Almarai’s Enterprise Risk Management (ERM) framework enables the identification, assessment, and management of risks that could affect the achievement of the Company’s strategic and operational objectives. The framework allows management to prioritize risks based on their potential impact and likelihood, allocate resources efficiently, and focus mitigation efforts on the most significant risks.
Our ERM policy is aligned with recognized national and international standards and references ISO 31000:2018 and COSO framework principles. Oversight is provided by the Board of Directors and relevant Board committees, with executive-level committees and management teams responsible for day-to-day risk ownership and control implementation. Almarai applies a lines of responsibility model to clarify risk ownership, oversight, and assurance roles across the organization.
Risk Management Process
Our risk management process begins by establishing the context for risk assessment and defines risk criteria. Risks are identified through internal and external sources, assessed based on potential consequences and likelihood, and prioritized to inform decision making and resource allocation. Mitigation plans and control activities are developed and implemented by risk owners, and risks are monitored through periodic reviews and reporting. Defined reporting channels ensure that relevant risk information is escalated and reviewed by management and committees to enable timely decisions and appropriate response actions.
The ERM function includes a corporate team supported by risk champions embedded across business areas. The business risk register is reviewed quarterly by these risk champions and the respective Executive Vice Presidents, who serve as risk owners, before being further reviewed and consolidated by the ERM function. Residual critical and significant risks, along with their mitigation plans, are escalated to executive management and form the basis for reporting to the Board Risk Committee. Key risk indicators are used in relevant areas to enable early warning and timely risk response.
Almarai’s ERM framework addresses a range of strategic, operational, and compliance risks. Key areas of focus include business and operational risks, business continuity and resilience, cybersecurity, and data privacy and third-party risk. Sustainability and climate-related considerations are incorporated into the Company’s risk management processes where relevant, with a focus on factors that may affect business resilience and financial performance across different time horizons.
Almarai maintains a major incident and crisis management protocol that may be activated when an abnormal or unstable event could affect strategic objectives, reputation, or operational continuity. The protocol incorporates a tiered response structure to enable rapid decision making and coordinated action at corporate and site levels.
Risk Appetite
Risk appetite defines the level and type of risk we are prepared to accept in pursuit of our objectives. It guides decision making by establishing expectations for risk taking across the business, while reinforcing the Company’s commitment to operational continuity, customer trust, and compliance.
Almarai maintains a higher appetite for investment-related risks where these drive strategic growth and long-term value creation. In contrast, the Company maintains a low appetite for financial risks, operational continuity threats, regulatory and compliance breaches, and information technology incidents and downtimes.
For areas that could affect consumer trust and safety, Almarai maintains zero appetite, including food safety risks, serious health and safety incidents, and reputational risks that could materially impact brand strength and market share.
Key Developments and Principal Risks in 2025
During the year, we strengthened our ERM capabilities with a focus on improving monitoring and resilience. Key risk indicators were expanded, and risk and control self-assessments were introduced to sharpen early identification of emerging risks and improve consistency in reporting across business areas.
In parallel, our approach continued to evolve toward a broader resilience mindset, linking enterprise risk management with business continuity, crisis preparedness, cybersecurity, and third-party risk oversight. Progress was made in expanding business continuity management practices, including ongoing work toward ISO 22301 alignment across operations. Cybersecurity and operational technology controls were also strengthened in response to evolving regulatory requirements for critical infrastructure supporting national food security. A dedicated function was established to strengthen governance of data privacy and third-party risk management.
During the year, principal risks were monitored across operational resilience and supply continuity, including biosecurity and animal health risks in dairy and poultry operations, reliability of critical production assets, supply chain disruption, and the availability of essential utilities such as power and water. Food safety and product integrity risks also remained a central focus, reflecting the importance of consumer confidence and product quality – along with other reputational risks that have the potential to affect our brand.
The risk profile for the year also included emerging technology and cybersecurity risks. Similarly, regulatory and compliance risks were an area of focus in response to evolving requirements across the operating environment, including sustainability and climate transition-related issues.
Management also continued to emphasize occupational health and safety risks, workforce risks, including cost pressures, talent availability, and succession planning. As Almarai progressed through its current strategy cycle, execution risks also remained a point of emphasis.