RISK MANAGEMENT
POLICY & FRAMEWORK
A structured approach to identifying, assessing, managing and monitoring risks across our business operations and workforce services.
Effective 1 January 2026 | Version 1.0
RISK MANAGEMENT
1. PURPOSE
This Policy & Framework defines how Magma Tech Solution Co., Ltd. identifies, assesses, manages, monitors and escalates risks associated with its business operations and the provision of IT personnel, contractors, secondment, staff augmentation and related workforce services to clients.
The framework is designed to support reliable resource delivery, appropriate handling of information, compliance with applicable obligations, sound administration and timely resolution of service issues.
2. Scope
This framework applies to Management and relevant personnel involved in:
IT recruitment, candidate sourcing, screening and submission.
IT outsourcing, secondment, staff augmentation and consultant deployment.
Consultant onboarding, assignment administration, performance coordination, replacement and offboarding.
Payroll, invoicing and statutory administration where these services are provided.
Handling of client information, personal data, credentials, devices and system access where relevant to an assignment.
Engagement with subcontractors or other third parties where used.
Applicable laws, client contracts, statements of work and client security or operational requirements must be followed. Where requirements differ, the stricter applicable requirement should be escalated for review.
3. RISK MANAGEMENT PRINCIPLES
Proportionate
Focus on risks relevant to the company’s services, scale and client obligations.
Preventive
Identify foreseeable issues early and take reasonable steps to reduce likelihood or impact.
Accountable
Assign an owner to each material risk and mitigation action.
Documented
Maintain appropriate records of risk reviews, decisions, incidents and corrective actions.
Responsive
Escalate significant risks promptly and communicate with the client when required.
Confidential
Protect personal, commercial and client information throughout risk management activities.
4. ROLES AND RESPONSIBILITIES
| Role | Responsibilities |
|---|---|
| Management | Approves and oversees this framework; reviews high and critical risks. |
| Account / Client Coordinator | Monitors service delivery, client feedback and deployment timelines. |
| HR / Recruitment | Manages candidate quality, resource availability and onboarding. |
| Payroll / Finance | Monitors payroll, invoicing and payment approvals. |
| IT / Security Contact | Coordinates access, devices and information security. |
| Employees / Consultants | Follow requirements, protect information and report concerns promptly. |
5. RISK IDENTIFICATION, ASSESSMENT AND TREATMENT
Risks are identified through recruitment and deployment planning, client feedback, contract reviews, consultant performance discussions, payroll checks, compliance tracking, security events, complaints, incidents and changes to service or regulatory requirements. Each material risk is assessed for likelihood and impact, assigned an owner and treated with proportionate actions.
Supplier and subcontractor risks include inadequate capability, service interruption, conflicts of interest, confidentiality failures, unauthorized access to information and non-compliance with applicable legal or contractual requirements. Screening and monitoring should be proportionate to the supplier’s role, the criticality of the service and the information or systems to which access is provided.
5.1 LIKELIHOOD AND IMPACT SCALE
| Score | Rating Guide |
|---|---|
| 1 | Rare / Minimal |
| 2 | Unlikely / Minor |
| 3 | Possible / Moderate |
| 4 | Likely / Major |
| 5 | Almost Certain / Severe |
Risk Score = Likelihood × Impact. The score supports prioritization; management also considers legal obligations, contract deadlines, client impact, information sensitivity and other relevant circumstances.
Low
1 – 4
Monitor through routine activities.
Medium
5 – 9
Assign mitigation actions and review progress.
High
10 – 16
Prioritize mitigation and management oversight.
Critical
17 – 25
Escalate promptly to Management and take immediate proportionate action.
6. Key Risk Areas and Controls
Resource availability and delayed deployment
Plan sourcing early, monitor required start dates, maintain candidate pipelines where practical and communicate foreseeable delays to the client.
Candidate suitability and skills mismatch
Validate CV details and role-relevant skills; conduct appropriate interviews or checks; retain relevant submission and approval records.
Consultant resignation or unavailability
Use the replacement and escalation process; assess service impact and coordinate next steps with the client in line with contractual arrangements.
Performance and client dissatisfaction
Review client feedback, document concerns, agree improvement actions and escalate unresolved issues.
Contractual and regulatory compliance
Maintain relevant agreements and assignment records; monitor applicable obligations and seek qualified advice where needed.
Visa and work permit matters, where applicable
Track relevant expiry dates and renewal actions; ensure required authorization is in place before deployment.
Payroll, invoicing and payment processing
Use processing calendars, validate inputs, confirm approvals, reconcile amounts and escalate foreseeable delays.
Personal data and confidentiality
Limit access to authorized personnel, use appropriate transfer channels, share only necessary information and follow applicable privacy requirements.
Client systems and information security
Follow client access, acceptable-use and device requirements; remove access at assignment end; report suspected incidents promptly.
Business continuity and key-person dependency
Maintain backup contacts and handover information; identify critical activities and reasonable alternative arrangements.
Fraud, bribery, conflicts and misconduct
Follow the Code of Conduct, raise concerns through appropriate channels and take proportionate corrective action.
Third-party dependency, where applicable
Clarify responsibilities, protect information shared with providers and monitor material service issues.
7. Incident Reporting and Escalation
Personnel report suspected security or privacy incidents, misconduct, payroll issues, compliance concerns and material service disruptions promptly to their designated Magma Tech Solution Co., Ltd. contact.
The receiving contact records known facts, immediate actions, potential impact, owner and next steps, while limiting access to sensitive information.
Management determines whether the client, affected individuals, authorities or other parties must be notified under applicable law or contract.
Where a client’s systems, information or service delivery are affected, the appropriate client representative or designated contact shall be notified in accordance with the applicable contract, agreed procedures and client incident-reporting requirements.
Corrective actions are tracked to completion, and relevant lessons are incorporated into controls or awareness activities.
For significant cybersecurity or personal-data incidents, response arrangements should include prompt escalation to Management and the designated IT or service contact, reasonable containment, preservation of relevant evidence, assessment of impact and notification to clients, affected individuals or authorities where required by applicable law or contract.
8. Monitoring and Review
7.1 Business Continuity and Operational Resilience
Management will maintain proportionate arrangements to support critical activities during disruption. These may include backup management and client contacts, access to essential company and client records, alternative payroll processing arrangements, backup personnel for key responsibilities and a process to identify replacement consultants where feasible. Material disruptions must be escalated promptly and affected clients informed in accordance with contractual obligations.
The Risk Register is reviewed at least quarterly and when a significant incident, service change, client requirement or material risk arises.
High and Critical risks are reviewed more frequently until actions are completed or residual risk is accepted by authorized Management.
Risk owners update action status and retain appropriate evidence of completion.
Management reviews material risks, overdue actions, recurring incidents and lessons learned.
This Policy is reviewed at least annually, or earlier when services, applicable requirements or client obligations change materially.
9. Risk Acceptance and Corrective Action
Risk treatment may include avoiding, reducing, transferring or accepting a risk. Only authorized Management may accept a material residual risk. A risk that would breach applicable law, required authorization or binding client requirements must not be accepted merely for convenience. Corrective actions should have an owner, target date and completion evidence where appropriate.
10. Records and Document Control
Maintain the Risk Register, material incident records, review decisions and corrective-action records in an access-controlled company location.
Retain records for the period required by applicable law, contract and company procedures.
Share records with clients or other relevant parties only when necessary, duly authorized and consistent with applicable confidentiality, contractual and data-protection obligations.
Management oversees this Policy and approves material changes.
POLICY APPROVAL & DOCUMENT INFORMATION
Document Owner: Magma Tech Solution Co., Ltd. – Management
Version 1.0 | Effective 1 January 2026 | Review at least annually
Approved by: Tapati Bhattacharya – Managing Director
MANAGEMENT APPROVAL
Approved and effective from 1 January 2026.
Internal policy; not an ISO certification or independent audit.
Ready to Build Your Development Team?
Let’s discuss your project and find the right engineers to help you succeed.