การจัดการความเสี่ยง
Risk Management

The Company places importance on risk management as a key mechanism to support business operations and value creation across the short, medium, and long
term planning horizons. A systematic approach to risk management enables the Company to effectively identify and address uncertainties that may impact its performance, including strategic, operational, financial, and external risks, thereby supporting business stability, strengthening organizational resilience, and enhancing adaptability to changing conditions. Effective risk management also helps the Company in reducing potential adverse impacts, such as operational disruptions, financial losses, and reputational damage, while creating opportunities to improve decision-making, Optimize resource allocation, and enhance stakeholder confidence. These impacts, risks, and opportunities arise across the value chain, particularly in operations, supply chain, and corporate functions. To address these challenges, the Company integrates risk management into its strategy and decision making processes through a structured Enterprise Risk Management (ERM) framework, enabling proactive risk identification, mitigation, and continuous monitoring to support long-term competitiveness and sustainable
value creation.

Management Approach

Enterprise Risk Management (ERM) Policy statement

TSTH is committed to adopting a proactive approach to risk management by fostering a culture of informed decision-making across all levels of the organization. The Company strives to anticipate and take preventive action to manage or mitigate risks and address residual risk. It also seeks to develop, implement, review, and monitor a uniform risk management policy, framework, and plan across all business units, functions, and locations. In addition, the Company develops and deploys
relevant capability-building measures for employees and stakeholders to ensure effective risk management, while emphasizing that all employees are responsible
for the effective management of risks in all aspects of the business.

Risk Management Framework

TSTH’s Enterprise Risk Management (ERM) framework is designed to provide a comprehensive and structured approach to identifying, assessing, monitoring, and
mitigating risks that may impact the achievement of business objectives. The framework is aligned with the Tata Steel (TSL) Group ERM framework and incorporates internationally recognized standards and best practices, including the Committee of Sponsoring Organizations of the Treadway Commission (COSO) and ISO 31000.

The Company adopts a proactive and dynamic risk management approach through both top-down and bottom-up risk identification processes. Risk identification
is an iterative process that evolves with changing business environments and market conditions, covering key business, operational, financial, market, and strategic
risks. Risks are assessed based on likelihood, impact, and velocity, and categorized into Class A, B, and C according to risk scores and mapped onto the Risk Heat
Map. Risk scores and mitigation effectiveness are regularly reviewed through early warning indicators and ongoing monitoring processes by functional management teams as well as the Apex Risk Review Committee, chaired by the President and Chief Executive Officer, to ensure timely implementation of appropriate mitigation actions and minimize potential adverse impacts.

Enterprise Risk Management (ERM) Process

1. Establish Context

The organization defines the internal and external context for risk management, including business objectives, operational environment, and key stakeholders, resulting in a clear ERM framework and defined scope aligned with strategic priorities.

2. Risk Identification

Risks are identified through both top-down and bottomup approaches, including inputs obtained through risk workshops, and by considering internal operations as well as external business environment factors, resulting in a comprehensive risk register covering all key business risks.

3. Assess Risks & Evaluate

Identified risks are assessed based on likelihood and impact, with risk scores calculated to evaluate their significance, resulting in risk ratings, classification into
Class A, B, and C, and visualization through a Risk Heat Map.

4. Risk Mitigation

Appropriate risk mitigation plans are developed and implemented to reduce risk exposure, with actions assigned to responsible owners and tracked for progress,
resulting in defined mitigation plans and ongoing control improvements.

5. Monitor, Review & Report

Risks, key indicators, and mitigation progress are continuously monitored and periodically reviewed, with updates reported to management and the Risk Review
Committee, resulting in regular risk reports, updated risk status, and oversight governance to ensure effective and timely risk management.

ERM Governance Structure

To ensure effective oversight and accountability, the Company has established a structured ERM governance framework, clearly defining roles and responsibilities
across all levels of the organization.

The Audit & Risk Review Committee consists of three Independent Directors and is responsible for overseeing the integrity of the Company’s financial reporting,
compliance, internal control, and Enterprise Risk Management (ERM) processes. The Committee is chaired by Ms. Anuttara Panpothong, who has extensive expertise in accounting and finance, particularly in reviewing and ensuring the reliability of financial statements.

The governance structure for Enterprise Risk Management (ERM) is designed to ensure effective oversight, accountability, and proactive risk management across the organization. At the Board level, the Board of Directors, through the Audit & Risk Review Committee, provides

overall governance and oversight of the Company’s risk management framework, policies, and practices. The Committee reviews the accuracy and adequacy
of financial statements, monitors compliance with applicable laws, regulations, and Company policies, and oversees the effectiveness of the Company’s internal
control, internal audit, and risk management systems. In addition, the Committee reviews the adequacy and effectiveness of risk identification, assessment,
monitoring, mitigation, and reporting processes on a quarterly basis, and provides recommendations for continuous improvement to ensure alignment with
business objectives, strategic priorities, and international standards.

At the management level, the Apex Risk Review Committee, chaired by the President and Chief Executive Officer, is responsible for overseeing the implementation
of ERM processes and monitoring key enterprise risks

across the organization. Senior executives and functional heads are accountable for identifying, assessing, and managing risks within their respective functions, including the development and execution of mitigation plans, monitoring of early warning indicators, and regular reporting of risk status and emerging issues.

At the operational level, relevant business and functional units across the organization are responsible for conducting both top-down and bottom-up risk
identification processes, evaluating risk likelihood, impact, and velocity, prioritizing risks based on risk scores, maintaining the Risk Heat Map, and ensuring
timely implementation of mitigation actions. The Risk Management function supports and coordinates the overall ERM process through risk reporting, consolidation, monitoring, and facilitation of periodic risk reviews, thereby strengthening the Company’s risk governance framework and organizational resilience.

Targets and Goals

Risk and Impact Management Practices

Aligned with the Company’s Enterprise Risk Management (ERM) framework, key business risks are proactively managed through structured risk mitigation approaches. The Company discloses a summary of principal risk areas and the corresponding mitigation measures under
the Risks of Business section, highlighting actions undertaken to address these risks and support effective risk management.

Highlighted Implementation and Activities

Enterprise Risk Refresh Workshops 2026

TSTH conducted 8 Enterprise Risk Refresh Workshops across key functions during January–February 2026 to update and validate key risks and identify emerging risks for the next fiscal year. Each session involved relevant stakeholders, including Vice Presidents of the respective functions, Department Managers, Section Managers, and other designated representatives. The output was used to update the Company’s risk register and support the refinement of mitigation plans.

Enterprise Risk Management (ERM) training

The Company also organised an online training session on the ERM process, featuring a guest speaker from TSL, on 26 November 2025. The session was attended
by 50 employees across various functions, including senior staff with 3–5 years of experience, Department Managers, Section Managers, and other designated
representatives. The training aimed to enhance risk management awareness and foster a risk-aware culture across the organization.

FY 2026 Performance