
