Risk management is the responsibility of the Board and the Executive Committee based on a Top-Down, Bottom-Up approach to engage all staff. Top-Down begins with our Board and its committees with clear terms of reference, including oversight for identification and management of specific allocations of risk type.

This is translated into action by our Executive Committee, which reviews and manages the ERM process through implementation of associated policies and procedures. Within our Executive Committee, the Vice President International and HSE and the Vice President North America have risk management responsibility on an operational level, while the Chief Financial Officer is responsible for overseeing risk management performance.

Bottom-Up is how staff implement, maintain and improve risk management processes, applying the hazard-risk-mitigation process in every part of our business.

Risks are identified by key staff across our Company, including our Operations, Finance, Health, Safety and Environment, Economics, Government and Public Relations, and Sustainability teams at corporate, business unit and asset levels. These employees have significant experience, and use a wide array of inputs, including operational and facility assessments, technical and research reports, external stakeholder organizations, government policy and regulation changes, industry initiatives, communities and landowners, and non-governmental entities.

The results are incorporated as specific risks into our Corporate Risk Register, which provides a consistent framework to ensure the effective tracking and communication of our material risks. Using our Risk Matrix as a prioritization tool, Teams assess each risk's severity, likelihood, speed of onset, and vulnerability using scales from 1 to 5 for each factor, described in terms of human, environment, financial, social license and cybersecurity impacts. In addition, risks such as commodity pricing, production and carbon taxes are stress-tested to identify the impact of changes over time.

Our sustainability materiality analysis, which assesses issues with impact for both the Company and our key stakeholders, is integrated into our ERM system using the Corporate Risk Register through a collaboration between our Finance, HSE, Operations and Sustainability teams. The results are reviewed annually at minimum by the responsible teams, and provided to the Executive Committee and the Board and its Committees as appropriate, who further review and assess the risks including interdependencies based on the company’s risk tolerance.