Risk Management

Importance

AOT prioritizes risk management as a matter of significant importance, implementing it through an integrated and concrete approach across the entire organization. This aligns with international best practices and enables the organization to achieve its defined vision, enhance business stability, and maximize value for all stakeholders.

Policy

AOT has established the Risk Management Policy, the Policy on the Integration of Corporate Governance, Risk Management, and Compliance, the Business Continuity Management Policy, and the Internal Control Policy to be observed by all relevant executives and employees. These policies are aligned with the AOT Corporate Plan for Fiscal Years 2023–2027 (2024 Revision), operational plans, project management frameworks, as well as applicable laws, regulations, and policies related to AOT’s implementation. In addition, AOT has developed a Risk Management Manual to serve as a comprehensive internal operational guideline.

Risk Management Policy

In 2024, AOT reviewed its Risk Management Policy with an emphasis on implementing integrated risk management across the organization. This approach aligns with principles of good corporate governance and AOT’s core values, while aiming to enhance the organization’s value and stability.

1. Risk management is designated as a shared responsibility across all levels of the organization.
2. AOT continuously develops its risk management system in accordance with international standards, such as COSO-ERM 2017, ISO 22301:2019 for business continuity management, and the Core Business Enablers under the State Enterprise Assessment Model (SE-AM).
3. AOT seeks to maintain a balance between risk and return within an acceptable risk appetite.
4. Strategic risks are continuously managed through the following process:
  
  • Comprehensive and timely identification of risks
  
  • Assessment of likelihood and impact
  
  • Risk mitigation to acceptable levels
  
  • Regular monitoring and reporting
5. Risk management is integrated with AOT’s “5 Jai” core values, fostering a risk-aware organizational culture.
6. Risk management and business continuity systems are continuously improved, supported by information technology for functions such as document approvals, the preparation of reports, and document storage.

Internal Control Policy

AOT is committed to developing an effective internal control system that is suitable for its business operations, with the aim of mitigating risks, promoting transparency, and enhancing operational efficiency. The approach follows the Committee of Sponsoring Organizations of the Treadway Commission (COSO 2013), which consists of Planning, Executing, Monitoring, and Control Self-Assessment (CSA). The Internal Control Policy assigns management the responsibility to ensure compliance with internal control requirements and to develop Standard Operating Procedures (SOPs). AOT also promotes training and knowledge-sharing for employees at all levels to raise awareness and understanding of internal control processes. Furthermore, AOT has established systems for internal control evaluation and reporting to ensure transparent and sustainable operations.

Business Continuity Management: BCM

AOT is committed to developing its Business Continuity Management (BCM) system in alignment with ISO 22301:2019 to enhance the organization’s capability in responding to unexpected events that may disrupt business operations. The objective is to ensure continuity during emergency situations and to build trust among all stakeholder groups. AOT continuously updates its Business Continuity Plan (BCP) and related processes, and communicates key information through internal systems and/or employee training. Regular BCP drills are conducted, and summary reports on business continuity management implementation are prepared annually.

ดูรายละเอียดเพิ่มเติม

นโยบายการบูรณาการการกำกับดูแลกิจการการบริหารความเสี่ยง และการกำกับดูแลการปฏิบัติงาน

Management Approach

AOT’s Risk Governance Structure

Role and Responsibilities

AOT’s risk governance structure is organized independently from business operations to ensure objectivity. It consists of the following key components:

Risk Management Committee (RMC) – Board Level Risk Oversight: Appointed by the AOT Board of Directors, the RMC includes with independent and non-executive board members, all of which are responsible for risk oversighting and setting risk management policies, approaches, frameworks, and acceptable risk levels. The committee also appoints working teams and/or employees (Operational Risk Management Functions) to support implementation as appropriate.
AOT Risk Management and Compliance Committee – Second Line
This committee comprises, Executive Vice Presidents, Airport General Managers, Corporate Secretary, Assistant Executive Vice Presidents, Office Directors under the President, Department Directors, and Deputy Directors of the Risk Management Department, all of which are responsible for setting control risk standards and overseeing risk compliance. At the policy level, the committee approves various operations plans related to risk management, internal control, and business continuity management. It monitors performance to ensure alignment with approved plans and supports human resource development through training programs that strengthen skills relevant to risk management. The committee also promotes the adoption of technology in risk management and provides support for related activities.
Operational Risk Ownership – First Line
This includes risk officers at the business line, office, and airport levels, led by heads of risk departments. They are responsible for identifying and assessing risks, developing appropriate risk management plans in alignment with AOT’s policy, and monitoring and reporting risk management and internal control performance to the AOT Risk Management and Compliance Committee.
Internal Audit Office (Independent Audit Unit – Third Line)
This unit operates independently. For internal audit functions, it reports directly to the Audit Committee. For general administrative purposes, it reports to the President. The Internal Audit Office is responsible for providing independent and objective assurance and consulting services to enhance value, improve operations, and support AOT in achieving its defined objectives. The unit adopts a structured and disciplined approach to evaluate the effectiveness of risk management, internal control, and corporate governance processes.
All risk-related operations are reported annually to the President and the Risk Management Committee.

Key Operational Responsibilities

Chief Operational Officer for Risk Management Implementation	MR.Danai Phuchada Director, Risk Management Department
Chief Operational Officer for Internal Audit	Mr. Thanya Seingcharoen Director, Internal Audit Office

AOT’s Risk Management Framework

AOT reviewed its Risk Management Manual for the fiscal year 2024 as a guideline for integrated risk management in alignment with The Committee of Sponsoring Organizations of the Treadway Commission – Enterprise Risk Management Integrating with Strategy and Performance (COSO-ERM 2017), and the Business Continuity Management framework in compliance with international standards under the International Organization for Standardization: ISO 22301:2019 (Societal Security and Resilience – Business Continuity Management System Requirements).

The framework also incorporates best practices based on the Ministry of Finance’s Criteria on Risk Management Standards and Guidelines for Government Agencies B.E. 2562, the Core Business Enablers under the State Enterprise Assessment Model (SE-AM), and guidelines from the Securities and Exchange Commission (SEC).

AOT integrates risk management processes into the development of its Corporate Plan and the implementation of critical projects, enabling the organization to effectively manage potential risks and disruptions that may impact its business operations in a timely and continuous manner. This approach supports AOT in achieving its defined objectives and targets.

Integrated Risk Management Based on COSO-ERM 2017
The integrated risk management framework under COSO-ERM 2017 comprises five components and twenty principles, as follows:

Governance and Culture
Strategy and Objective-Setting
Performance
Review and Revision
Information, Communication, and Reporting

AOT’s Risk Management Processes

AOT has established a structured Risk Management Process to identify and analyze potential events, changes, or uncertainties—both internal and external—that may affect the organization’s operations. This process is conducted regularly twice a year as part of the Risk Exposure Review: once prior to the start of the fiscal year, and once as a mid-year review. Additional reviews are conducted immediately when significant changes that may impact AOT occur.

Toggle List

1. Analysis of Potential Changes and Their Impact on AOT’s Operations (Uncertainty) (Uncertainty) +

AOT conducts analysis on eight key areas of change, along with other relevant factors, including long-term risk issues (over three years). These insights serve as inputs in the development of the Risk Management Plan to minimize the likelihood and impact of risk events. The results from this analysis are also used as inputs for reviewing AOT’s Corporate Plan, enabling the organization to respond effectively to long-term changes. This process plays a critical role in supporting AOT’s future growth and risk management strategies.

2. Establishment and Review of Key Risk Indicators (KRIs) +

AOT establishes and reviews Key Risk Indicators (KRIs) twice annually on a continual basis to identify and monitor key risks that may affect the organization. These KRIs are designed to align with AOT’s strategic objectives and function as tools for risk tracking and early warning signals in cases of potential future risks. KRIs are categorized into two groups:
- Operational KRIs, which cover AOT’s core operations
- Management KRIs, which are linked to internal management processes.
Each KRI is assessed using a three-tier indicator system, and the results are presented on a KRIs Dashboard for analysis and decision-making in improving risk management processes. The establishment of KRIs enables AOT to effectively monitor and manage risks in alignment with its strategic goals.

color	KRIs	Action
Green	KRI results meet the target	Normal monitoring (Watch)
Yellow	KRI results show signs of deviation from target	Review and improve existing measures
Red	KRI results exceed the defined target threshold	Develop additional risk response plans and report to AOT Risk Management and Compliance Committee for policy-level

3. Risk Management Planning+

3.1 Risk Universe Analysis +

In the risk assessment phase of risk management operations, AOT has developed a comprehensive Risk Universe as a database of potential risk factors. This analysis is based on 13 identified sources, aligned with the updated 2023 assessment criteria for Core Business Enablers under the State Enterprise Assessment Model (SE-AM), specifically Dimension 3: Risk Management and Internal Control (RM & IC). The 13 sources are as follows:

1. AOT’s enterprise-level risk factors from the previous fiscal year with unsatisfactory risk management results
2. Organizational environment analysis (SWOT Analysis)
3. Strategic Objective (SO) indicators and targets
4. Strategic Challenges (SC)
5. Indicators under the AOT Corporate Plan
6. Value Driver
7. Indicators and targets under the draft Performance Agreement (PA) between AOT and the State Enterprise Policy Office (SEPO) for FY2024, and the actual/forecasted results from FY2023 PA that did not meet performance targets
8. Policies set by the Board of Directors (Board Policy)
9. Action Plans, Work Plans, and Public-Private Partnership (PPP) projects
10. Results from Uncertainty Analysis regarding emerging risks affecting AOT operations
11. Intelligence Risk Assessment for business opportunity identification
12. Stakeholder Management
13. Results of the organization-wide Control Self-Assessment (CSA)

Criteria for Risk Universe Assessment and Analysis
Risk Universe with a 1–2-Year Time Horizon:	Risk factors that AOT may face within the next 1–2 years are considered as key inputs for the development of the annual Risk Management Plan. These are assessed alongside the Effectiveness Evaluation Criteria of Control Measures. Control effectiveness is deemed "insufficient" if the evaluation result scores below level 3 in any assessed dimension. If a risk issue is evaluated as "sufficient", it will be monitored by the relevant department. In contrast, risk issues evaluated as "insufficient" will be included as inputs in the development of AOT’s Risk Management Plan.
Risk Universe with a Time Horizon of Over 3 Years:	The Risk Management Department will analyze and categorize these risk issues as potential Uncertainty that could impact AOT’s operations. These issues will be submitted to the Corporate Planning Department as key inputs for the review of AOT’s Corporate Plan.

Criteria for Risk Universe Assessment and Analysis

Risk Universe with a 1–2-Year Time Horizon:

Risk factors that AOT may face within the next 1–2 years are considered as key inputs for the development of the annual Risk Management Plan. These are assessed alongside the Effectiveness Evaluation Criteria of Control Measures. Control effectiveness is deemed "insufficient" if the evaluation result scores below level 3 in any assessed dimension. If a risk issue is evaluated as "sufficient", it will be monitored by the relevant department. In contrast, risk issues evaluated as "insufficient" will be included as inputs in the development of AOT’s Risk Management Plan.

Risk Universe with a Time Horizon of Over 3 Years:

The Risk Management Department will analyze and categorize these risk issues as potential Uncertainty that could impact AOT’s operations. These issues will be submitted to the Corporate Planning Department as key inputs for the review of AOT’s Corporate Plan.

Strategic Risk Refers to the risk of financial loss or loss of competitive capability resulting from inappropriate strategic decision-making processes.
Operational RiskRefers to the risk that may affect the organization’s operations due to failures arising from personnel, systems, or internal processes.
Financial RiskRefers to the risk arising from volatility in financial variables such as exchange rates, interest rates, liquidity, and commodity prices, which can lead to financial losses.
Compliance Risk)Refers to the risk arising from violations or failures to comply with established policies, procedures, or controls intended to align with relevant regulations, contractual obligations, and applicable laws governing the organization’s operations.
Human Capital RiskRefers to the gap between the organization's goals and employees' capabilities, which may hinder the achievement of targets. This may stem from either intentional or unintentional employee actions, such as underperformance or lack of required competencies.
Safety Risk Refers to the risk resulting from unintentional human actions or process failures that may cause harm to individuals or damage to property.
Security RiskRefers to unlawful or intentional acts of interference that may result in harm to individuals, damage to property, prolonged service disruptions, or reputational damage.
Hazard and Environmental RiskRefers to the risk arising from natural or man-made hazards, such as floods, pandemics, or acts of terrorism, which may affect business operations.
Fraud RiskRefers to the risk of deliberate actions undertaken to obtain unlawful benefits for oneself or others (e.g., family members), typically involving deception or abuse of power.
IT RiskRefers to the risk arising from events that may cause damage to AOT’s IT assets or information, such as data corruption from malware, failure of core server systems, or unauthorized access to sensitive information.
Reputation RiskRefers to the risk arising from events that may negatively affect AOT’s image, leading to public criticism and potential reputational damage.
Emerging RiskRefers to the risk of potential future loss arising from factors not currently manifested but which may occur due to changing circumstances. These risks often emerge slowly, are difficult to identify, and occur infrequently—but when they do, the impact is often severe. Emerging risks are typically identified through forecasting based on existing evidence and are often associated with political, legal, social, technological, physical environmental, or natural changes. In some cases, the impact of such risks cannot yet be determined. Examples include risks associated with nanotechnology, climate change, and emerging infectious diseases.

Note: Risks identified from both internal and external environmental analysis can support value creation for the organization. This refers to risk management that helps minimize the “loss of business opportunities,” enabling the organization to transform crises or adverse events into opportunities that enhance competitive advantage. Business opportunities are identified through the organization’s SWOT analysis and further assessed to identify associated risk factors. These factors are then integrated into the risk management process to reduce the overall risk level.

2. Identification of Corporate Risk Factors (Identifies Risk)+
Corporate risk factors are selected based on short-term risk issues (within 1–2 years) extracted from the Risk Universe, particularly those assessed as having “insufficient” effectiveness of control measures. These risk issues are compiled and analyzed to identify AOT’s corporate risk factors, taking into consideration:

3. Strategy and Objectives Setting in Risk Management +

To ensure effective organizational risk management, AOT initiates its risk management efforts with the clear articulation of goals and objectives, which serve as the foundation for risk management implementation. This approach supports the achievement of risk management targets in a rational and structured manner. The objectives are defined across several levels:
- Corporate level: including Vision and Mission, leading to overall corporate objectives
- Departmental level: objectives or targets set for each division and department
- Process and project level: objectives defined for specific operational processes or projects

AOT defines risk management targets through two levels of risk thresholds:
-Risk Appetite (RA): the level of risk the organization is willing to accept in pursuit of its objectives
- Risk Tolerance (RT): the acceptable level of deviation from the defined risk appetite

In general, achieving organizational objectives and expected returns may require the acceptance of certain levels of risk. By setting a risk appetite, AOT can determine what types of risk, in what form, and at what magnitude the organization is prepared to accept in order to accomplish its goals.

Risk Appetite: RA

Risk Appetite refers to the overall level of risk (Board-Based Amount) that the organization is willing to accept in pursuing its vision and mission. It may be defined as a single target value or a range, and should align with the organization’s strategic goals. The determination of the risk appetite is typically the responsibility of senior management, under the oversight of the organization’s executive board.

Risk Tolerance: RT

Risk Tolerance must be defined in alignment with the organization’s Risk Appetite. It may be specified in financial projections or in the organization’s annual Performance Agreement (PA). In cases where no such specification exists, the tolerance level should be determined and approved by senior management and the organization’s executive board.

4. Root Cause Analysis : RCA+
In addition to setting strategic objectives and targets for risk management, AOT conducts root cause analysis to identify the sources of risk, categorized into internal factors and external uncertainties. The analysis is performed by designated Risk Owners through the following methods: นี้
1. • Operational Staff Identification: Risk causes are identified by operational staff, who possess the relevant knowledge and understanding of the work processes and are best positioned to recognize risk events and their sources.
2. • Interviews or Risk Perception Surveys: Since staff may not always be aware of their own risk sources, collecting perspectives from others through interviews and questionnaires can help reveal more comprehensive causes. Data collected from such methods can serve as a basis for discussions during risk workshops.
3. • Process Flow Analysis: Understanding current operations and best practices helps identify potential risk causes. This is often done using process maps, process descriptions, or both.
4. • Workshops: Workshops are a widely used method for risk cause identification and should be facilitated by experienced coordinators to ensure that objectives are met within the given process and timeframe. It is essential to select participants with relevant knowledge and engagement in the process or issue being discussed.
5. Existing Control and Mitigation Plan+

Mitigation Plan AOT’s enterprise risk management includes the development of plans or measures to control and mitigate risks to an acceptable level, as defined by the organization’s strategic objectives and targets. These actions are implemented by the respective departments and units. Concurrently, an assessment of the adequacy of existing controls is conducted for each identified risk cause. The assessment is based on three dimensions:
- Performance against objectives
- Control processes
- Monitoring mechanisms
If any of these dimensions receive a rating below Level 3, indicating inadequacy, the risk will require the development of a Mitigation Plan to ensure that the risk is controlled within the acceptable level
6. Risk Assessment+

AOT conducts risk assessment by prioritizing identified risks through the evaluation of their likelihood of occurrence and potential impact. This process is visualized using a Risk Matrix, which helps identify risks with a high probability of occurring and significantly affecting AOT’s operations. Risk prioritization may be based on historical statistical data or future forecasts, and the assessment criteria are set accordingly. These criteria are aligned with factors such as:
- Organizational objectives
- Applicable laws and regulations
- Key performance indicators (KPIs)
- Actual performance outcomes
- Critical factors impacting operations
The outcome of the risk assessment supports AOT in preparing appropriate control measures or risk mitigation strategies to minimize potential adverse effects to an acceptable level.
7. Risk Response+

For risk factors with current control measures assessed as “inadequate,” a Mitigation Plan must be developed. This plan refers to new actions that must be initiated by the responsible units to bring the risk level within an acceptable range. However, the organization must evaluate the cost-effectiveness of the selected risk response measures, considering whether they are worthwhile relative to the acceptable risk level. The Risk Owner is required to conduct a Cost and Benefit Analysis (CBA)—both in monetary and non-monetary terms—to ensure the effectiveness of the risk management approach. The organization may choose one or more types of risk responses in combination, with the objective of reducing the likelihood and/or impact of the risk event to an acceptable level.
8. Risk Correlation Map+

The Risk Correlation Map is a visual representation of the relationships among risk factors and their impacts—both quantitative and qualitative—on the organization’s strategic objectives. This tool enhances the effectiveness of risk management planning by ensuring that all relevant risk factors are comprehensively addressed. Once risk factors and their root causes have been identified, assessed, and response strategies have been analyzed, the Risk Management Department conducts a comprehensive review of all identified risk factors and develops a Risk Correlation Map. This map includes each risk factor, its underlying causes, and assigned weightings. It serves as the basis for evaluating and analyzing the interrelationships among all risks, illustrating the potential impacts and severity levels of each risk cause.
9. Monitoring and Reporting of Risk Management Performance (Reporting)+

AOT Risk Management Performance Reporting Plan for Fiscal Year 2024

Airports of Thailand Public Company Limited (AOT) has established a structured risk management performance reporting plan for Fiscal Year 2024, which encompasses the monitoring of risk levels, the implementation results of existing control measures, and the development of additional risk management plans. This ensures that the risk management process remains effective and appropriate, with the flexibility to adapt should the additional measures prove insufficient.
Risk Owners are responsible for reporting the outcomes of organizational and airport-level risk management activities. This includes progress updates on existing control measures, newly proposed risk mitigation plans (if any), and a quarterly assessment of risk severity based on likelihood and impact. In cases of significant change, immediate reporting is also required via the “AOT Risk Management Performance Report Form (Form RM-2).”
Risk Agents and secretaries of the Risk Management Working Committee (RMWC) at the line, department, and airport levels are tasked with compiling and analyzing the results. These are then submitted to their respective RMWCs for review and endorsement before being forwarded to AOT’s Corporate RMWC and the AOT Risk Management Committee (RMC) for acknowledgement.
To facilitate this process, the Risk Management Division has formulated an operational plan for FY 2024 and communicated it to Risk Owners and personnel responsible for risk management, internal control, and business continuity (Risk Agents) during a dedicated briefing session held on 11 October 2023. This session was conducted to ensure all parties understand and follow the specified timeline and reporting procedures to support AOT’s integrated risk management framework.

ตัวอย่างการรายงานผลการดำเนินงานด้านความเสี่ยงให้แก่คณะกรรมการ 2567

AOT’s Business Continuity Management System (BCMS) is aligned with the international standard ISO 22301:2019 (Security and Resilience – Business Continuity Management Systems – Requirements), ensuring the organization’s capacity to manage risks and potential disruptions in a timely manner and maintain uninterrupted operations. This alignment supports AOT’s ability to achieve its defined objectives and targets.

AOT has established a Business Continuity Management (BCM) process that is integrated with the organization’s goals and strategies. A written Business Continuity Plan (BCP) is prepared and approved by the Business Continuity Management Committees at the Head Office and six airports. The plan is implemented with the participation of AOT executives, employees, and relevant external parties.

This process has been developed to address the nature of AOT’s operations, transaction volume, information technology systems, and potential risks across the company (Head Office and six airports), including scenarios that could disrupt operations. The plans and procedures are designed to be comprehensive and systematic to ensure business resilience. Covered incidents include:

Aircraft accidents within the airport area
Power system failures
Runway/Taxiway damage rendering them inoperable
Natural disasters
Unlawful interference or terrorism
Fire or explosion in buildings and facilities
Information and communication technology (ICT) failures

Dangerous communicable diseases or pandemics
Baggage handling system failures
Air traffic control tower inoperability
Automated People Mover (APM) system failures
Ground service providers unable to operate (including ground handling, cargo services, and aircraft fuel services)

AOT’s Business Continuity Management

The Business Continuity Management (BCM) process at AOT is structured into the following maturity levels:

Level 1:

The organization has established a BCM process aligned with its strategic goals and objectives. A written Business Continuity Plan (BCP) is developed and approved by the organization’s board. A dedicated committee or responsible unit is appointed to oversee the development and implementation of the plan. Executives and relevant personnel are actively involved in formulating and executing the BCP.

Level 2:

The BCM process is further enhanced to consider the nature of the business, IT complexity, transaction volume, and related risk events. The plan comprehensively addresses potential scenarios that could affect business continuity. The procedures are systematically designed to minimize potential impacts and enhance operational resilience.

Level 3:

The BCM process is implemented in practice, with up-to-date information and full dissemination to responsible parties, employees, suppliers, partners, customers, and other stakeholders. Stakeholder awareness is assessed to ensure all parties understand and are prepared to execute the BCP effectively.

Level 4:

The BCM process is integrated with the organization’s digital transformation roadmap. Key Performance Indicators (KPIs) are defined to measure, monitor, and evaluate the effectiveness of the BCM implementation. The results are utilized to review and improve the BCP, as well as to formulate a long-term digital action plan that supports organizational sustainability and adaptability to future change.

Internal and External Audits

AOT conducts both internal and external audits—including continuous renewal of external certifications—to ensure that its risk management system serves as a key mechanism supporting the successful achievement of the organization’s mission and business objectives. The Company places strong emphasis on the performance and operational effectiveness of the system, ensuring alignment with international standards.

Implementation

In 2024, AOT carried out enterprise risk management by assessing and prioritizing risk issues identified by risk owners in order to develop appropriate plans and control measures. The following is an example of the risk assessment and prioritization process:

Risk Factor	Risk Level			Mitigation Actions
Risk Factor	Before Mitigation	Target	After Mitigation	Mitigation Actions
Regulatory Compliance (RF1) AOT may be unable to integrate collaboration in managing emergency situations and towing disabled aircraft.	Very High	Medium	Low	Conduct simulation exercises for towing disabled aircraft Assess and report operational performance to the AOT Board of Directors Sign memorandums of understanding with airlines regarding cooperation in towing disabled aircraft
Strategic Risk (RF2) Risk associated with AOT’s capacity expansion projects	Very High	Medium	Medium	Develop risk management plans and additional control measures through the workshop on "Guidelines for Enterprise Risk Management and Action Plan Development for Fiscal Year 2025"
Strategic Risk (RF3) AOT may not be adequately prepared to restore the operational capacity of apron services and ground support equipment at Suvarnabhumi Airport (BKK)	High	Medium	Medium	Review and revise the procurement plan for apron services and ground support equipment operators Manage contracts and supervise operators to ensure alignment with evolving operating environments
Financial Risk (RF4) Risk arising from the inability to manage investment plans in alignment with established targets	High	Medium	Low	Develop risk management plans and additional control measures through the workshop on "Guidelines for Enterprise Risk Management and Action Plan Development for Fiscal Year 2025"
Strategic Risk (RF5) AOT’s performance indicators for fiscal year 2024 may not meet the established targets	High	Medium	Medium	Revise performance indicators to enhance their appropriateness for fiscal year 2025

Emerging Risks

Emerging risks present new challenges stemming from various changes and are considered significant threats to airport business operations. These risks may have a material impact on both the airport business and society, depending on each specific issue. Such risks encompass factors related to environmental, social, and governance (ESG) dimensions, including climate change, resource scarcity, regulatory shifts, and technological disruptions.

The management of emerging risks requires a proactive strategy to ensure organizational resilience, minimize potential negative impacts, and capitalize on opportunities for sustainable growth. Identifying and addressing these risks will enable the organization to better align with global sustainability goals and preserve long-term business value.

Misinformation and Disinformation	Extreme Weather
Description
Misinformation and disinformation arising from the transformative shift in digital technology pose a significant long-term risk to airport operations, which serve as a major public service such as widespread passenger confusion and travel disruptions, reputational damage, eroding public trust, and potential safety and security breaches, and operational challenges. At the same time, as these technologies continue to evolve and integrate, the rapid advancement of digital tools and the proliferation of the Internet of Things (IoT) introduce new cyber threats. Stemming from the ease of accessing and sharing information — often without specialized skills — these threats can enable the unintentional spread of misinformation and disinformation, or even the deliberate manipulation of data. AOT seeks to establish preventive measures through its business continuity plan to ensure airports can operate normally and to address the impacts of these risks.	Climate change is increasingly intensifying and may lead to more frequent and severe extreme weather events. These physical risks include: (1) heavy rainfall causing severe flooding, (2) prolonged and more intense heatwaves, (3) extended periods of drought, and (4) increased occurrence of wildfires. These risks are expected to escalate due to rising greenhouse gas emissions, which accelerate climate-related physical threats and could result in greater damage to AOT operations.
Business Impact
Passenger confusion and misinformation can cause delays, bottlenecks, and reduced efficiency, disrupting daily airport operations and flight schedules. Information-related risks may undermine stakeholder confidence – from passengers to investors – potentially decreasing revenue and harming long-term business performance. The spread of disinformation and cyber threats can tarnish AOT’s public image, weakening relationships with airlines, customers, and partners. Addressing misinformation and mitigating cyber incidents often requires significant investments in new technologies, processes, and expertise. Cyber-attacks or manipulated data could impact critical systems, jeopardizing the safety of passengers, staff, and airport assets. Ongoing service disruptions and declining service quality may make AOT less competitive, risking a loss of customers and business to other airports.	Physical risks arising from climate change can impact airport operations depending on the type, likelihood, and severity of the risks. These can affect AOT in several dimensions—for example, business disruptions caused by storms, heavy rainfall, and flooding. There is also an increase in operating expenses due to higher energy consumption in passenger terminals driven by elevated external temperatures. Such risks and impacts could also affect the valuation of AOT’s assets, which must be disclosed in the annual financial report, particularly in cases where asset values decline (stranded assets) as a result of direct physical impacts of climate change on aviation infrastructure that supports both passenger and cargo transportation domestically and internationally.
Mitigation Actions (Mitigation Actions)
Implement a Cybersecurity Incident Response Plan: Develop a robust plan with clear detection and response protocols to identify, contain, and mitigate cyber threats and data manipulation attempts before they impact airport operations. Increase employee and public awareness: Conduct regular training sessions for airport staff and launch communication campaigns for passengers and the public to raise awareness of misinformation and disinformation risks, promoting responsible information-sharing behaviors. Monitor and counter misinformation in real time: Continuously track misinformation trends across digital and social channels, using data analytics tools to detect emerging threats and rapidly deploy countermeasures to prevent widespread misinformation. Strengthen policies and regulatory frameworks: Enforce and advocate for strong policies, codes of conduct, and legal requirements that hold platforms, media channels, and individuals accountable for spreading false or misleading information.	Analyze physical risks that are likely to occur and impact AOT’s airport operations to develop plans or preparedness measures for dealing with such risks. Design infrastructure that considers the ability to withstand physical risks that could impact operations. Continuously monitor and assess operations related to physical risk management arising from climate change to ensure effective implementation. Expand training programs or courses to enhance employees’ understanding of various physical risks in order to better respond to potential impacts.

Promotion of Risk Culture

AOT promotes a positive risk culture by fostering an environment that supports effective risk management to all non-executive directors. Regular meetings of the AOT Risk Management Working Group and the Enterprise Risk Management Committee are held on a monthly basis. These meetings serve as platforms for regularly reviewing the company’s risk exposure, discussing emerging risk situations, enhancing collective understanding of risk interdependencies and impacts prior to decision-making, and raising organizational risk awareness. Examples of AOT’s risk culture promotion initiatives include: AOT e-Learning Platform for risk management knowledge and awareness. Cross–departmental meetings involving Airport Standards and Aviation units. Risk awareness surveys to assess and strengthen employee understanding of risk–related issues

1. Risk Management Education

AOT conducts an annual survey to assess employees’ awareness of risk management. The objective is to evaluate the effectiveness of risk communication through both internal and external media channels, and to utilize the survey findings to enhance the efficiency of communication methods for promoting risk awareness across the organization.

In addition, AOT integrates risk criteria into service development initiatives (Incorporation of Risk Criteria in AOT Services) and establishes risk management metrics for relevant departments. These metrics are directly linked to financial incentives and performance evaluations.

AOT has implemented the “Triple A” Risk Management Program, a collaborative initiative between the Risk Management Department and the Human Resources Department. The program aims to promote desired risk management behaviors among executives and employees, thereby strengthening the organization’s risk culture. The Triple A Program is an outcome of the Risk Awareness Survey and the Risk Management Performance Evaluation, reflecting AOT’s commitment to fostering a resilient and proactive risk management environment.

2. Risk-Focused Training

Based on AOT Risk Management Handbook, AOT organizes training programs and activities designed to enhance the skills and expertise of participants in risk management and in implementing prescribed practices. These initiatives aim to strengthen the preparedness of all six airports for international standard assessments, while also promoting a deeper understanding and heightened risk awareness among personnel at all organizational levels.

Risk Management Training Course	Participants
Risk Culture Development Seminar for Practitioners in Risk Management, Internal Control, and Business Continuity at Airports (Risk Agent Program)	Members of the Board of Directors Senior Executives, personnel responsible for Airport Risk Management, Internal Control Business Continuity (Risk Agents), as well as staff from the Risk Management Department
Junior Airport Management Intermediate Airport Management Senior Airport Management	AOT Employee
The Internal Auditor Team Leader Development Workshop on Business Continuity Management System (BCMS) According to ISO 22301:2019 Standard – Fiscal Year 2024. AOT organized the internal auditor team leader development workshop under the course “Development of Internal Auditor Team Leaders on Business Continuity Management System (BCMS) According to ISO 22301:2019 Standard” for the fiscal year 2024. The objective was to develop qualified internal auditor team leaders who meet the ISO 22301:2019 requirements and are eligible for international certification from institutions such as the Chartered Quality Institute (CQI) and the International Register of Certificated Auditors (IRCA).	Risk Agents from AOT headquarters and all six airports
Business Continuity Management System (BCMS) training in accordance with the international ISO 22301:2019 standard for the fiscal year 2024 includes key workshop training programs as follows: Evaluation and enhancement of Business Impact Analysis (BIA) and Risk Assessment results Development of internal audit personnel for the Business Continuity Management System	Internal auditors and BCMS employees of AOT headquarters and all six airports.
Workshop training program on “Internal Audit of Business Continuity Management System (BCMS) in accordance with the international ISO 22301:2019 standard,” focusing on personnel readiness and systematic process management. The training also aims to prepare internal BCMS auditors to operate effectively according to the standard. The program includes two sub-courses: Development of Internal Auditors for the Business Continuity Management System (BCMS) based on ISO 22301:2019 Internal Audit of the Business Continuity Management System (BCMS) based on ISO 22301:2019	Internal auditors and BCMS employees of AOT headquarters and all six airports .

3. Risk Management Performance Evaluation

AOT undergoes performance evaluation in risk management in accordance with the State Enterprise Assessment Model (SE-AM). This assessment supports the ongoing development and enhancement of AOT’s risk management operations. The results serve as key indicators for identifying both strengths and areas for improvement across five key dimensions:

1. Governance and Organizational Culture
2. Information, Communication, and Reporting
3. Risk Management Review
4. Risk Management Processes
5. Strategic Planning and Objective Setting