The duties and responsibilities of the Audit and Risk Management Committee shall include the following:

External Audit

1. To nominate and recommend to the Board, the appointment of the external auditors having regard to the adequacy of the experience, resources, audit fee and independence of the external auditors;
2. To discuss with the external auditors before the audit commences, the nature, scope and plan of the audit, and ensure co-ordination where more than one audit firm is involved;
3. To review with the external auditors, their evaluation of the system of internal controls and his audit report including any significant suggestions for improvements and management’s response;
4. To review the assistance given by the employees of the Group to the external auditors;
5. To discuss problems and reservations, if any, arising from the interim and final audits, and any matter which the external auditors wish to discuss in the absence of the management, where necessary;
6. To discuss and review the external auditors’ management letter and management response, if any;
7. To annually assess and consider the performance, suitability and independence of the external auditors including their fees, and consider any questions of resignation or dismissal including whether there is reason (supported by grounds) to believe that the external auditors are not suitable for re-appointment. The assessment is to be based on established policies and procedures that consider, among others (Practice 8.3, MCCG 2017):
   
   
   • the competence, audit quality and resource capacity of the external auditors in relation to the audit;
   • the ability of the external auditors to meet deadlines in providing services and responding to issues in a timely manner as contemplated in the external audit plan;
   • the nature and extent of the non-audit services provided by the external auditors and appropriateness of the level of fees paid for such services relative to the audit fee; and
   • obtaining written assurance from the external auditors confirming that they are, and have been, independent throughout the conduct of the audit engagement in accordance with the terms of all relevant professional and regulatory requirements.
   
   
8. To review any letter of resignation from the external auditors and report the same to the Board.

Financial Reporting

1. To review in depth the quarterly and year-end financial statements, focusing particularly on:
   
   
   • any change in and implementation of major accounting policies and practices;
   • significant adjustments arising from the audit;
   • the going concern assumption;
   • compliance with accounting standards and other statutory requirements; and
   • to ensure a true and fair view of the financial position and performance of the Group and of the Company is presented after taking into consideration any accounting issue arising in respect of the Group and of the Company’s affairs, and recommending the quarterly and year-end financial statements to the Board for its approval;
   
   
2. To assess the appropriateness of the management’s selection of accounting policies and disclosures in compliance with approved accounting standards;
3. To ensure timely submission of financial statements by the management;
4. To review significant or unusual transactions and accounting estimates; and
5. To review with the Group’s counsels, any legal matters that could have a significant impact on the Group’s financial statements;

Internal Audit (Practices 9.1, 9.2 and 10.1, MCCG 2017)

1. To do the following, in relation to the internal audit function:
   
   
   • review the adequacy of the scope, functions, resources and competency of the internal audit function, and that it has the necessary authority to carry out its work;
   • ensure the internal audit function is independent of the activities it audits the internal audit activities should be free from interference in determining the scope of internal audit, performing work and communicating results; and the internal audit function reports directly to the Audit and Risk Management Committee;
   • review the internal audit programme, processes, the results of the internal audit programme and processes, and whether or not appropriate actions are taken on the recommendations of the internal audit function;
   • review the assistance and co-operation given by the employees of the Group to the internal auditors;
   • review any appraisal or assessment of the performance of the internal auditors;
   • approve any appointment or termination of the internal auditors; and
   • take cognizance of the resignation of the internal auditors and its reasons for resigning.
   
   
2. To discuss and review the major findings of internal investigations and the management’s response;
3. To review the major findings of internal investigations and management’s response;
4. To review management’s monitoring of compliance with the Group’s code of corporate conduct;
5. To verify at the end of each financial year, the allocation of options under a share issuance scheme and share grant scheme for employees, if any, to ensure compliance with the allocation criteria determined by the Remuneration Committee and in accordance with the Bye-Laws of the relevant Option Scheme. A statement by the Audit and Risk Management Committee verifying such allocation shall be included in the annual report; and
6. To review the findings of any examinations by regulatory authorities.

Risk Management (Practices 9.1 and 9.2, MCCG 2017)

1. To provide oversight, direction and counsel to the Group’s risk management process which includes the following:
   
   
   • recommend for the Board’s approval, the establishment of the Group’s risk management framework, policies, strategies, and any proposed changes thereto arising from any review;
   • to conduct an annual review and periodic testing of the Group’s risk management framework and assess the resources and knowledge of the management and employees involved in the risk management process;
   • to monitor the Group’s and Department’s level of risk exposures and management of the significant financial and non-financial risks identified;
   • to review and recommend the Group’s level of risk tolerance and actively identify, assess and monitor key business risks to safeguard shareholders’ investments and the Group’s assets;
   • to review the Group’s risk profile and ensure that significant risks that are outside tolerable ranges are being responded with appropriate actions taken in a timely manner;
   • to evaluate new risks identified by the RMEC and RMWG including the likelihood of the emerging risks happening in the future and consider the need to put in place the appropriate controls;
   • to review the status of the implementation of management action plans in mitigating significant risks identified;
   
   
2. To establish and periodically review the Group’s risk management guidelines and policies and ensure implementation of the objectives outlined in the policies and compliance with them;
3. To evaluate the effectiveness of the RMEC and RMWG’s structure, risk management processes and support system to identify, assess, monitor and manage the Group’s key risks; and
4. To review the Statement on Risk Management and Internal Control in the Group’s annual report to ensure that relevant information as prescribed in the MMLR of Bursa Securities are disclosed. Disclosure in the annual report should include a discussion on how key risk areas such as finance, operations, regulatory compliance, reputation, cyber security and sustainability were evaluated and the controls in place for the Group to mitigate and manage those risks.

Related Party Transaction

1. To consider any related party transactions and conflict of interest situation that may arise within the Company or the Group including any transaction, procedure or course of conduct that raises questions of management integrity.

Sustainability

1. To review the strategies, policies, management, initiatives, targets and performance of the Group as a whole, as appropriate, in the following areas to ensure the Company’s business is conducted in a responsible manner:
   
   
   • Health and safety
   • Environment
   • Community Relations
   • Security
   • Governance

Relationships and Communication with Board, Auditors and Management

1. To report its findings on the financial and management performance, risk assessment results and other material matters to the Board;
2. To perform other oversight functions as requested by the Board; and
3. To consider and examine such other matters as the Audit and Risk Management Committee considers appropriate.

Revision of the Terms of Reference

Any revision or amendment to the Terms of Reference, as proposed by the Audit and Risk Management Committee or the Nominating Committee or any third party, shall be presented to the Board for its approval.

Upon the Board’s approval, the said revision or amendment shall form part of this Terms of Reference and this Terms of Reference shall be considered duly revised or amended.