Risk Management
The Policy establishes the responsibility of risk owners, unified approaches to risk identification, assessment, monitoring and review, and integrates risk management into the Fund's key management processes.
The system operates on a three-lines-of-defence model:
- risk owners are responsible for managing risks at the level of business processes;
- the Risk Management and Internal Control Department, together with the Compliance Service, coordinate the methodology and control procedures;
- the Board of Directors provides oversight;
- the Internal Audit Service conducts an independent assessment of the effectiveness of the system.
We assess ESG risks using a single methodology based on the analysis of likelihood and impact. An inherent and a residual level are determined for each risk. The inherent risk reflects the potential level of impact in the absence of management measures, while the residual risk characterises the risk level taking into account the controls and management measures in place.
Information on risks is captured in a risk register, which sets out risk factors, possible consequences, risk owners and risk-management measures. For visualisation, a risk map is used, on which risks are mapped against potential impact and likelihood.
Data on ESG risks are generated at the level of portfolio companies, where such risks arise and are managed in the course of operational activities, and are then consolidated at the Fund level.
In 2025, we maintained our approach of including ESG risks in the corporate risk register and risk map. These reflect risks related to environmental, social and governance aspects of activity, including environmental and climate risks, accident risks, HR risks, the risk of social instability, and compliance and corruption risks.
Given the sectoral structure of the portfolio, these risks have different profiles. Environmental and climate risks, and risks in occupational health and industrial safety, are most material for energy, oil and gas, transport and industrial companies. Social, HR, compliance and cyber risks are cross-sectoral and material for all the Group's key assets.
The results of ESG risk assessment are considered as part of corporate risk reporting. The Risk Management and Internal Control Department verifies the correctness of assessments, analyses the completeness of disclosure, and where necessary develops recommendations for Fund representatives on the boards of directors of portfolio companies.
The consolidated risk map is considered by the Audit Committee and approved by the Board of Directors. Where the risk profile changes, the risk is reassessed and the risk class is adjusted, ensuring that controls and management decisions remain current.
Climate risk management
Climate risk management involves the Board of Directors, the Audit Committee, the Management Board and the Sustainability Committee.
The identification and assessment of climate risks are carried out taking into account the recommendations of the TCFD and the requirements of IFRS S2. The assessment uses scenario analysis and covers the potential impact on assets, operations and financial performance.
This approach is already applied in the management processes of NC KazMunayGas JSC, Samruk-Energy JSC, NAC Kazatomprom JSC and JSC NC Kazakhstan Temir Zholy (KTZ). At NC QazaqGaz JSC, work continues to develop a systematic approach to transition climate risk management under the 2025–2033 low-carbon development programme.
