Corporate governance

Risk management

The core principle of risk management is continuous, systematic and preventive action to identify risks, define the risk level accepted by the company, assess and manage risks, and, in the event that risk materialize, manage and control them effectively so that the company achieves its strategic and financial objectives. Risk management forms part of the company’s management, monitoring, and reporting systems. Risk management covers risk identification, assessment, and contingency planning (Enterprise Risk Management, ERM).

The Board of Directors of the company is responsible for approving the Auroora’s risk management principles and for assessing the adequacy and appropriateness of risk management. The Chief Financial Officer is responsible for Group-level risk management and its organization, resourcing of the work, and reviewing the risk management principles. The Group Management Team is responsible for the implementation of risk management, monitoring of operational risks, risk assessment, and measures related to risks.

Risk management in Auroora is decentralized to the boards of the subsidiaries, which are responsible for risk management in their respective companies, define the responsible parties for risk management, and are responsible for risk identification, management, and reporting. The boards of the subsidiaries are responsible for identifying and assessing risks in their own companies, preparing proposals for risk mitigation, and reporting in accordance with the given instructions to the Group Management Team. Each employee is responsible for identifying and reporting risks related to their own work and other risks they observe to their supervisor.

The coordination of financial risk management is the responsibility of the Group finance and treasury function. It develops financial risk management, supports business risk management, and reports regularly on financial risks to the Management Team and the Board of Directors.

Strategic risks are addressed regularly in the management teams and board meetings of each group company in connection with monitoring the implementation of the strategy and annually in connection with the review of the strategy. Risk reports are reviewed by the Board of Directors and the Group Management Team. Key risks and risk management measures are reported annually in the company’s report of the Board of Directors, interim reports, and, where necessary, on a case-by-case basis.