3. Managing risk of Fraud – responsibilities

(a) The Executives are responsible for overall management of fraud risk, including:

1. (i) establishing and maintaining sound systems of risk management and internal
   control that support the achievement of company’s strategy and business
   objectives;
2. (ii) defining a fraud risk profile and undertaking a regular review of the fraud risks
   associated with each of the key organisational objectives to keep the profile up to
   date;
3. (iii) establishing appropriate mechanisms for reporting issues related to fraud risk; and
4. (iv) choosing appropriate consequence management towards employees committing
   fraud.

(b) Managers have overall responsibility for preventing, detecting and managing the fraud
risk on a day to day basis, including:

1. (i) identifying and assessing of fraud risks to which systems, operations and
   procedures within their area of accountability are exposed;
2. (ii) ensuring that established internal controls are being continuously complied with
   and relevant systems continue to operate effectively;
3. (iii) regularly reviewing and testing controls in place and, where appropriate,
   implementing new controls to reduce the risk of similar fraud occurrence in the
   future; and
4. (iv) fostering an anti-fraud culture.

(c) Every Employee is responsible for:

1. (i) acting with propriety in the use of the Group’s resources and the handling and
   usage of funds whether they are involved with cash or payments systems,
   receipts or dealing with suppliers or customers;
2. (ii) being conscious to the possibility that unusual events or one-off transactions could
   be indicators of potential fraud;
3. (iii) immediately reporting details of suspected fraud or irregularity through the
   established fraud reporting procedure; and
4. (iv) co-operating fully with dedicated employees assigned to conduct internal checks,
   reviews or fraud investigations.