Risk Management

The Group embraces a risk-aware culture and believes that an ingrained risk culture is the key to effective risk management, while training is a useful tool to promote and engage management and employees in ERM implementation. The Group promotes the risk culture with the following key themes:

• Effective ERM is beyond processes and forms – it is a change of culture in terms of mindset and behaviour.
• ERM is not a standalone programme – it should be tailored and embedded in the Group’s business processes.
• ERM deals with both risks and opportunities – appropriate risk-based treatments can control risks and even seize further opportunities of value creation.

The Group's ERM Framework aims to enhance the ability to achieve its vision and mission, and fulfil its five core values. In support of this, the Group has established a robust ERM framework with the following risk management objectives:

• To fulfil our commitment to integrity, ethics and compliance as an integral part of our corporate governance
• To build agility and resilience amid uncertainty in dynamic business environment
• To facilitate risk-informed decisions and align the Group’s objectives, strategy and operations with the risk appetite
• To strengthen our capacity for seizing opportunities and safeguarding our assets to support our sustainable growth and create shared value

Risk appetite is defined to establish the extent and nature of risks the Group is willing to take in achieving our vision and mission. The Group’s risk appetite statement is disseminated across the Group and incorporated into our risk assessment criteria in order to align with our business objectives, core values, strategy, as well as risk management activities. The risk appetite statement is reviewed by the Board periodically to keep abreast of the ever-changing business environment and the latest development of the Group. The Group’s risk appetite is as follows:

• The Group upholds the highest standards of integrity, compliance, and ethics and has no tolerance for any material breaches of laws and regulations.
• The Group has no compromise on any threats which may significantly impact the health and safety of our people.
• The Group does not expose itself to any potential material damage to its reputation or brand.
• The Group proactively reduces its environmental footprint by embedding environmental considerations across its value chain, advancing its net-zero pathway, and avoiding activities that may significantly harm the environment.
• The Group respects human rights and promotes inclusive and equitable practices across its operations and supply chain. It seeks to create positive societal impact through responsible charitable partnerships, while refraining from activities that may cause significant harm to its people, stakeholders, or communities.
• The Group endeavours to minimize any business interruptions and significant operational impacts to business continuity. In addition, the Group remains vigilant to operational risks arising from climate change and continues to strengthen its climate adaptation measures to enhance operational resilience.
• The Group is prudent in making decisions that may threaten its long-term financial viability and liquidity to meet its financial commitments.
• The Group balances risks and opportunities whilst implementing strategies to minimize failure in business decisions, reduce shortfalls in achieving its ESG commitments and net zero pathway, and optimize the Group’s long-term value.

The overall risk management process is overseen by the Board. With the emphasis on value creation and protection, the Group adopts the Three Lines Model as its risk governance structure. The model clearly defines the responsibilities for enhancing collaboration and communication among different roles, which facilitates alignment of risk management activities and provides assurance to the Board.

Risk management process starts from the establishment of context, by taking into consideration of the external environment and megatrends, as well as risk universe of the Group. Risks are then identified, analyzed, evaluated and treated with measures. With constant review, monitoring, reporting and consultation, the risk management process integrates with various business processes and activities in optimizing the risk and return.

To facilitate a comprehensive and robust risk management process, top-down and bottom-up approaches are employed to gather risk insights as well as to monitor and manage risks from the perspectives of both sides, together with “ERM Policy” and “ERM Procedure” to provide proper guidance. Also, interactive communication between the risk owners and the GRM Team is in place to enable both parties to keep abreast of risk updates.

Risk Management Process

1. Establishment of Context

The Group defines the internal and external contexts (e.g. corporate objectives, core values, organizational structure, stakeholders, business segments, operating regions, regulatory environment) as well as the parameters for risk assessment criteria.

2. Risk Identification

The Group adopts both top-down and bottom-up approaches, complemented with outside-in and spread-out mechanisms to facilitate a comprehensive risk identification process. 

3. Risk Analysis

The Group adopts a two-phased methodology where business units and corporate office departments need to conduct a preliminary risk assessment to sort out key risks for undergoing comprehensive risk analysis, and a diverse spectrum of risk assessment criteria is applied throughout the process covering likelihood, impact, risk velocity, forecast risk movement, inherent risk level and residual risk level.

4. Risk Evaluation

The risk analysis results are compared with the risk appetite and tolerance level. This allows management to determine the risk response strategy for each risk and prioritize risk treatment plans.

5. Risk Treatment

Risk treatment plans for implementing risk mitigation measures are developed by respective business units and corporate office departments, based on the priority and nature of risks.

Continual tracking, review and validation of the implementation of our ERM framework have been in place to monitor various risks, change in risk exposure, their residual risk levels, as well as to ensure and increase the effectiveness and quality of ERM framework and outcomes.

Regular reporting, regarding identified risks and the status of risk management activities, is provided to management, the ERM Steering Group, the Executive Committee, the Audit Committee and the ESG Committee to facilitate the risk management process and decision-making. The ERM Steering Group Meeting is held every half year to discuss key risk matters and updates.

The Group operates and invests in a diversified portfolio of businesses predominantly in Hong Kong and the Chinese Mainland, including financial services, toll roads, logistics, construction, and facilities management.

Through the comprehensive risk management process described in the previous section, the Group has identified major risks which may affect the achievement of its business objectives. However, risks evolve through interactions among various dynamic forces and factors in the business environment. Certain risks that are not currently significant may emerge as key risks in the future, while other risks may not yet have been identified. Accordingly, our risk portfolio is regularly reviewed and updated to react and respond to the changing risk landscape.

Overall Risk Trend and Emerging Risk Drivers
The Group’s risk environment in FY2026 continues to be influenced by the pace of economic recovery in Hong Kong and the Chinese Mainland, geopolitical tensions, trade policy uncertainty and an increasingly demanding regulatory landscape. Although interest rate volatility has moderated and inflation remains relatively contained, economic growth across the region remains uneven. Hong Kong’s GDP growth is forecast at 2.5%–3.5% in 2026, while the Chinese Mainland is expected to maintain moderate growth amid ongoing economic restructuring.

While these developments may affect consumer spending, investment decisions and financing conditions, the Group remains resilient, supported by a strong balance sheet, healthy liquidity position and prudent financial management practices. Existing liquidity resources and funding capacity are considered adequate to support business operations and strategic initiatives under both normal and stressed conditions. Notwithstanding the external uncertainties, the Group’s overall risk profile remains within its risk appetite.

Technology transformation remains a strategic priority for enhancing the Group’s competitive position. Advances in artificial intelligence, automation and digital solutions present significant opportunities to improve operational efficiency, customer engagement and decision-making capabilities. Across the Group, various business units are accelerating the adoption of emerging technologies, with investments subject to pilot implementation and ongoing evaluation to ensure they are supported by demonstrable business value, appropriate use cases and prudent cost-benefit considerations prior to wider deployment. For example, the insurance business utilizes digital platforms, data analytics and AI-enabled solutions to enhance customer experience, streamline operational processes and strengthen distribution effectiveness. Meanwhile, the construction business is expanding the use of smart site technologies and construction robotics to improve quality, productivity, safety and cost control, while fostering a more modern and technology-enabled working environment that supports attraction and retention of next-generation talents.

As reliance on technology grows, the Group faces heightened risks relating to cybersecurity threats, data privacy and AI governance. The Group will reinforce technology risk management, cybersecurity capabilities and governance frameworks to ensure these transformation initiatives are implemented in a secure, resilient and responsible manner. In parallel, certain business units have developed dedicated AI governance frameworks to support the responsible adoption of AI, with a focus on accountability, risk assessment, human oversight, continuous validation and ongoing training. The Group also promotes employee awareness and capability building through training programmes designed to encourage the effective use of emerging technologies, such as generative AI, while reinforcing the importance of cybersecurity, data protection, and ethical and compliance considerations. In addition, the Group’s expansion into digital infrastructure may introduce new technology, operational and regulatory considerations, which will continue to be incorporated into the Group’s risk assessment and monitoring processes.

Climate-related risks continue to grow in significance. The increasing frequency and severity of extreme weather events, evolving transition requirements associated with decarbonization initiatives and expanding ESG disclosure expectations may impact business operations, asset values, project delivery and stakeholder expectations. The Group continues to enhance its climate risk management capabilities through climate scenario analysis, business continuity planning, infrastructure resilience measures and sustainability initiatives under its ESG strategic priorities.

Looking ahead, the Group will maintain a vigilant and forward-looking approach towards emerging risks and opportunities. By strengthening risk awareness, enhancing resilience and promoting innovation, the Group remains well positioned to navigate uncertainties and support sustainable value creation for its stakeholders. Please refer to the following table for the major risks identified by the Group and the corresponding response measures. This is neither intended to be exhaustive nor comprehensive.