McPherson : Risk Management Policy Internal Control Framework

MCPHERSON'S LIMITED

RISK MANAGEMENT POLICY AND INTERNAL CONTROL FRAMEWORK

April 2022

McPherson's Limited

Risk Management Policy and Internal Control

Framework

Index

No.	Section	Page
1.	Risk Management Policy	1
2.	Internal Control and Compliance Framework	2
3.	Monitoring, Evaluation and Review	2
4.	Document Control	2

i

McPherson's Limited

Risk Management Policy and Internal Control

Framework

RISK MANAGEMENT POLICY

McPherson's employs comprehensive risk management systems to support its business activities and safeguard shareholder value.

Risk is defined as ..."exposure to the uncertainty of an event or action, which may affect McPherson's ability to achieve its business objectives".

The consequences of risk may be positive or negative and risk management includes identifying and taking advantage of opportunities as well as minimising adverse impacts.

This policy should be read in conjunction with the following:

• ▪ The Audit Committee Charter

• ▪ The Risk and Compliance Committee Charter

• ▪ The Code of Conduct Policy

• ▪ The Ethical and Responsible Business Conduct Policy

• ▪ The ASX Announcements and Communications Policy

• ▪ The Whistleblower Policy

Our Policy is to:

• ◼ Use a proven risk management approach, ensure appropriate focus is given to the identification, evaluation, mitigation, monitoring and reporting of all significant risks to the McPherson's Board or the Board's Risk and Compliance Committee;

• ◼ Periodically communicate to all stakeholders the material risks that have potential to have an effect on the Group's financial prospects, and how the Group manages these risks.

• ◼ Encourage our Management team to take considered risks, while ensuring that managing risk is an integral part of business planning and management processes;

• ◼ Inform, skill and motivate our people to enable them to implement effective risk management practices; and

• ◼ Maintain a cost/benefit focus where appropriate when developing risk mitigation strategies, such as implementing insurance cover.

The risk management strategy is designed to ensure the following are in place:

• ◼ A management capability that allows efficient and effective identification, measurement and assessment of collective risks (financial / non-financial) that impact McPherson's shareholder value and the quality and value added;

• ◼ A substantive link between risk analysis and strategic decision making;

• ◼ Effective management of enterprise level risks in totality via a combination of:

  - Implementing operational risk management strategies, policies and assurance;

  - Purchasing insurance where appropriate;

• ◼ An effective early warning ("red flag") reporting system, such as an effective whistleblower system;

• ◼ The regular review and establishment by the Board of an appropriate risk appetite to provide guidance to management; and

• ◼ The regular reporting of risk related matters to the Board or the Risk and Compliance Committee.

McPherson's Limited

Risk Management Policy and Internal Control

Framework

INTERNAL CONTROL AND COMPLIANCE FRAMEWORK

The Board is responsible for the overall internal control framework but recognises that no cost-effective internal control system will preclude all errors and irregularities. The Board has instigated the following internal control and compliance framework:

• ◼ Financial Reporting - monthly actual results are reported against budgets approved by the Directors and revised forecasts for the financial year are prepared and reported against regularly;

• ◼ Continuous disclosure - a comprehensive policy and process is in place to identify matters that may have a material effect on the price of the Company's securities, and to promptly notify those matters to the ASX and post them on the Company's website consistent with the requirements of the Company's ASX Announcements and Communications Policy;

• ◼ Compliance - the Company has in place a comprehensive system to ensure compliance with laws, regulations and Company Policy;

• ◼ Quality and integrity of personnel - external probity checks are undertaken with relevant external authorities as part of the pre-appointment due diligence process for all new Directors and Senior Leadership Team roles. Compliance with the Code of Conduct Policy and the Ethical and Responsible Business Conduct Policy is mandatory for all Directors, senior executives and all other employees;

• ◼ Specialty Reporting - Key areas are subject to regular reporting to the Board, including legal, insurance and environmental matters; and

• ◼ Investment appraisal - Capital expenditure and annual budgets are subject to detailed appraisal and review procedures and levels of authority. Comprehensive due diligence requirements are mandatory where businesses are being acquired or divested, or other investments are being considered.

• 3. Monitoring, Evaluation and Review

  This policy will be periodically reviewed to check that it is operating effectively and determine whether any changes are required to it.

  The Board of Directors will review this policy annually. The next review date is June 2022.

4.

Document Control

Status	Approved and issued
Approved By	Board
Effective Date	27 May 2020
Approval Date	27 May 2020
Policy Owner	Company Secretary
Amendment History
Version	Date	Author
2020.1	May 2020	Company Secretary

McPherson's Limited

Risk Management Policy and Internal Control

Framework

2021.1	June 2021	Company Secretary
2022.1	February 2022	Company Secretary
2022.2	April 2022	Risk and Compliance Committee