Managing risk and opportunities

The Roche

Risk Management is an integral part of the group’s business practice on all levels of the Roche group. Risk Management includes:

• identification,

• analysis and evaluation of risks,

• the appropriate response,

• tracking and reporting of risks to provide assurance regarding the achievement of objectives.

On Roche Group level this is formalised in the Group Risk Management Process, where Divisional and Group functions and business areas assess risks and develop plans for the most material ones identified. This happens in parallel to the development of the business plans.

A consolidated Group Risk Report is then discussed and approved together with the business plan by the Corporate Executive Committee and reviewed by the Board of Directors.

This process is overall supported by Group Risk Advisory, which is responsible for the necessary alignment, co-ordination and development of Group Risk Management. Continuous improvement is applied to the Group Risk Management Process through stakeholder feedback and maturity measurement, and when appropriate external reviews.

In addition, Group Risk Advisory is coordinating / consolidating various risk management activities across the organisation including training and risk awareness activities. Risk management trainings include customised trainings for line management and Risk Managers (including a mandatory online training). Further Risk Management trainings (virtual and classroom) are offered by Risk Advisory and are available to all employees. Additionally, upon request Risk Awareness workshops are conducted for functions and regions and Roche Affiliates can receive risk management training to establish their own Risk Management process. These activities also focus on identification and management of risks as well as opportunities.

Also under the lead of Group Risk Advisory, a Risk Forum was kicked off in 2014 to create a cross functional network to explore new ways to raise risk awareness across the organisation. This has evolved into a Risk & Opportunity Alliance (ROAD) which conducts innovation dialogues/workshops to address complex topics which have a cross functional/divisional significance.

We also implemented a risk management programme designed to systematically identify, assess, mitigate and adequately manage the risk of human rights violations. This risk management programme does not only apply to our operations, but likewise to our value chain and activities related to our business. We discuss and assess identified risks within the Corporate Sustainability Committee. At the time being, the four identified top risks - including vulnerable groups such as patients, employees, suppliers and business partners – are Data Privacy, Safe workplace (incl. health risks), Working conditions (incl. child, forced or compulsory labour, harassment and discriminations) and Employee association. For further information, please visit our Human rights website .

Beside Group Risk Advisory many other 2nd lines of controls perform risk management activities and trainings (e.g. Healthcare Compliance, Medical Compliance, Safety, Health & Environment (SHE), Quality, Procurement, Pharma Global Technical Operations, etc.). In addition, many cross-functional risk activities occur within Roche, a few of which are described below as examples.

Financial Risk Management within the Group is governed by policies reviewed by the Board of Directors. Policy implementation and day-to-day Risk Management are carried out by the treasury functions and regular reporting on these risks is performed by the relevant accounting and controlling functions.

Crisis Management, where every subsidiary of the Group have established Emergency Management teams, with corresponding alarm and escalation procedures and authority to act quickly in the event of a crisis. Also, at Roche Group level there is a Roche Emergency Management Organisation and Support (REMOS), supporting Local Emergency Management when needed. These teams comprise operational line management with appropriate authority and they rehearse different crisis scenarios regularly.

A risk-based compliance management approach was developed in 2013 for one of the regional organisations to target compliance efforts to areas most at risk. A Compliance & Risk Management Office has been established to address specific risks in the procurement area.

Safety, Security, Health and Environmental risks are managed by Group SHE. A comprehensive bottom-up approach is used to identify and assess all SHE risks which are consolidated in a risk inventory and integrated into the Roche Group Risk Report.

Product Development continues to apply a consistent methodology for identification and management of risks that could impact achievement of development projects.

Digital Media Risk and opportunities continue to be monitored and managed by a cross-functional group.

A group wide Business Continuity Programme aims to further strengthen our business continuity management (BCM) to ensure that all sites respond effectively to catastrophic events and deliver a minimum, acceptable level of key products and services. The respectiveGroup BCM policyand guideline is in place, facilitating a consistent and aligned local implementation.