Risk & Crisis Management

“

IRPC is committed to robust risk management to identify, assess, and mitigate risks across our operations and safeguard our people, assets, and reputation.

”

IRPC recognizes that effective risk management is essential to sustaining our operations and minimizing negative impacts on the economy, environment, and society, including impacts on human rights. Key risks such as supply chain disruptions, climate change-related impacts, environmental pollution, community safety incidents, and regulatory non-compliance may arise from our direct operations, manufacturing processes, and business relationships, potentially causing or contributing to adverse impacts on business continuity, communities, natural resources, and human rights along the value chain. At the same time, IRPC’s risk management practices generate positive impacts by strengthening organizational resilience, improving operational efficiency, reducing environmental footprint, and advancing overall sustainability performance. Through continuous monitoring, adherence to our Risk Management Policy, and structured processes aligned with ISO 31000 and COSO ERM, IRPC works systematically to prevent, mitigate, and remediate adverse impacts while supporting long-term environmental, social, and economic stability for all stakeholders.

Management Approach

In response to an increasingly volatile and uncertain business environment, IRPC places great emphasis on managing risks to ensure clear, comprehensive, efficient, and effective organizational management. This approach is integrated with other management systems across the organization, with a focus on achieving goals aligned with our vision and strategy. IRPC has established a Risk Management Policy that encompasses the overall risk management framework and is systematically connected with other management systems throughout the organization to ensure consistency and effectiveness in addressing risks.

Our risk management is conducted in accordance with internationally recognized standards, including ISO 31000: Risk Management – Principles and Guidelines and COSO Enterprise Risk Management. These frameworks are integrated with corporate governance, internal control systems, business continuity management, anti-corruption measures, and sustainable management practices, supporting transparent and sustainable business operations.

Risk Management Governance Structure

The Company has established a risk management governance structure with oversight from the Board of Directors, supported by the Risk Management Committee (RMC) at the Board level, and the Risk Management and Internal Control Steering Committee (RMCC) at the executive management level. This structure enables effective oversight, coordination, and implementation of risk management practices across the organization.

The Risk Management Team, under the Corporate Planning and Sustainability Department, operates independently from all business functions and serves as the central function responsible for coordinating enterprise risk management (ERM), including analyzing, monitoring, and reporting risk management performance to the RMCC and RMC on a quarterly basis.

The roles and responsibilities of key governance bodies within IRPC’s risk management structure are outlined below:

IRPC’s Risk Management

Board of Directors Directors is responsible for setting strategic directions in risk management and ensure risk management is implemented effectively by reviewing the risk management and internal control system of the company and subsidiaries on a quarterly basis.
Risk Management Committee (RMC) is responsible for defining the risk management policy, risk management plan, and risk management procedure for the entire company in compliance with corporate and strategic plans that are set by the Board of directors. In addition, the RMC is responsible for reporting on the operational status of the risk management system to the Board of directors on a regular basis. In which, the chairman of RMC is the highest-ranking person dedicated risk management person with direct operational level.
Risk Management and Internal Control Steering Committee (RMCC) is responsible for monitoring and ensuring greater efficiency in its overall risk management and internal control system.
Risk Management Team is responsible for coordinating and implementing risk management processes across the organization which include providing advice and guidance on various types of risk (including emerging risks) and supporting effective risk culture by empowering employees through incentives and training.

IRPC’s Risk Audit and Monitoring

IRPC aims to ensure that risk management is implemented in line with the Company’s risk management plan to prevent or mitigate potential impacts to manageable levels. The Company has assigned roles and responsibilities to the Audit Committee and the Office of Corporate Internal Audit to monitor and review risk management as part of the internal audit system. The roles and responsibilities of relevant parties are outlined below:

Audit Committee is responsible foroverseeing and monitoring risk management by means of independent reviews through receiving reports on or finding on risk management from the Office of Corporate Internal Audit, to ensure that risk management is implemented according to the policy and effectively throughout the organization.
Office of Corporate Internal Audit is responsible for conducting independent audits and monitoring the effectiveness of the internal control system including risk management on an operational level. IRPC’s senior vice president officiates as IRPC’s office of Corporate Internal Audit, is the highest-ranking person who is responsible for monitoring and auditing risk management on an operational level.

In addition, IRPC ensures the effectiveness of our risk management framework through independent assessments conducted by external parties annually, the Company has undergone external reviews by organizations such as the Management System Certification Institute (MASCI) to evaluate the conformance of our risk management system with international standards. Additionally, IRPC has engaged KPMG to GRC Maturity assessment to evaluate the effectiveness of our risk management and internal control systems.

At IRPC, risk management is implemented across two interconnected levels: corporate and functional. The governance structure follows a top-down approach, cascading from the corporate level to the functional level. Risk management is implemented across business and support functions, with operational units involved in identifying, assessing, and managing risks within their respective areas. The scope of risk management at each level is outlined below.

Scope of Risk Management at Each Level

Scope

Definition

Organizational Level

Risks to the organization arising from its mission itself, from the lack of alignment among missions, or from organizational operations that are inconsistent with the stated mission — including where the defined mission may no longer be suitable given changing trends or key factors.

Business Unit Level

Risks to the organization or to business units arising from misalignment between the organization’s mission and the business unit’s mission, or from the lack of alignment of policies and/or strategies among business units — including the appropriateness and changes of the various factors affecting both policies and strategies.

Project Level

Risks to the organization or to business units arising from selecting projects or strategies that are unsuitable given changing trends or key factors.

Operational Level

Risks to the organization, business units, or projects/strategies arising from plans or operations that are unsuitable given changing trends or key factors.

Risk Management Process

IRPC implements a structured risk management process on an annual cycle, comprising seven key steps: (1) Risk Communication and Consultation, (2) Mission, (3) Context Setting, (4) Risk Assessment, (5) Risk Treatment and Mitigation, (6) Monitoring and Review, and (7) Reporting.

This process is applied consistently across all levels of the organization, including corporate, business unit, subsidiary, and functional levels. IRPC assigns appropriate roles to relevant functions to carry out risk assessment and develop mitigation plans, while ensuring that risks are continuously monitored and reviewed throughout the cycle.

Risks Management ProcessDownload

(1) Communication and Consultation

IRPC ensures effective communication and consultation on risk management across the organization through established governance and management processes. This enables relevant stakeholders to understand key risks, align on objectives and strategies, and contribute to the identification, assessment, and management of risks. The objectives of communication and consultation are to:

Build understanding and awareness of relevant stakeholder interests
Ensure that the Company’s mission, objectives, and strategies remain aligned with evolving trends and key environmental factors
Support the establishment of an appropriate risk management context
Enable comprehensive risk identification
Incorporate diverse perspectives in defining risk criteria and evaluating risks
Achieve alignment and support for risk management measures
Promote effective change management within the risk management process

Communication and consultation are conducted as a two-way process through regular plan reviews, reporting, and the review of risk management results. These activities are supported by ongoing training and engagement initiatives to promote risk awareness across both operational and management levels.

(2) Defining the Mission

Risk management must be linked with other management systems. Therefore, it is necessary to define the organization’s mission to support those responsible for risk management in assessing the alignment between the organization’s objectives, scope, strategies, and business goals.

The defined mission is then used to guide the formulation of the organization’s strategies going forward, as illustrated below:

Mission to Shareholders

Deliver fair and sustainable returns to shareholders through reliable management of excellent business performance.

Mission to Society

Incorporate social responsibility and environmental stewardship into business operations to drive sustainable development.

Mission to Business Partners

Be the best choice for partners by offering innovative products and services.

Mission to Employees

Build a learning organization with a happy working environment while developing personnel to be dedicated and committed to the organization for professional excellence.

However, in cases where a clearly defined mission is not available, or when applying risk management at the departmental level, the department’s main purpose (Main Purpose) from the Functional Description document may be used as a reference for defining the mission.

(3) Context Setting

Defining the context involves assessing factors related to the organization’s objectives or missions, which are used to evaluate the impact and likelihood of various events. This step identifies factors that may affect the Company and serves as the foundation for the subsequent risk assessment process.

Defining the context includes:

External Context: environmental factors that affect the company, such as economic conditions, political conflicts, impacts on communities and the environment, and technological changes.
- Factors that support the company’s strategies are considered Opportunities.
- Factors that obstruct the company’s strategies are considered Threats.
Internal Context: factors arising within the Company, such as financial status and strategies.
- Factors that support strategies are considered Strengths.
- Factors that obstruct strategies are considered Weaknesses.

Identification of internal and external factors can be conducted using various tools, such as PESTEL Analysis, McKinsey 7S, SWOT Analysis, TOWS Matrix, and Five Forces Analysis. The Company also classifies internal and external factors in alignment with ESG principles.

Defining internal and external factors is not limited to those that have already occurred or are expected in the near term, but also includes future factors, as there may be emerging risks — for example, new national laws or future supply and demand of crude oil. The Company remains aware of these factors to prepare in advance for their potential impacts.

(4) Risk Assessment

Risk assessment consists of three main steps: (4.1) Risk Identification, (4.2) Risk Analysis, and (4.3) Risk Evaluation. It helps identify risks that have the potential to impact the Company’s strategies and business objectives, and supports the determination of appropriate risk treatment measures to reduce risks to an acceptable level. Risk assessments are conducted at least twice a year, or more frequently as needed, to ensure timely and effective risk management.

Risk event identification

Risk event identification is carried out by considering events that may affect critical success factors, which are essential to the organization’s ability to execute its strategies and achieve its business objectives.

At this stage, divergent thinking is applied to ensure a broad range of potential events is considered. The types and magnitude of potential impacts are also identified as part of the process. This approach supports comprehensive identification and provides clarity in defining and communicating risk events for subsequent analysis.

Risk Analysis

Risk Analysis involves assessing the impacts of risk events, the likelihood of their occurrence, and the root causes of risks.

At this stage, convergent thinking is applied to focus on evaluating and narrowing down key risks. The analysis considers both worst-case and most probable scenarios. To support effective monitoring and review of risk treatment measures, key risk indicators (KRIs) are defined to reflect the root causes of risk.

Risk Evaluation

Risk Evaluation combinesthe results of risk analysis with established risk criteria, considering both impact and likelihood, to determine the overall risk level. This involves:

Assessing the level of impact from each risk event
Assessing the level of likelihood of each risk event
Plotting the risk level on a risk matrix (risk map) to visually represent and communicate the results

IRPC’s risk assessment process is based on data from risk analysis and defined risk criteria, evaluating both impact and opportunities of potential events that may affect operations. Impact is assessed across five key areas: (1) Finance and Investment, (2) Business Processes, (3) Health, Safety, and Environment, (4) Corporate Image, and (5) Stakeholders. Likelihood is also evaluated to determine overall risk levels.

Risk assessment criteriaDownload

(5) Risk Treatment and Mitigation

Selecting appropriate risk treatment measures requires consideration of the cost-effectiveness of each option:

If a measure is cost-effective to implement internally, it may be selected as a risk retention (acceptance) approach.
If a measure is not cost-effective to implement internally, a risk transfer approach may be considered.
If a measure remains not cost-effective even after considering risk transfer, a risk avoidance (elimination) approach should be considered, which involves modifying or discontinuing the strategy to prevent the risk from occurring.

Approach

Meaning

Conditions for Consideration

Accept Risk (TAKE)

No action is taken to reduce the likelihood or impact of risk, but risk management measures must still be followed.

The risk is at a level that the organization can accept, and existing risk management measures are maintained.

Treat Risk (TREAT)

Take actions to reduce the likelihood and/or impact of the risk, which may involve improving existing risk controls and/or implementing additional risk controls.

The risk management measures are cost-effective enough to be implemented internally.

Transfer Risk (TRANSFER)

Take actions to transfer the likelihood and impact of the risk to others, such as purchasing insurance, entering hedging contracts, forward contracts for goods or currency, or outsourcing to third parties.

The risk management measures are cost-effective if the risk is transferred to other parties.

Terminate Risk (TERMINATE)

Cease any activity to eliminate the likelihood and/or impact of the risk, such as discontinuing strategies, projects, or plans.

When the risk level is unacceptable to the organization and the risk management measures are not cost-effective.

Assessing the Adequacy of Risk Treatment Measures: After selecting the type of risk treatment measures, the next step is to assess the target level of risk reduction. The goal of risk management is to reduce the risk to an acceptable level. The remaining (residual) risk can be evaluated by considering the chosen strategies and the estimated effectiveness of the risk treatment measures.

Preparing and Implementing the Risk Treatment Plan: : Implementing risk treatment measures requires preparing plans and resources, such as operational plans, contingency plans, budget plans, and assigning risk owners. Implementation should be aligned with the strategic plan, budget approvals, and performance reporting to ensure effective execution.

(6) Monitoring and Review

Monitoring and review of risk management aim to build confidence in the effectiveness and efficiency of risk treatment measures as conditions evolve. In evaluating and reviewing these measures, organizations may use:

Key Performance Indicators (KPIs),
Key Risk Indicators (KRIs), and possibly
Key Success Indicators (KSIs) that are suitable for the scope and context of the risks.

By assessing these indicators together, the Company can evaluate effectiveness and efficiency, and identify gaps that require improvement to enhance risk treatment measures.

If risk treatment measures can prevent or reduce the impact of risk events, all three indicators should show results that meet the target level.
If the measures cannot prevent or reduce the impact, all three indicators should show results that are at the threshold level.

Effective indicators should also be designed to provide early warning signals, enabling the Company to detect issues before they escalate.

IRPC regularly monitors risks related to business operations, including strategic, operational, financial, regulatory, and environmental, social, and governance (ESG) risks, as well as emerging risks that may impact future operations. The Company reviews risk exposure on a quarterly basis, with reports submitted to the Risk Management and Internal Control Committee (RMCC), the Risk Management Committee (RMC), and the Board of Directors. In addition to scheduled quarterly reviews, ad-hoc risk reviews may be triggered by material changes and impact in business conditions, significant external events, or escalation from operational risk owners.

(7) Report

Recording and reporting are essential to support communication and consultation throughout the risk management process. At the enterprise level, risk information is recorded and reported in the risk register in accordance with the risk management reporting calendar.

The Company regularly reviews its risk management practices to ensure they remain effective under changing conditions. When risk treatment measures are effective, indicators reflect target-level outcomes; if not, they show results near threshold levels. These results are reported on a quarterly basis to the Risk Management and Internal Control Steering Committee (RMCC) and the Risk Management Committee (RMC).

Risk Management Tools

IRPC utilizes a range of analytical tools to support effective risk identification, assessment, and decision-making across the organization. Key tools include:

Risk Correlation

Risk correlation analysis examines the relationships between key variables that impact IRPC’s business. For example, price volatility of raw materials and products represents business risks, while foreign exchange and interest rates represent financial risks. Historical data over the past three years are analyzed to develop statistical models for forecasting potential future risks.

Risk Appetite

IRPC defines risk appetite as the level of risk the organization is willing to accept in pursuit of strategic objectives, providing a clear boundary for decision-making across the organization. The Risk Appetite Statement, approved by the Board of Directors, sets tolerance limits across key risk categories, including operational, financial, and strategic risks. These limits are translated into measurable indicators that guide decision-making at all levels of the organization. Risk appetite is continuously monitored and reported across functional areas, with periodic reviews to ensure alignment with changing business conditions, compliance requirements, and strategic priorities. By establishing both upper and lower tolerance levels, IRPC ensures that risks are managed within acceptable boundaries while fostering a strong risk culture and supporting sustainable growth.

Risk Map

The Risk Map is used to prioritize risk factors based on their severity, determined by both likelihood and impact in alignment with IRPC’s risk boundaries. Risks are categorized into four levels: low (green), medium (yellow), high (orange), and extreme (red). Risks classified as high or extreme are designated as corporate-level risks and require appropriate actions in accordance with the enterprise risk management process.

Sensitivity Analysis and Stress Testing

IRPC applies sensitivity analysis and stress testing as part of our risk and crisis management framework to assess the potential impact of adverse events. Sensitivity analysis evaluates how changes in key assumptions affect risk exposure, while stress testing examines the Company’s resilience under extreme but plausible scenarios.

Risk Culture

IRPC aims to embed risk management into the way we work across the organization. This involves building a shared understanding among the Board of Directors, management, and employees on the importance of applying a consistent risk management framework to support sustainable growth. The Risk Management and Internal Control Steering Committee (RMCC), together with the Risk Management Committee (RMC), oversees the implementation of this framework and ensures that risk management is applied across strategic, operational, and day-to-day activities. To promote awareness, IRPC communicates key risk issues through various channels, including Board and management meetings, departmental meetings, workshops, e-learning, risk-focused Podcasts and internal programs such as ISPIRIT and G3 Good Great Growth.

Risk Management Education

Regular Education on Risk Management for Non-Executive Directors: IRPC is committed to promoting a strong risk culture across the organization, including regular risk management education for non-executive directors. To enhance the Board’s effectiveness in overseeing risk, IRPC encourages directors to participate in risk-related training regularly, at least once a year. Directors have attended programs certified by the Stock Exchange of Thailand (SET), such as the Director Accreditation Program (DAP), Director Certification Program, and training by the Thai Institute of Directors (IOD). IRPC also ensures that directors and executives are kept up to date on emerging risk issues related to changes in laws, technology, and economic conditions.
Focused training throughout the organization on risk management principles: IRPC conducts annual enterprise risk management training for all business units, focusing on risk managers, risk owners, and risk agents who act as facilitators and change agents within their units. The training aims to build awareness and embed a strong risk management culture across the organization. To further reinforce this culture, IRPC implements several initiatives, including mandatory risk training for departmental risk managers. IRPC also periodically introduces specialized training programs for senior management including strategic risk landscape courses delivered in partnership with leading external experts to strengthen executives’ capabilities in identifying and responding to macro-level risk trends and evolving business environments. risk management performance to executives’ financial incentives. ERM Ambassadors and ERM Auditors are also appointed to monitor practices and promote the best practices among employees. In addition, IRPC conducts a Risk Control Self-Assessment for executives every two years to evaluate their risk awareness and the application of the risk management framework.

Risk Management Process Integration

Incorporating risk criteria in the product development or approval process: IRPC integrates risk considerations into every stage of product development, recognizing that taking calculated risks is essential to achieving market success. Risks are assessed and addressed early in the process to ensure cost-effective mitigation. Key market-based risks include commercial viability, customer acceptance, competitor landscape, and timing of product introduction. In addition, IRPC considers organizational risks such as liquidity, resource availability, project management capability, and the technical and logistical readiness of supply chain and manufacturing partners. IRPC regularly reviews and updates its risk management policy and risk assessment criteria through independent external benchmarking against industry peers, integrating improvements with the GRC (Governance, Risk Management & Internal Control, Compliance) framework. The criteria are continuously enhanced to incorporate evolving areas such as human rights risk and corruption risk assessments, ensuring a comprehensive approach to risk identification across the organization. Throughout development, IRPC staff are actively involved in the selection, evaluation, and engagement with these partners to ensure alignment and minimize risk exposure.
Inclusion of risk management criteria in the HR review process for employee evaluations: IRPC integrates specific risk management criteria into the HR evaluation process to ensure that employee performance reflects not only business outcomes but also risk-conscious behavior. These criteria are clearly defined and aligned with each role’s responsibilities, enabling HR to assess how well employees identify, manage, and respond to risks within their scope of work. This approach helps identify performance gaps, supports targeted development, and reinforces accountability. Risk-related performance is also tied to financial incentives, encouraging a proactive risk management mindset. Through this integration, IRPC promotes a strong risk culture across all levels of the organization.

Risk Management Metrics Link to Financial Incentives

Financial incentives which incorporate risk management metrics: The management of the corporate risk profile is directly linked to the KPIs of members of the Risk Management and Internal Control Committee (RMCC) and Risk Management Committee (RMC) and is cascaded to relevant functions. The Supply Chain and Hedging Committee (SCHC) additionally oversees financial and commodity price risk management. Financial incentives are tied to both business and risk management performance, evaluated through KPIs, competencies, and desired behaviors via the Performance Management System (PMS).
For management level:Financial incentives are also linked to business and risk management performance through KPIs. Non-financially, the company fosters a strong risk management culture by instilling a risk-aware mindset across the workforce. Executives and staff are expected to possess a solid understanding of risk management systems relevant to their roles in achieving business objectives.

Risk Reporting and Measurement

Potential risks reporting throughout the organization:

IRPC has implemented various measures to ensure that all employees can report potential risks, including monthly risk management reporting sessions and the IRPC Corruption Mailbox (PO BOX 35) for reporting corruption risks. The company promotes safety through initiatives like the Zero Accident Campaign, Process Safety Management (PSM), and Zero Process Safety Events (PSE), raising awareness through “Lessons Learned” shared with all employees. Additionally, daily health and safety check-ins via the Line application allow for monitoring employees’ well-being across locations, with alerts when employees enter high-risk zones. To encourage reporting, employees can use the whistleblowing mechanism and other channels, ensuring easy access to the Corporate Risk Team at all levels. IRPC maintains active membership in the Thai Private Sector Collective Action Against Corruption (CAC) and conducts periodic corruption risk assessments with dedicated risk mitigation measures as part of this ongoing commitment. IRPC continuously expands cybersecurity risk awareness through dedicated training and awareness programs covering all employees, reflecting the growing prominence of digital and cyber threats in the risk landscape.

Measures allowing continuous improvement in risk management practices:

IRPC ensures continuous improvement in risk management through structured feedback processes that involve employees at all levels. Feedback, suggestions, and comments from the Board of Directors or executives regarding risks raised during reporting sessions are communicated to risk managers, risk owners, and relevant parties. Additionally, IRPC has implemented a “Functional Risk Criteria Review Process,” which encourages employees to engage in assessing risk tolerance and behaviors, fostering active participation in improving risk management practices across the organization.

Measuring Risk Culture Effectiveness:

IRPC has developed the “I-Risk Program,” a Performance and Risk Management platform designed to support the risk management process, particularly when handling large-scale data. The platform summarizes data in a way that encourages transparency and quick response behaviors, which are crucial to building a strong risk culture. The I-Risk application enables risk owners to identify risk events, implement treatments, and regularly report to executives. The program features a dashboard that displays real-time risk statuses, providing continuous surveillance and monitoring of risk management efforts. All users can access updated information on risk factors, which is regularly refreshed during quarterly meetings.

Emerging Risks

IRPC has assessed evolving external factors and emerging risk trends that could impact on the Company over the next 3-5 years, including political, economic, social, environmental, legal, and technological risks. In response, the Company is proactively preparing to address these challenges while seeking opportunities to adapt its business strategies in alignment with the shifting business landscape of the future.

(1) Geopolitical Risks, Economic Restructuring Risk, and Trade Policy Risk

Category of Risk

Geopolitical

Impact level

High

Likelihood

High

Timeframe

Within 1 year

Description

Geopolitical conflicts between major powers are intensifying, including the United States–China conflict and tensions in the Middle East, affecting international trade, supply chains, and global economic structures. Trade barriers and export restrictions are expected to tighten, particularly through environmental regulations, carbon emission controls, and labor requirements.

Impact

Fluctuations in raw material and transportation costs: Reliance on imported oil exposes the Company to crude oil price volatility and rising shipping cost.
Intense price competition: Influx of low-cost products from China affects margins and customer operations.
Trade restrictions and tariff barriers: Stricter environmental and non-tariff measures increase compliance costs and limit exports.

Mitigation Actions

Financial management: Manage price and exchange rate volatility using hedging and inventory management.
Product strategy adjustment: Increase proportion of specialty products to reduce competition.
Expansion and partnerships: Diversify exports and strengthen cooperation in low-risk regions.
Operational efficiency: Implement joint initiatives within PTT Group to enhance competitiveness.

(2) Energy Transition and Low-Carbon Technology

Category of Risk

Environmental

Impact Level

High

Likelihood

High

Timeframe

Within 3-5 years

Description

Global and national transitions toward a low-carbon economy, including Thailand’s Climate Change Act, Emissions Trading System (ETS), and carbon tax, are accelerating the shift from fossil fuels to clean energy. Growth in electric vehicles and low-carbon technologies may reduce demand for core products and affect asset value.

Impact

Increased operating costs: From carbon tax and investments in emission reduction technologies.
Declining demand for fossil products: Transition to clean energy affects long-term demand.
Image and confidence risks: Pressure from stakeholders on environmental performance.
Trade challenges: Carbon border adjustment mechanisms (CBAM) may impact export competitiveness.

Mitigation Actions

Proactive strategy formulation: Align business with carbon neutrality and net-zero targets under 3Cs strategy.
Investment in innovation: Develop renewable energy and emission reduction projects.
Measurement and verification: Conduct CFO and CFP assessments to prepare for regulations.
Asset management: Improve efficiency and financial stability during transition.
Collaboration: Engage stakeholders to support transition and compliance.

(3) Global Plastic Treaty and Extended Producer Responsibility (EPR)

Category of Risk

Environmental

Impact Level

High

Likelihood

High

Timeframe

Within 3-5 years

Description

The Global Treaty on Plastic aims to reduce plastic pollution to zero by 2040 through reuse, recycling, and improved waste management. The draft treaty covers reducing plastic production, promoting recycled plastics, and improving waste systems. Extended Producer Responsibility (EPR) requires producers to take responsibility throughout the product lifecycle.

Impact

Sales and performance: Demand for single-use plastics may decrease due to changing consumer behavior and regulations.
Increased production costs: Costs related to environmentally friendly design, recycling systems, and compliance.
Company image: Risk to reputation if plastic waste management is not effectively addressed.

Mitigation Actions

Proactive strategy formulation: Integrate 3Cs strategy (Climate Change, Circular Economy, Creating Shared Value).
Investment in recycling technology: Develop recycling systems and low-carbon production processes.
Supply chain management: Improve waste collection and sorting systems.
Collaboration: Work with stakeholders to prepare for EPR implementation.
Communication: Raise awareness to maintain Company credibility.

Full details are disclosed in the Annual Report 2025 (Form 56-1 One Report, pp. 115–118).

Annual Report 2025 (Form 56-1 One Report)Download

Business Continuity Management

IRPC recognizes the importance of managing risks and uncertainties that may disrupt business operations. The Company has therefore implemented a Business Continuity Management (BCM) system and developed a comprehensive Business Continuity Plan (BCP) in alignment with ISO 22301 standards. The BCM system has been certified for polyolefin products since 2022, with continued verification through a surveillance audit in 2025. This demonstrates that the Company is prepared to respond to situations that could cause business disruptions, covering a wide range of critical risks, including:

Risks from major disasters such as fire
Risks from structural collapses
Risks from chemical leaks
Risks from drought conditions
Risks from terroris
Risks from protests
Risks from raw material shortages
Risks from cyberattacks
Risks from critical machinery breakdown or damage
Risks from epidemics

The system covers key risk scenarios, including:

1. Major accidents risk (e.g. fires)

2. Structural collapse

3. Chemical leaks

4. Drought

5. Terrorism

6. Protests

7. Material shortages

8. Cyberattacks

9. Machinery breakdown

10. Epidemics

In response to the aforementioned risks, the Company will regularly assess the business impacts and risk levels of each scenario in order to establish and continuously improve the business continuity management plan. This ensures timely and appropriate prevention and response measures tailored to each situation.

The BCM framework addresses a wide range of potential disruption scenarios that may impact operations. These scenarios are systematically assessed to strengthen preparedness and ensure that appropriate response measures are in place.

The Company regularly tests and rehearses the Business Continuity Plan (BCP) through simulated scenarios to evaluate the effectiveness of the plan and the team’s ability to respond to real incidents. This process also includes updating the plan to reflect rapidly changing situations and risks. Drills are conducted within the framework of the Crisis and Business Continuity Management Center, with the Chief Executive Officer and President acting as the Director of the Emergency Control Center, together with senior executives, participating in the rehearsal in 2025. A simulated scenario was set in which a fire broke out in a Hexane tank at the HDPE Plant in the Rayong factory, causing damage to the tank. As a result, both the HDPE Plant and UHMWPE Plant were unable to continue production. Repairs to the tank would take several months before HDPE and UHMWPE operations could resume, leading to an inability to deliver HDPE and UHMWPE (Ultra High Molecular Weight Polyethylene) products to customers.

Comprehensive development of BCM and BCP in 2025 enables the Company to be well-prepared to handle crises, minimize operational impacts, and ensure rapid business recovery. This allows the Company to maintain stable operations, build stakeholder confidence, and support the organization’s sustainable development goals. The Company remains committed to continuously improving BCM and BCP systems to effectively address new challenges and strengthen corporate resilience in all situations.

To maintain the effectiveness and relevance of the BCP, IRPC conducts regular Business Impact Assessments (BIA) and Risk Assessments. The results are used to define and continuously update response and recovery measures, ensuring timely and appropriate actions under evolving risk conditions.

Risk & Crisis Management

Risk Management Governance Structure

Scope of Risk Management at Each Level

Scope

Definition

Risk Management Process

(1) Communication and Consultation

(2) Defining the Mission

(3) Context Setting

(4) Risk Assessment

(5) Risk Treatment and Mitigation

Approach

Meaning

Conditions for Consideration

(6) Monitoring and Review

(7) Report

Risk Management Tools

Related Document

Risk Culture

Emerging Risks

(1) Geopolitical Risks, Economic Restructuring Risk, and Trade Policy Risk

(2) Energy Transition and Low-Carbon Technology

(3) Global Plastic Treaty and Extended Producer Responsibility (EPR)

Business Continuity Management

The system covers key risk scenarios, including: