The Risk Committee members meet as a group on a quarterly basis to synthesize and assess risks, as well as to make and implement risk related recommendations. As appropriate, the Co-Chairs will make recommendations to the CEO and Co-Chair of the Board and the Audit and Risk Committee on the risk appetite, profile and tolerance of Bud APAC.
At the working level,internal audit teams are assigned to perform selected audits of operations of each business unit based on the annual Enterprise Risk Management (ERM) assessment results. We also undertook an independent appraisal of the effectiveness of the Company’s risk management framework, including an extensive benchmarking exercise against the relevant peer groups.
We demonstrate our unwavering commitment to ethics and compliance through our actions. We adhere to all applicable laws and regulations without taking shortcuts, diligently identify and assess risks associated with our operations and employ suitable technology to implement control measures that minimize risk.
Under the direction of our CEO and Co-Chair of the Board of Directors, we have established an Ethics and Compliance Committee at the management level. This committee is led by our Chief Legal and Corporate Affairs Officer, who also holds a position on the Executive Committee of Bud APAC. The committee is responsible for monitoring the Company’s compliance with applicable laws and regulations to ensure that all business activities are ethically and legally compliant.
Stakeholder Engagement Approach
In response to a dynamic market landscape and evolving stakeholder expectations, we want to future-proof our company by effectively identifying risks and opportunities, addressing stakeholder interests, and making well-informed decisions.
Topics with relatively lower priority to keep in view and reassess
Disclosure Items: GRI 205; HKEX B4, B7
Policy | Expectations |
Code of Business Conduct | All employees are expected to consistently uphold the highest level of business integrity and ethical conduct. |
Anti-Corruption Policy | All directors, employees, suppliers and business partners must comply with all laws concerning bribery, corruption, and conflicts of interest. |
Anti-Money Laundering and International Trade Compliance Policy | All employees should be aware of the list of activities that require prior approval from the Legal team or the Compliance team and the required procedures consistent with the ethics and compliance guidelines. |
Conflict of Interest Policy | All directors and employees must disclose any interests that might conflict, or appear to conflict, with the interests of Bud APAC. |
Whistleblowing Policy | Employees and others are encouraged to report any suspicions of bribery or unethical business practices. |
Responsible Marketing and Communications Code | To safeguard our consumers’ well-being, uphold our company’s reputation, and ensure our commercial communications are conducted responsibly. |
Human Rights Policy | We acknowledge our obligation to provide a work environment that is safe, environmentally sound, and devoid of any harassment or discrimination for not only our employees but also for temporary workers and independent contractors. |
Disclosure Items: GRI 418; HKEX B6
Policy and Procedure | Expectations |
Privacy Policy | This policy governs all types of customer data. Adherence to data security is a key component in evaluating employee performance. Employees who breached data security protocols are subject to disciplinary measures. |
Information & Cyber Security Incident Response Plan | To address information and cyber security incidents particularly on personal data, this plan outlines procedures for consistent detection and management of such incidents. It also ensures that enhancements and corrective measures are executed to prevent future occurrences. |
Data Breach Incident Management Standards | Developed and periodically updated by the Personal Information Protection Group, this set of Standards guides the management of data breach incidents. A Data Breach Response Team is formed by business and data owners, IT heads, and the Personal Information Protection Group. Their responsibilities include identifying, responding to,processing, recovering from, and reporting on data breaches. |
Personal Information Security Impact Assessment Standards | Based on China’s personal information protection compliance requirements, this set of Standards assists Bud China in conducting personal information impact assessments and risk management. The Personal Information Protection Group advises on risk mitigation strategies varying from immediate to time-bound remediation, or remediation after evaluating impact and costs. The project owner is responsible for implementing measures in line with these recommendations and complying with Bud China’s requirements and relevant legal regulations. |
Masking Requirements of Personal Information Display in Application Development | Introduced in 2023, the standard mandates the appropriate masking (de-identification) of personal information displayed in application development, aligning with the relevant laws and regulations in Mainland China. |
A director with IT expertise is on our Board, contributing to the cybersecurity strategy. Additionally, our Vice President of Technology and Analytics, the Director of Technology and Analytics, and the APAC InfoSecurity & Compliance Lead oversee and manage the cybersecurity strategy and implementation.
We have implemented routine monitoring through a dashboard on our data management platform. This allows for real-time tracking of direct sourcing data quality, facilitating data accuracy corrections as needed. Changes are made when discrepancies are identified, enhancing the accuracy of our direct sourcing data. We established the Personal Information Protection Group (PIPG) to further enhance our data protection strategies. The group is comprised of members from security, legal, and compliance. It is responsible for implementing data security processes and training, regularly reviewing national regulations and taking appropriate actions. Recognising the critical importance of data security and privacy, we have also revised and enhanced our policy framework to ensure robust personal information protection and effective management of cybersecurity risks.