9. Internal Control, Risk Management, and Internal Audit

The Company has an efficient management system in place throughout the
organization, which aligns and integrates Governance, Risk Management
and Compliance, including the crucial areas of Strategy, Process,
People, Technology and Structure, to drive the Company’s key strategic
goals, achieve optimum efficiency and effectiveness and ensure
sustainable development.

To achieve the Company’s objectives and accomplishments and add value to
the Company’s stakeholders, the Board of Directors and Audit Committee
have aware and realized an essential of Internal Control and Risk
Management mechanisms, and related roles, so they assigned these
responsibilities to all staffs. In addition, the Company clearly defines
management and staff operating authority at all levels in accordance
with relevant internal and external regulations and laws, covers
financial control, operations, management, and supervision.

The Company has defined that all employees must assess the effectiveness
of Control Self-Assessment (CSA) by identifying and mitigating risks to
an acceptable level which encourages employees to take continuous
personal responsibility for self-assessing risk and developing internal
control systems to strengthen the effectiveness of the internal control
and risk management systems. In addition, in the year 2012, The Company
hired external consultant to assess corporate and operational risk
management for developing and applying Enterprise Risk Management (ERM)
framework for more effective practical operation across the organization
in order to provide reasonable assurances to the achievement of the
following objectives:

1.  Strategies and objectives are clearly stated, practical and aligned
    with the Company’s mission.

2.  Outcomes are achieved to stated objectives, while resources are
    managed and used efficiently and economically.

3.  All reports, including financial, management and operational
    information are accurate, reliable and timely.

4.  Business operations are in line with the Company’s policies,
    regulations, laws, and other related rules both internal and
    external to the company.

5.  Appropriate safeguarding systems are implemented to protect physical
    assets, personnel and information systems data.

6.  Established good corporate governance system with an effective
    quality management system.

7.  Continuous high quality improvements are made to operations
    regarding personnel, equipment assets and operating systems.

8.  Control Self-Assessment is implemented properly in all crucial
    processes throughout the organization.

The Company has proper and effective internal control and risk
management systems, aligned with the integrated framework of the
Committee of Sponsoring Organizations of the Treadway Commission (COSO)
which consist of COSO framework and Enterprise Risk Management (ERM)
relating to business operations and management processes within the
Company. The eight enterprise risk management components are as follows:

1.  Internal Environment

The Company encourages and promotes a good working environment by
setting policy and planning, executing, controlling and monitoring all
business activities. The Company has also established a suitable
organizational structure, according to business size and operations,
which complies with its Corporate Governance Policy and adheres to its
business philosophies and ethics, written in the Code of Business
Ethics. The Company has appointed a Business Ethics Committee, with the
Chief Executive Office as the

Chairman and senior management as committee members, to conduct its
business in compliance with good corporate governance policy. The
Company has also established a Fraud Whistleblower Protection Policy to
support and protect any staffs who may have any concerns regarding any
aspect of company

business and who feel that action is necessary to serve and protect the
Company’s interests. The Company expects all senior management to be
honest and ethical and act as role models for all employees. All
stakeholders are treated with fairness and respect and in such a way
that adheres to good corporate governance principles. Employee authority
and responsibility are also clearly determined at each level;
additionally, the Risk Management Committee is appointed with defined
roles and responsibilities, including the continuous and systematic
assessment of risk management processes and procedures. The Company
communicates to employees at all levels to understand and define its
risk appetite level which can be linked to company strategy and
governance role to ensure that the Company has well-defined internal
control and risk management and good corporate governance, which can
effectively prevent or reduce any loss and damage that may occur.
Consequently, the Company will be able to achieve the defined objectives
efficiently and effectively.

The Company has the Information and IT Security Policy in order to
provide best protection for organization’s critical information security
and encourage every level of employee to participate in training possess
an awareness regarding information security, oversee to improve
operational procedure and standard. The Company also has Business
Continuity Management Policy through providing proper overseeing despite
beyond-normal controlled circumstances to prevent core business
processes from any interruption, including the Safety & Bio-Hygienic and
Work Environment Policy to able management of working environment and
safety achieve effectiveness and efficiency and conforming to
regulation. In addition, the Company has the Sustainable Development
Policy covering all aspects of economy, society and environment that
conformed to good corporate governance concept and international
standard.

In addition, The Company also recognizes the importance of each
stakeholder group which motivate the company to create Corporate Culture
program as a guideline for employee so that they can be cultivated and
behave in the way that reflect “AIS culture” called iHIP ( i=
Insightful: deeply understand and expect the needs to improve and
innovate satisfying services, H=Helpful: analyze foresee and display
determination in providing services to ensure that needs and problems
will be responded and successfully achieved, I=Innovation: strive to
offer continuous improvement regarding idea and creativity,
P=Professional: transparent, sincere and thoughtful regarding customer’s
benefits including to create trustworthy in our professionalism toward
stakeholders. These have led The Company to placed great emphasis on
employee resources, which is the most valuable asset by developing a
fair and clearly defined evaluation and remunerations standard,
Individual Development Plans and a wide range of training opportunities
while encouraging employees to meet business goals and international
standards of excellence.

2.  Objective Setting

The Company provides each department and employees with clearly written
stated objectives and goals, including strategies, operations,
reporting, and rules and regulations compliance. These objectives and
goals align with the overall Company’s mission at its risk appetite
level. Furthermore, the Company updates business plans, strategies, and
objectives, according to the current situation and changing risk
factors.

3.  Event Identification

The Company properly and systematically identifies events or risk
factors that may negatively influence the Company’s objectives both at
organization and operations level. In addition, the Company identifies
future events, which may have a positive impact on its objectives, by
considering both internal and external risks and the Company also
routinely monitors the results. In addition, the Company regularly
identifies and analyses the significant changes that may affect the
defined strategies and objectives to ensure that the Company has
identified risk factors that cover all significant changes (at each
operational level) and routinely reports to management and other
relevant parties.

4.  Risk Assessment

The Company deploys systematic risk assessment tools and methods. The
Company provides the risk management manual for best practice and sets
varying levels of appropriate risk assessment criteria. The Company also
assesses the quality and quantity of risk factors by considering the
Company’s risk appetite by applying two aspects of assessment: the
potential loss or damage in the event of risk

occurrence (impact) and the probability of risk occurrence (likelihood).
The Company uses both measures to determine risk levels as high, medium,
or low. Moreover, the Company assesses circumstances and possible
fraudulent incidents or any inappropriate conduct to ensure that the
Company has proper internal control system, risk management approach and
monitoring covering all aspects.

5.  Risk Response

The Company has in place a continuous and systematic risk management
process. The Company plans strategic responses to risk at the individual
and overall level by considering either avoiding, reducing, sharing, or
accepting the risk as appropriate to the Company’s interests. Equally,
the Company always considers the most cost efficient and most effective
methods to manage high risk, thereby reducing the overall likelihood and
impact of that particular risk. The Company also has an effective
internal control system, which is suitable for handling any changing
risks.

6.  Control Activity

The Company has a clearly stated policy and procedural process and also
define efficient key control activities covering core business process
as well as the critical information systems by focusing on preventive
control activities including regular evaluation and reporting. These
activities are to ensure that the defined control activities are
effective and meet objectives, as well as quality and timeliness. In
addition, the senior management periodically review the policies and
procedures, including control activities, in accordance with the current
situation and any changing risk to ensure they still meet the Company’s
objectives.

7.  Information and Communication

The Company has an information network system that connects across the
organization to support business decisions and initiatives. It also has
an effective information security system, including a contingency plan
to protect the information system when there are serious incidents that
may cause system failure. The Company has a practical contingency plan.
Furthermore, the Company deploys an audit trail system that can track
back and review historical data. The Company also maintains an
information system to analyse data and indicate any risk area, for which
comprehensive records and reports are available.

Moreover, the Company has an efficient and effective communication
channel network that enables internal communication throughout the
organization. Important information such as corporate governance,
business ethics, risk management policies, risk appetite, policies and
regulations, role and responsibilities, and segregation of duties,
including procedures and practices, can be effectively communicated
between management and employees. In addition, the data and information
are also classified according to their criticality and sensitivity as
well as assigned the proper access authority. The Company also provides
an efficient and timeliness communication channel for external
stakeholders.

8.  Monitoring

The Company tracks and monitors business performance by regularly
comparing with targets or key performance indicators (KPIs) defined at
each level and having an efficient monitoring performance system. As
managers are required to monitor staff members’ performance regularly,
operations-level staff has to report any deficiencies or inefficiency to
the supervisors closely and to senior management routinely to ensure
internal control systems are effective and responsive to risk factors in
an appropriate and timely manner including performance assessing
provided by The Internal Audit Office, external auditor and external
independent reviewer.

The Company has established a system to monitor risk management results
and an alert system to ensure that risk management is effectively
aligned with its risk appetite. The Company deploys a continuous

reporting system for each management level, including senior management.
The Company also holds regular meetings for the Board of Directors and
senior management to monitor business performance and assess whether
business objectives are being achieved.

In an ever changing business environment, risk management is essential
to support the Company goals. Accordingly, to prepare and build for the
future, it is important that the Company has a risk management policy
and mechanism in place to build strength and prepare for upcoming future
so that the Company can manage risks properly and sustain business
status.

The Company emphasizes the importance and value of risk management.
Therefore, the Company appoints the Chairman of the Executive Committee
as the Chairman of the Risk Management Committee, together with the
Chief Executive Officer and senior management as members of the
committee, totaling eleven members. In 2012, the Risk Management
Committee met four times to identify risks throughout the Company, rate
the risks, define the risk management concept, and assign
responsibilities to those in charge of managing and controlling the
risks to its risk appetite levels. This enabled the Company to
accomplish its goals and strategies and create confidence for all
shareholders and stakeholders. The Risk Management Committee
continuously revises any changes to any risk factors.

The Risk Management Committee follows up the accomplishment of risk
management by considering the management action plans and the reliable
measured results of the plans. At each meeting, the responsible
management reports the results of risk management approach which
identified in the previous meeting to the Risk Management Committee to
discuss whether risk level has been successfully mitigated, thus
resulting in effective risk management.

Every quarter, the Risk Management Committee submits risk management
report results to the Audit Committee, the Board of Directors and the
Executive Committee for closely monitoring to ensure that its risk
appetite is acceptable and the Company is able to accomplish its goals.
Please refer to the “Risk Factors” section, which summarizes the risk
factors affecting the Company’s operation and financials.

At the Board of Director’s Meeting No. 2/2013 on 30 January, 2013 the
Board of Directors and the Audit Committees has assessed the internal
control system and related processes during 2012 by reviewed the
effectiveness of internal control process and by questioned the
management. The result from the adequate evaluate found that the Company
has implemented an appropriate and effective Internal Control System.

In addition, KPMG Phoomchai Audit Limited, the Company’s external
auditor in 2012, evaluated the effectiveness of the Company’s internal
control system and concluded that there were no material deficiencies.

Internal Audit

The Internal Audit Office performs its duties independently and
objectively and reports functionally and directly to the Audit Committee
and administratively to the Chief Executive Officer. The Company
regularly updates the Internal Audit Charter (vision, mission, strategy,
scope, objectives, responsibilities, accountability and authority), and
also updates the Internal Audit Manual as its primary source of
reference. This ensures that the Internal Audit Office conforms to the
International Standards for the

Professional Practices of Internal Auditing (Standards) and delivers a
high standard of service with due professional care to support the
Company’s good corporate governance policy and practice, adding value to
both the Company’s stakeholders and the Company’s sustainable
development.

The Internal Audit Office evaluates and improves the effectiveness of
internal control, risk management and governance processes according to
annual audit plan. The Internal Audit Office creates an annual audit
plan, approved by the Audit Committee, after consideration of overall
objectives, strategies, mission, and the Risk Based Audit Approach,
including key control points and management opinions. The Internal Audit
Office also consults and advises on CSA, project development, and risk
management, etc. to ensure that company performance follows its
strategies and achieves its goal and objectives. Furthermore, the
Internal Audit Office regularly performs monitoring activities to ensure
the effective and continuous improvement of internal control, risk
management, and governance processes.

The Internal Audit Office supports continuous conduct of quality
assessment review, at least once for every five years. The Company
appointed an external independent assessor to review its structure,
resources, the efficiency and the effectiveness of internal audit
activities, conformance with the standards, code of ethics,
technologies, staff competencies, development plan and training of each
staff, roles and responsibilities to support the Company’s mission, etc.
The external assessor evaluated the

Internal Audit Office by comparing it with international standards, best
practices, and related benchmarking with other outstanding performance
companies.

In 2011, the external assessor rated the Internal Audit Office as
‘generally conforms’ in accordance with the International Standards for
the Professional Practice of the Internal Auditing (Standards), and has
also performed remarkably well in relation to qualitative benchmarking
against high performing internal audit functions internationally. The
Internal Auditors intend to maintain this remarkable performance.

In assessing the effectiveness of risk management, the Internal Audit
Office reviews events identification and risk factors, which affect the
Company’s objectives, and then reviews the risk management approach.
This is to ensure that risk identification and risk assessment are
accurate and appropriate, and that a systematic risk management approach
is implemented to manage at the Company’s risk appetite level, report in
a timely manner and monitor regularly.

In assessing the effectiveness of internal control, the Internal Audit
Office has developed an adequate evaluation questionnaire for each
internal control process, according to the COSO-ERM framework, which is
used to review the performance of each operation. The Internal Audit
Office also supports each department to perform regular Control
Self-Assessments in each procedure to ensure that the Company’s
objectives are achieved efficiently and effectively, rules and
regulations are strictly adhered to and that financial reports are
accurate and reliable.

In assessing the effectiveness of governance, the Internal Audit Office
performs regular corporate governance evaluations, according to
principles of good corporate governance set by the Organization for
Economic Co-Operation and Development (OECD) and the Stock Exchange of
Thailand (SET). This ensures that the Company provides the necessary
infrastructure and processes to support good corporate governance,
transparency, fairness for all and accomplishes its objectives by using
resources effectively to ensure the greatest benefit for all concerned
stakeholders.

In assessing external and internal fraud risk management, the Internal
Audit Office performs fraud risk assessments and provide channel for
receiving a fraud complaint and auditing upon the request (Whistle
Blowing) for events identification and then evaluates the possibility of
external and internal fraud. The Internal Audit Office also considers
the most effective measures to prevent and control risk to ensure that
the Company achieves its objectives.

In assessing Self-Control Approach of employees (CSA), the Internal
Audit Office provides a comprehensive self-assessment support service
for employees and departments by offering individual counseling,
group-training workshops and effective assessment tools. This encourages
employees to develop a well-controlled and effective operating system to
manage key risks effectively, and in a timely

manner. In addition, CSA validation is implemented for each business
unit to ensure that operation processes of each business units can
achieve its strategies and objectives and within the period specified.

In the project consultant role, the Internal Audit Office has involved
in the key projects development, which may affect significance of
revenue, support company strategy, regulatory risk or has a potential
fraudulent risk. Involvement by review the sufficiency of application
and process control for each particular selected projects as well as
provide the recommendation for considering before project launched.
Presently, the Internal Audit Office allocates 20% of resource for
consultation in company project development.

Furthermore, the Chief Audit Executive (CAE) acts as the secretary to
the Audit Committee to support the effective achievement of its
responsibilities and ensure accountability, as assigned by the Board of
Directors in the Audit Committee by holding a meeting every month.
Additionally, to provide professional advice such as business ethic,
risk management, information security and sustainable development in
order to provide valuable recommendation to organization.

The Internal Audit Office adheres to the International Professional
Practices Framework (IPPF), the International Standards for the
Professional Practice of Internal Auditing, COSO, ERM, Governance, Risk
and Compliance (GRC), AS/NZ 4360 (ISO 31000), and ISO 22301. In the
information systems, the Internal Audit Office also holds CobiT 5 IT
Governance framework, ISO 27001 and The IIA GTAG (Global Technology
Audit Guide) to ensure that the Company has well-defined internal
control, risk

management and corporate governance, including the Company's information
systems are effective protected to achieve the Company’s objectives. In
addition, all internal auditors perform their duties professionally,
independently, and objectively, according to the IIA Code of Ethics.

In addition, the Internal Audit Office maintains and seeks to improve
the quality of internal audit services to conform to the International
Standards for the Professional Practices of Internal Auditing with an
appropriate professional manner by joining seminar with leading domestic
companies quarterly and with international companies annually. This
includes encouraging internal audit staffs to develop their knowledge by
taking a studying abroad trip every year and inviting foreign expert to
train additional knowledge to the whole internal audit staffs. To
maintain and develop an excellent standard of service, every year, the
Internal Audit Office also performs quality self-assessment, every five
years, by a qualified independent reviewer. All Internal Audit Office
staffs participate in an annual Individual Development Plan to identify
and manage key competencies and career opportunities. Each staff is
therefore encouraged to study a range of professional programs to become
qualified at different levels. At present, there are seven Certified
Internal Auditors  (CIA), four Certified Information System Auditors
(CISA), one Certified Information Systems Security Professional (CISSP),
three Certified Public Accountants (CPA) and one Tax Auditor (TA) in the
Internal Audit Office. The rest of the staffs are studying CIA, CISA,
CCSA (The Certification in Control Self-Assessment), CRMA (Certification
in Risk Management Assurance), and CFE (Certified Fraud Examiners).