Framework & Governance

Our ever-evolving business landscape presents a set of risks to our business and financial performance. Our Risk and Compliance Division actively monitors these risks, which we have classified into four categories to facilitate oversight and control. The Division makes regular assessments of each risk and reports these to the Management Committee, Management Risk and Audit Committee, Risk Management Committee and Board to ensure an enterprise-wide understanding of the risks we face and how we mitigate their potential impact on our performance. 

The Enterprise Risk Management Framework was designed in accordance with ISO 31000:2009 Risk Management Principles and Guidelines while the Compliance Framework was designed based on the internationally recognized ISO 19600 Compliance Management System. Business Continuity Management Framework was developed in line with ISO 22301 standard. In addition, the Group adopts the Guidelines on Financial Market Infrastructures issued by the SC Malaysia and Principles for Financial Market Infrastructures (PFMI) issued International Organisation of Securities Commissions (IOSCO), to manage the risks of its business and operations. One of the key features of the risk management framework is the implementation of the three lines of defence comprising established and clear functional responsibilities and accountabilities for the management of risk.

The following diagram depicts the 3 lines of defence adopted by Bursa in carrying out their roles and responsibilities:

Senior Management, which includes Management Committee members and Divisional Heads, are the first line of defence and are accountable for all risks assigned under their respective areas of responsibility based on the Enterprise Risk Management Principles & Framework (ERMPF) and Enterprise Risk Management Process & Guidelines manuals (ERMPG). This group of personnel is also responsible for the continuous development of the risk management capabilities of employees and ensures that risk management is embedded in all key processes and activities. The second line of defence is provided by the Risk & Compliance (RC) team and Management Risk & Audit Committee (MRAC), with oversight by the Risk Management Committee (RMC). The RC team is responsible for monitoring the risk and approving matters within its authority for implementation across the Group. The third line of defence is provided by IA and AC and are responsible for providing assurance on the effectiveness of the enterprise risk governance framework. 

RISK & COMPLIANCE STRUCTURE 

A centralised risk management function integrated with a compliance function was formalised for the Bursa Malaysia Group to provide a holistic and enterprise-wide view of the risk and compliance management within the Group.  

The structure for Risk & Compliance Division as shown in the chart, comprise of three departments, namely Enterprise Risk Management, Compliance Management and Business Continuity Management. Under the Enterprise Risk Management, the risk reporting structure covers 4 risk categories, namely Operational Risk, Financial Risk, Strategic Risk and Legal & Regulatory Risk.