ICICI Prudential Life Insurance Company Ltd Management Discussions

2Total cost including commission excluding interest on sub debt/ (total premium-90% of single premium).

Persistency ratio: The Company has a strong focus on improving the quality of business and customer retention. Our 13th month persistency ratio stood at 89.1% for FY2025. The 49th month persistency ratio stood at 69.5%.

Expense ratio: The cost to total weighted received premium (TWRP) ratio stood at 25.1% in FY2025 compared to 24.0% in FY2024 primarily on account of increase in expenses relating to commission.

Solvency ratio: The Company had a solvency ratio of 212.2% at March 31, 2025, compared to the minimum regulatory requirement of 150%.

Consolidated financial results and subsidiary performance

The Company has a wholly owned subsidiary, ICICI Prudential Pension Funds Management Company Limited (PFM). The PFM is licensed by the Pension Funds Regulatory and Development Authority as a Pension Fund Manager under the National Pension System (NPS). The PFM had also obtained registration as a Point of Presence (PoP) for NPS distribution and servicing.

Business

The subscribers funds managed by the PFM increased from 284.19 billion at March 31, 2024 to 454.55 billion at March 31, 2025, an increase of 59.9% during the year.

The PFM has a market share of 16.99% in the private sector AUM at March 31, 2025.

The net worth of PFM at March 31, 2025 stands at 0.53 billion (at March 31, 2024 0.56 billion) on account of loss incurred during the period.

For the year ended March 31, 2025, the PFM registered a loss primarily on account of increase in employee benefit expenses and other operating expenses reflecting the building up of capacity as part of the overall growth plan. The subsidiary is committed towards increasing its presence in the industry and is focused on scaling up the business and revenue.

Basis of consolidation

The consolidated financial statements are prepared in accordance with the accounting standards notified under section 133 of the Companies Act 2013, read together with paragraph 7 of the Companies (Accounts) Rules 2014, section 129(4) of the Companies Act, 2013. The financials are consolidated on a line-by-line basis in accordance with AS 21 on ‘Consolidated Financial Statements. These consolidated financial statements for the Group are prepared in accordance with the principles and procedures for preparation and presentation of consolidated financial statements as laid down under the Accounting Standard (AS) 21, “Consolidated Financial Statements” and are presented in the same format as that of the Holding Company. The financial statements of the Holding Company and its subsidiary have been combined on a line-by-line basis by adding together similar items of assets, liabilities, income and expenses in respective components of financial statements after eliminating intra-group balances, transactions and resulting unrealized profits/ losses. The Policyholders account specifically dealing with direct insurance business governed by IRDAI regulations has retained its distinct independent form in these consolidated financial statements.

The consolidated profit after tax for the Company increased from 8.51 billion in FY2024 to 11.86 billion in FY2025.

III. INTERNAL CONTROL SYSTEMS AND THEIR ADEQUACY

The internal controls of the Company are commensurate with the business requirements, its scale of operation and applicable statutes to ensure orderly and efficient conduct of business. These controls have been designed to provide a reasonable assurance with regard to maintaining proper accounting controls, safeguarding of assets, prevention, and detection of frauds and errors, ensuring operating effectiveness, reliability of financial reporting, and compliance with applicable regulations.

The Company has a mechanism of testing the controls at regular intervals for design and operating effectiveness. Further, the auditors opine on the adequacy and operating effectiveness of internal financial controls over financial reporting.

The key components of the internal financial control

framework implemented by the Company include:

I. Entity Level Controls (ELCs) that operate at an organization level on which the control environment of the company relies on.

II. Controls operating at process level with the objective of providing assurance at a transaction recording stage, in most aspects of operations and processes, the Company has deployed automation for control and efficiency.

III. Robust IT control environment with adequate controls focused on reconciliation between systems, auto checks to avoid any duplicate data upload, reconciliation of all jobs run at the beginning and end of day, matching of trial balance and ensuring no unposted entries in the system monthly.

IV. Control over third parties providing services focusing on due diligence, risk assessment, document review and periodic assessment to ensure controls over third-party service providers relevant from a financial reporting perspective. Further, the Board Risk Management Committee has oversight on the implementation of controls and monitors the performance of the outsourced vendors.

V. Controls over safeguarding of assets (comprising of investment assets, IT assets and other assets). These controls are based on value and custody of assets.

VI. Review controls which comprise of multiple levels of oversight over financial reporting by way of a strong reporting and review framework. There are senior management controls comprising of high-level controls (HLC) and management

review controls (MRC) to monitor and identify any material misstatement.

VII. Fraud control framework which consists of preventive measures, incident management and awareness activities.

These controls are covered under the IFC framework which is aligned with Internal Control Framework 2013 given by the Committee of Sponsoring Organisations (COSO) of the Treadway Commission and tested at regular intervals for design and operating effectiveness.

There had been no material changes in the process level controls or activities conducted in the financial statement closing process of the Company. The Company had tested all material controls over financial reporting at March 31, 2025 and found them to be operating effectively. Further the Company has been compliant with the requirements, prescribed under amendments in the Companies (Account) Rules, 2014, of using accounting software which has a feature of recording audit trail and creating an edit log of each change made in the books of account.

In addition, internal audits are undertaken to review significant operational areas regularly. The Audit Reports, submitted by the Internal Auditors, are reviewed by the Audit Committee and corrective action is initiated to strengthen the controls and enhance the effectiveness of the existing systems. Statutory and Internal Auditors are also invited to the Audit Committee meetings to ascertain their views on the adequacy of internal control systems. The management believes that strengthening internal controls is a continuous process and it will, therefore, continue its efforts to keep pace with changing business needs and environment.

The Company recognises that risk is an integral element of the business and managed acceptance of risk is essential for generation of shareholder value. The Companys acceptance of risk is dependent on the return on risk-adjusted capital and consistency with its strategic objectives. Having accepted a risk, the Company may cede or hedge it where this is cost effective. In general therefore, the Companys control procedures and systems are designed to manage risk, rather than eliminate it. However, at certain times, there may also exist some risks for which the Company has no tolerance and which are actively avoided.

The Company has in place a risk management framework with the following aims:

• Determining the risk profile of the Company i.e. the aggregate level of risks that the Company has undertaken in pursuit of profitable business.

• Identification, measurement, monitoring and control of risk for the purpose of protecting the interests of key stakeholders.

• Enhancing the Companys ability to identify and pursue opportunities that offer attractive risk-adjusted returns by providing transparent, accurate and timely risk information.

• Embedding risk-based decision making in key management processes and fostering a culture of risk awareness.

• Limiting the Companys exposure to adverse outcomes through risk limits.

• Ensuring compliance with regulatory requirements.

• Focusing on ensuring that it possesses the appropriate capabilities and experience in managing and transferring risks.

• Minimising reputational risk.

• Management of sustainability risks.

RISK GOVERNANCE FRAMEWORK

The risk governance structure of the Company consists of the Board, the Board Risk Management Committee (BRMC), the Executive Risk Committee (ERC) and its sub-committees.

The risks faced by the Company are classified into market, credit, liquidity, insurance, operational and reputation. In addition to these risks, the life insurance industry faces a number of emerging risks. Geo-political tensions and disruption to energy supplies continue to be additional sources of uncertainty for financial and commodity markets and trigger for inflation (which could

impact credit quality of counterparties, as well as reduce real wages thereby impacting discretionary savings, insurance new business and persistency risk).

There are also emerging risks related to ESG (environmental, social and governance) issues. For the Company, governance, ethics and sustainability are the overall responsibility of the Board, with its committees playing key roles in identifying, mitigating and managing ESG risks and other material issues. One of the most prominent ESG risks is that of climate change which could potentially have wide ranging implications including (but not limited to) adverse impact on economic growth and investment markets and higher than expected claims due to increased risk of future weather-related catastrophes, pandemics as well as possible changes in long-term mortality/morbidity rates. The Company continues to work towards developing its understanding of ESG risks, including climate change and remaining aware of industry best practice as it develops. The current industry consensus is for insurers to treat climate risk as an amplifier of existing risk categories rather than a new risk category. Accordingly, sustainability risks including climate-related risks are integrated in our risk management framework and are part of our Board approved Risk Policy (“the Policy”). For the impact of ESG risks on the asset side, the Company has implemented a framework for investment decisions that will support mitigation of risks due to climate changes as well as other environmental, social and governance risks by factoring these in its investment decisions. While climate change can also impact morbidity, mortality and persistency and thus, the Companys liabilities, it is expected that the impacts will emerge gradually, and through a change in future assumptions earlier than through actual incidences. The longer-term impact to the Company should be managed by its ability to reprice contracts and develop new products if required. Apart from climate change, there are other emerging risks associated with public health trends such as increase in obesity related disorders and demographic changes such as population urbanisation and ageing. Another increasingly important ESG aspect is that of data privacy which could potentially have a material impact on the Companys reputation. The risk management framework of the Company seeks to identify, measure and control its exposures to all these risks within its overall risk appetite.

The risk philosophy of the Company is outlined in the Board approved risk policy (‘the Policy) which is reviewed by the Board at least annually. The Policy details identification, measurement, monitoring and control standards relating to the various individual risks. The Policy covers aspects related to:

i) Financial Risk Management or Asset Liability Management (‘ALM): covering market risk, credit risk, liquidity risk and insurance risk

ii) Operational Risk Management: covering fraud risk, compliance risk, legal risk, outsourcing risk, customer risk and measurement and control of operational loss, information and cyber risk and business continuity risk

iii) Reputation Risk Management

In addition to the above, the Board has approved the following policies that assist in managing some of the above risks:

• Reinsurance Policy

• Underwriting Policy

• Outsourcing Policy

• Fraud Risk Management Policy

• Information & Cyber Security Policy

• Business Continuity Management Policy

• Derivatives Policy

This framework in conjunction with the three lines of defence helps the Company manage risk. The key responsibilities of each line are laid out below:

First line of Defence

• Business functions that manage risk

• Responsible for identifying risks and maintaining effective internal controls

• Executing risk and control procedures on a day-to-day basis

Second line of Defence

• Risk management function that facilitates and monitors the implementation

of effective risk management practices by business teams

• Defining target risk exposure, reporting adequate risk-related information throughout the organisation

V. ^

Third line of Defence

• Internal and external audit provides the Board with comprehensive assurance based

on independence and objectivity

• To ensure adequacy of risk controls and appropriate risk governance

The risk management model of the Company comprises a four-stage continuous cycle, namely the identification and assessment, measurement, monitoring and control of risks.

1. RISK IDENTIFICATION

The Company identifies its risk exposure through a variety of techniques and processes, including:

1) Stress testing of the current financial condition of the Company. The Company periodically carries out stress testing of its assets and liabilities to identify impact on the regulatory and economic solvency position. Such testing is used as an aid in analyzing the Companys resilience, assessing the effectiveness of risk controls and identifying significant existing or emerging risks to its financial position, such as severe economic shocks and catastrophic events, which could materialize as a consequence of several risk factors including climate change and other emerging risks.

2) Product development process by way of ? analysis of the sensitivity of profit margins and

of profit patterns to market and insurance risks.

Any liquidity or operational risk arising out of the new product or modification of an existing product is assessed prior to product launch.

3) Business planning process by way of analysis of the sensitivity of the projected solvency and emergence of profit to market and insurance risks.

4) Review of the bases of assumptions, which are used for valuation, pricing and new business profit reporting, at least annually to assess any change in risk profile.

5) Tracking of key liquidity risk indicators.

6) The Board of the Company periodically reviews the potential impact of strategic risks such as changes in macro-economic factors, government policies, regulatory environment and tax regime on the business plan of the Company. The Company has a framework in place for identifying business concentration risk and it actively engages in diversification of business across various drivers including distribution partners and product segments.

7) Risk and Control Self-Assessment (RCSA) to identify and assess operational risks in terms of their likelihood and impact for each business unit within the Company. The RCSA activity is done with due cognisance to any loss events or audit findings.

8) The Company evaluates legal and regulatory risk by monitoring the implementation of relevant requirements and monitoring for any deviations.

9) Reputation risk is monitored based on trends in regulatory orders (if any), media mentions, customer complaints and legal cases.

2. RISK MEASUREMENT

The Company uses the following approaches to measure its risk exposure.

1) Economic capital requirement (ECR): ECR is an appropriate measure of risk exposure for market, credit and insurance risks. ECR is measured by calculating the reduction in available economic capital (market value of assets less realistic liabilities) under extreme economic and non-economic scenarios. The stresses are benchmarked to European Insurance and Occupational Pensions Authority (EIOPA) standards as they develop, subject to appropriate adjustments for local conditions and the Companys stage of development.

2) Risk to the growth of the EV: The Company considers risks that impede future growth of the EV like insufficient new business profit growth and over-run in acquisition or renewal expenses, caused by adverse deviation of actual unit costs from planned unit costs.

3) Risk to the statutory position: The Company considers the impact of market risk on its statutory position and assesses the quality of its ALM by performing a resilience test periodically on the regulatory balance sheet. It conducts asset-liability modelling on its balance sheet to assess the potential impact on its solvency cover.

4) Liquidity ratio of highly liquid assets to near-term liabilities is tracked in order to assess the liquidity position.

5) Actual vs. Expected Experience: The Company periodically reviews the actual experience relative to the expected experience (A/E) for mortality, morbidity, and persistency ratios in order to monitor trends and also gain insights on emerging risks, if any. The Company also considers trends in key indicators like surrender rates.

6) Operational and fraud losses are measured as a proportion of profit before tax to identify the extent of deviation from the agreed tolerance limit. In addition, key operational risk indicators are tracked.

7) Reputation risk score is calculated based on a methodology of rating various parameters impacting the risk such as regulatory concerns, media mentions, customer complaints and legal cases.

3. RISK MONITORING

The ERC reviews all the risks and presents a risk report to the BRMC on a quarterly basis. The BRMC informs the Board of the key findings.

4. RISK CONTROL

I dentified risks are managed by one or more of the following techniques

• Retention (acceptance);

• Avoidance;

• Transfer or;

• Reduction (mitigation).

The nature of the controls implemented and the level of control exercised are based upon the:

• Potential severity of the risk;

• Frequency of the risk occurring;

• Cost of implementing controls relative to the significance of the risk;

• Risk appetite.

a. Market risk:

1. Launching new products can significantly alter the risk profile of the Companys balance sheet. Market risks inherent in the new products or significant modifications to existing products are identified at the product design stage and a risk report is placed before the ERC and the Product Management Committee (PMC). The products are launched only after approval by the ERC and the PMC.

2. Asset Liability Management (ALM): Asset-liability management involves minimising the risk due to mismatches in assets and liabilities. Mismatches could arise either due to asymmetric changes in the value of assets and liabilities as a consequence of changes

in macroeconomic factors such as interest rates, or due to asynchronous cash inflows and outflows. The Company has developed detailed investment specifications that govern the investment strategy and limits for each fund depending on the profile of the liability backed by those assets. For each category of products, the investment specifications specify limits to permissible exposures to various asset classes along with duration guidelines for fixed income instruments. The investment specifications are designed to achieve the risk versus return objectives and policyholders reasonable expectations while maintaining the risk within the Companys risk appetite and with due consideration of regulatory requirements. The mitigation strategies for different portfolios are as follows:

i. Category 1: Non-linked business where the benefits to policyholders are based on performance of the underlying investments For these funds the Companys asset allocation strategy, which includes investments in equities, is designed to achieve the twin objectives of managing risks arising from guarantees and optimising policyholder returns, subject to regulatory constraints. Asset Liability Management (ALM) is done through regular monitoring of the equity backing ratio and debt duration against limits as applicable. The bonus declaration mechanism for participating products also helps in the smoothing of the volatility of the investment returns.

ii. Category 2: Non-linked business where the benefits and premiums are fixed at the start of the contract

The liabilities for these lines of business are obligations to policyholders or to meet expenses and have to be met either at a fixed time or on the occurrence of a contingency. The Company manages the risk on such products by investing only in fixed income instruments. Further, a combination of duration matching and cash flow matching approaches is used to mitigate asset liability mismatches. The Company uses interest rate derivatives and separate trading of registered interest and principal securities (STRIPS) to hedge interest rate risk. In particular, a forward rate agreement (FRA), which is a particular type of interest rate derivative, allows the Company to lock in now the interest rates at which the future premiums would be invested.

iii. Category 3: Linked products with guarantees

The Company uses a mix of stochastic and deterministic approaches to calculate the cost for providing the guarantee and holds a reserve on this account. The Company manages the investment risk arising from these products by setting limits on the equity backing ratio and debt duration.

iv. Category 4: Linked products without guarantees

The linked portfolio without guarantees has minimal investment risk to the solvency of the Company. These funds are managed with respect to an appropriate benchmark index and do not require any active ALM.

b. Credit risk:

The Company manages the credit risk of its investments through the following measures:

1. Exposure limits for companies, groups and industries in accordance with IRDAI norms and limits as per its own Investment Policy;

2. Restricting investments primarily to securities rated AA and above;

3. Engagement with select and financially sound reinsurers as per internal guidelines for reinsurance. The credit risk on reinsurance contracts are reviewed when the Company plans to enter into

a relationship with a new reinsurer, or in case of significant events like credit rating downgrades of existing reinsurers;

4. Approved counter-parties are used to minimize settlement risk

c. Liquidity risk:

The Company faces limited liquidity risk due to the nature of its liabilities. The Company has put the following mitigants in place:

1. The Investment Specifications as a part of the asset liability management framework provide guidelines to manage liquidity risk by specifying the minimum investment in highly liquid assets, taking account of constraints on the fungibility of assets among funds, and by specifying cash flow matching for certain funds.

2. The Company has a liquidity contingency plan, which addresses the following

a) Identifying mitigants to liquidity stress arising out of contingencies;

b) Communication and action protocol;

c) Restoring normality in the event of any contingency;

3. New products are launched only after approval by the ERC and the PMC.

The ERC also evaluates the impact of market liquidity on any hedging or asset allocation strategy required by the product.

d. Mortality, Morbidity and Longevity risks:

The Company uses the following approaches to manage its mortality and morbidity risk:

1. Developing new products: The Company designs exclusions and terms and conditions in consultation with reinsurers and with due regards to market practices to manage the mortality, morbidity and longevity risks. In order to deal with a changing insurance landscape or emerging risks, new products could be developed with more suitable product features, policy wordings, exclusions and terms and conditions.

2. Product approval process: Launching

new products can significantly alter the risk profile of the Companys balance sheet. Insurance risks inherent in the new products or significant modifications to existing products are identified at the product design stage and products are launched only after approval by the ERC and the PMC.

3. Reinsurance: The Company uses

appropriate reinsurance arrangements, including catastrophe reinsurance, to manage insurance risk. Such reinsurance arrangements can support in risk transfer of emerging risks as well. The Companys reinsurance exposures are considered and approved by the ERC periodically.

4. Re-pricing: The Company also reserves the right to re-price future new business in case of adverse experience, which could materialize due to various factors including sustainability risks.

5. Underwriting and claims controls: Underwriting procedures and processes are in place to identify risk at the time of acceptance of the contract for different classes of business. A review of the underwriting strategy is carried out periodically. The underwriting strategy can be adjusted to allow for any changes in the insurance risk landscape or emerging risks. Claims procedures are also in place to assess and manage the risks at the claims stage, which are reviewed periodically.

6. Experience analysis: The Company periodically reviews the actual experience relative to the expected experience for mortality, morbidity and longevity. Such a review will provide the Company insights on emerging risks if the Company faces any.

7. Review of bases: The Company conducts a review at least annually of the bases of assumptions, which are used for various purposes such as valuation, pricing etc. to assess any change in risk profile. A widespread increase in mortality or morbidity, for example as a result of climate changes or emergence on new diseases, may require the Company to re-evaluate its assumptions.

e. Persistency risk:

The Company uses the following approaches to manage the risk:

1. Experience analysis: The Company conducts its experience analysis regularly to ensure that corrective action can be initiated at the earliest opportunity and that assumptions used in product pricing and embedded value reporting are in line with experience.

2. Product features: The Company uses features like loyalty bonuses and additional allocation of units to encourage policyholders to continue with the policy.

3. Service initiatives: The Company uses a combination of proactive and reactive interventions to manage persistency. The interventions could include attaching direct debit or ECS mandates at new business stage, sending communication via different media such as emails to customers and distributors and reminders and telephonic interviews with customers.

4. Aligning key performance indicators: The Company uses different key performance indicators for different levels of hierarchy in sales and operations to align interests and ensure adequate focus on persistency.

f. Expense risk:

The Company uses the following approaches to manage the risk:

1. Experience analysis: The Company actively monitors its expense levels, which are then fed back into new product pricing, calculation of reserves and management reporting. In case of any adverse deviations between actual unit costs and planned unit costs, mitigation measures are taken.

2. Aligning key performance indicators: The Company uses different key performance indicators to align interests and ensure adequate focus on expense.

g. Operational risk:

The Company uses the following approaches to manage the risk:

i. Mitigation plans are developed for high risk items identified and monitored by the risk committees

ii. The Company actively promotes a risk awareness culture by improving understanding through communication and education among management, employees, contractors and vendors. Appropriate training material is developed and cascaded to improve knowledge and promote a strong operational risk practice. Further, risk champions have been nominated across various functions who support the risk management teams to identify risks proactively and create an awareness culture within such functions.

iii. The Company also has in place policies to manage operational risk like Whistle-blower policy, Code of Conduct for employees, Code of Conduct for Prevention of Insider trading, Anti Money Laundering and Counter financing of Terrorism policy and Anti-Bribery and Anti-Corruption Policy.

iv. Fraud Risk Management: The Company ensures adherence to Fraud prevention framework laid down by the regulator and directives under Companies Act 2013. The following approach has been adopted to prevent fraud:

v. Outsourcing Risk: Processes of the Company are outsourced, where it is convinced of the advantages by entering in such arrangements, as permitted under IRDAI (Outsourcing of Activities by Indian Insurers) Regulations 2017 (“the regulation”). The Company has an Outsourcing policy and it follows the below operating framework for the required due-diligence for any new activity or vendor empanelment. The Company has constituted an Outsourcing Committee which oversees the compliance to the regulation.

( Customer satisfaction

& reputation • Adequate training of outsourced staff

• Tracking of grievances & blacklisting

• Anti bribery and Anticorruption checks conducted for high risk vendors

Business continuity

• Minimal reliance on single vendor

• Periodic drills conducted to ensure no disruption

Data security

• Risk assessment done on an on-going basis

• Secure transmission and encryption of data shared with vendors

Process delivery

• Indemnity against any malpractice

• Monitoring consistent deficiency in service delivery

• Penalty levied in case of breach

vi. Business Continuity Management (BCM): The Company has a Business Continuity Management (BCM) framework and policy to ensure resilience and continuity of key products and services at minimum acceptable level. The Company regularly test disaster recovery plans and update the business continuity plans based on the learnings and assessment of evolving risks. As part of the BCM framework, business impact analysis and risk assessment is conducted to assess the likely impact on the Companys business processes due to adverse events like, natural disaster, pandemic, technical disruption, cyber-attack, administrative decisions like lockdown, etc. The Company has been accredited with the ISO 22301:2019 certification for the business continuity management systems. The key BCM objectives and the framework are depicted below.

Safety of personnel

• Disaster management protocol

• Employee training and awareness

• Assessment and testing

Availability of information

• Back-up for all critical information

• Disaster recovery plan

• Periodic testing

r ^

Continuity of critical processes

• Identify critical functions

• Minimum resources defined

• Business continuity plan testing

Crisis

communication

• Employee level communication

• Alternative locations/transcript for customers

• Inform regulator/ management

vii. Information and Cyber Security: The Company has an information and cyber security framework and policy that ensures all information assets are safeguarded by establishing comprehensive management processes throughout the organisation and information is protected adequately through appropriate controls and proactive measures. The Company has considered defence-in-depth approach and has implemented security solutions like firewall, intrusion prevention system, anti-malware solutions, end point detection and response (EDR), email security, end point security, data leakage prevention, network access control (NAC) and web proxy. The Company has mechanism in place to monitor cyber security events to detect and respond to any threats to its network, application and infrastructure. A disciplined and focused application security program is in place, to the regularly conduct vulnerability assessment of critical IT applications and infrastructure. Further, cloud security strategy, practices and advance level controls for protecting data and IT infrastructure has been implemented. Cyber security operations centre (SOC) has been setup for proactive monitoring (24x7), incident response, recovery, and remediation activities. The Company also collaborates with threat intel partners, which allows to proactively identify and address cyber risks. Considering the dynamic nature of the

technology ecosystem and emerging cyber threats, Information and Cyber Security controls are periodically assessed with the help of external consultants to identify new areas and risk, so that control effectiveness can be improved. An awareness programme is in place, covering the aspects related to data security and privacy, such as ‘Dos and Donts in the areas of privacy & confidentiality, workplace responsibilities, password and email security as well as information and cyber security. Further, employee onboarding and induction process includes information and cyber security aspects. Special focused Cybersecurity workshops are conducted for the leadership teams. Cyber crisis management plan is implemented which covers material crisis scenarios and a mechanism to address five phases, namely identification, containment, remediation, recovery and debrief.

Based on the Information Security Management System (ISMS) controls implemented and the assessment conducted by the certification body, we have been awarded a certification under the ISO 27001:2022 standard.

The Company has a privacy policy in place which provides commitment to privacy throughout the life-cycle of the information from, collection, processing, sharing, retention and destruction, by taking reasonable steps to protect the confidentiality of the Personal Information provided.

The Company also engages external consultants and experts regularly, to reassess the controls and solutions implemented and improve the effectiveness.

h. Reputation risk:

Reputation risk can be defined as the risk of negative opinion about the financial stability, service levels, integrity, transparency or any other aspect, in the minds of the stakeholders, resulting in a decline in business volumes and eventually impacting continuity of business.

The Company has defined a reputation risk framework and periodically monitors various parameters that could impact the reputation of the Company. The Company uses various approaches to manage reputation risk such as faster resolution of customer grievances, root cause analysis of complaints and identification of issues through proactive management of adverse feedbacks in the media.