Risk Mitigation Plan – RJC COP 2024
- 1. Document Control
| Company Name | Mahavir Bullion & Refinery Private Limited | Policy No. | MBR/RMP/04 |
| Policy Title | Risk Mitigation Plan | Revision Date | 01/04/2026 |
| Effective Date | 01/04/2025 | Review Date | 01/04/2027 |
| Approved By | Board of Directors | Approval Date | 01/04/2026 |
| Policy Owner | Compliance Officer / Senior Management | Classification | Controlled Document |
| Applicable Standard | RJC COP 2024 | Next Review | Annually |
-
2. Background
Mahavir Bullion & Refinery Private Limited (MBRPL or the Company) was incorporated in 2018 with the objective of providing refining and related precious-metal services to business houses, precious-metal traders and jewellers. The Company recognises that its operations and supply chains may be exposed to commercial, operational, compliance, responsible-sourcing, financial, security, environmental, health and safety and reputational risks.
This Risk Mitigation Plan establishes the Company's structured approach for identifying, assessing, treating, monitoring, reporting and reviewing risks. The original Risk Mitigation Plan identifies CAHRA determination, KYC and due diligence, origin information, sanctions and legal/internal sourcing checks as key risk-identification controls. -
3. Introduction
The Company shall maintain a documented and risk-based framework to ensure that identified risks are assessed and addressed in a timely and proportionate manner. Risk treatment shall be integrated with responsible sourcing, KYC/due diligence, human rights, security, health and safety, environmental management, procurement, operations and other relevant management systems.
This Plan shall be read with the Company's Supply Chain Policy, AML/CFT Policy, KYC/Due Diligence SOP, Human Rights Policy, Health & Safety Risk Assessment Policy, Security Risk Assessment Policy and other applicable controlled documents. -
4. Objectives
• Identify material risks that may affect the Company's people, operations, supply chains, stakeholders, legal compliance, business continuity or reputation.
• Assess likelihood and potential impact using a documented risk-rating methodology.
• Define proportionate mitigation actions, responsible owners and timelines.
• Prevent or reduce adverse impacts through controls, engagement, monitoring and escalation.
• Ensure higher-risk supply-chain issues are addressed consistently with responsible-sourcing due diligence.
• Provide management and the Board with timely risk information for decision-making.
• Maintain evidence of risk assessment, mitigation, monitoring and closure for internal and RJC audit purposes. -
5. Applicability
This Plan applies to all areas of MBRPL operations and relevant business relationships, including sourcing/procurement, refinery operations, customers, suppliers, aggregators, logistics, finance, security, human resources, health and safety, environmental management and responsible-sourcing activities. -
6. Risk Management Process
• Risk identification
• Risk assessment and rating
• Risk treatment / mitigation planning
• Implementation of controls
• Monitoring and review
• Escalation and reporting
• Closure, acceptance or continued monitoring
The process shall be documented sufficiently to demonstrate why a risk was rated at a particular level, what treatment was selected, who owns the action, the applicable timeline and how effectiveness was evaluated. -
7. Risk Identification
The Company shall identify risks through operational assessments, supplier/customer due diligence, transaction review, incident and near-miss information, audits, complaints, legal/regulatory changes, stakeholder feedback, security assessments, H&S assessments, environmental assessments and responsible-sourcing due diligence. For responsible-sourcing risks, the Company shall identify Conflict-Affected and High-Risk Areas (CAHRA) using documented resources, criteria and review frequency. The original Plan states that the Company has established a CAHRA identification procedure.
KYC and due diligence shall obtain and assess counterparty legal identity, relevant ownership/control, business information, source/origin information and other risk information proportionate to the relationship. For imports, the Company shall request origin information for each material transaction and understand direct supplier names and locations. -
8. Risk Assessment and Rating
Risks shall be assessed using the Company's approved risk matrix. The assessment should consider, as applicable, likelihood, severity/impact, scope, duration, legal/regulatory exposure, human-rights implications, supply-chain implications, financial impact, operational impact and reputational impact.
| Risk Rating | General Treatment | Required Response |
|---|---|---|
| High | Immediate / enhanced mitigation | Escalate promptly, define corrective actions, assign senior ownership and monitor to closure. |
| Medium-High | Prompt mitigation | Communicate risk and required actions; apply enhanced monitoring and defined mitigation timeline. |
| Medium | Mitigation with monitoring | Agree actions and timeline; continue monitoring and reassess effectiveness. |
| Low-Medium | Tolerate with controls | Apply proportionate controls and monitor for changes. |
| Low | Routine monitoring | Continue monitoring and maintain contingency arrangements where relevant. |
-
9. Risk Mitigation / Treatment
The Company shall select treatment according to the nature and severity of the risk. Treatment may include avoiding the activity, reducing likelihood or impact through controls, transferring/contractually allocating risk where appropriate, accepting a controlled residual risk, engaging with a counterparty to improve performance, suspending activity, or disengaging where mitigation is unsuccessful or continued engagement would be inappropriate.
The original Plan specifies the following risk-rating responses and timelines. These controls are retained as the Company's existing framework and should be applied consistently with the Responsible Sourcing Policy and any approved KYC/Due Diligence SOP.
| Rating | Existing Plan Response | Timeline | Escalation / Outcome |
|---|---|---|---|
| High | Promptly inform the supplier/customer/concerned authority and communicate mitigation steps. No new transaction during the mitigation process. | 7 days | If required information/mitigation is not received, strive to terminate future transactions. |
| Medium-High | Inform the counterparty/authority and communicate steps to mitigate the identified risk. | 14 days | If not mitigated within the specified timeline, strive to terminate future transactions. |
| Medium | Inform the counterparty/authority and communicate steps to mitigate the identified risk. | 30 days | If unresolved, extend and jointly mitigate; if still unresolved, seek an alternative solution or discontinue new transactions until satisfactorily mitigated. |
| Low-Medium | May be tolerated with proportionate control measures and stakeholder engagement. | Ongoing | Monitor and control. |
| Low | Generally managed through continuous monitoring. | Ongoing | Review operations and contingency plans. |
-
10. Responsible-Sourcing Risk Mitigation
• Where a responsible-sourcing red flag is identified, the Company shall document the risk, evidence, mitigation action, owner and decision.
• Mitigation may include obtaining additional KYC/origin documents, clarification from the supplier/customer, enhanced due diligence, additional transaction checks, site or document review, increased monitoring, corrective-action commitments or other proportionate measures.
• Senior Management shall be informed of material unresolved risks and shall decide whether to continue, suspend or disengage, as appropriate.
• Risk mitigation plans and their effectiveness shall be subject to ongoing monitoring and reporting to management/Board where material.
The original Responsible Sourcing Policy separately states that risk mitigation plans should be monitored, that failed mitigation may lead to suspension/discontinuation, and that changes in supply chain circumstances may require additional fact and risk assessment. -
11. Risk Monitoring and Review
• Reconsider risk context, rating, treatment and responsibilities.
• Review previously identified risks and determine whether controls remain effective.
• Deactivate a risk only where documented monitoring demonstrates that likelihood and impact have become non-existent or negligible.
• Review risk treatment methodologies against the Company's Risk Management Policy and applicable regulatory requirements.
• Repeat or update assessments after significant incidents, changes in supply chain, changes in counterparties, changes in law, new information or other material changes in circumstances.
The original Plan expressly requires ongoing monitoring and review of risk context, ratings, treatment, responsibilities and previously identified risks. -
12. Risk Reporting and Escalation
Material risks shall be reported to appropriate management and, where required, the Board. Management/Board oversight shall include review of risk-mitigation strategy, organisational responsibility, internal controls and the effectiveness of the risk-management framework.
• High and critical/residual risks shall be escalated promptly.
• Material unresolved responsible-sourcing risks shall be escalated to Senior Management and, where appropriate, the Board.
• Risk owners shall report progress against mitigation actions.
• Overdue actions shall be escalated to the next appropriate management level.
• Decisions to accept, suspend, restrict or terminate a material risk relationship shall be documented. -
13. Risk Mitigation Register
The Company shall maintain a Risk Register / Risk Mitigation Register containing, at minimum:
• Risk ID and date identified
• Risk category and description
• Source / affected process or counterparty
• Likelihood and impact
• Initial risk rating
• Existing controls
• Mitigation / corrective actions
• Responsible owner
• Target date
• Status
• Residual risk rating
• Evidence / closure reference
• Management escalation / decision where applicable
The register shall be kept current and supported by objective evidence such as KYC/EDD files, risk assessments, incident records, audit findings, correspondence, corrective-action records and management approvals. - 14. Roles and Responsibilities
| Role | Responsibility |
|---|---|
| Board of Directors | Provide oversight, approve the Plan where required and review material risk exposure. |
| Senior Management | Ensure resources, approve material mitigation decisions and monitor significant unresolved risks. |
| Compliance / Risk Owner | Maintain the framework, coordinate risk assessments, monitor mitigation and report/escalate material issues. |
| Sourcing / Procurement | Identify supplier and transaction risks, complete required due diligence and implement sourcing-related mitigation. |
| Operations / Refinery | Identify operational risks, maintain controls and report incidents, deviations and emerging risks. |
| Finance | Identify financial/payment risks and support appropriate controls and escalation. |
| HSE / Security / HR | Manage risks within their respective control areas and provide evidence for monitoring and review. |
| All Employees | Report identified risks, incidents, control failures and concerns through designated channels. |
-
15. Documentation and Record Keeping
• Risk registers and risk assessments
• Risk mitigation plans and action trackers
• KYC / due-diligence and responsible-sourcing records
• Counterparty communications and mitigation evidence
• Incident, complaint and audit records relevant to risk
• Management/Board review records and decisions
• Closure and residual-risk acceptance records
• Training and awareness records where risk responsibilities require training
Records shall be retained securely in accordance with applicable law and the Company's document-retention requirements. Access shall be restricted to authorised personnel. -
16. Training and Awareness
• Relevant personnel shall be trained on risk identification, escalation and mitigation responsibilities.
• Procurement, sourcing, compliance and other risk-exposed functions shall receive role-specific training.
• Training shall include responsible-sourcing red flags, KYC/EDD escalation, documentation and non-retaliation where relevant.
• Training attendance and content shall be documented. -
17. Internal Review and Assurance
• The Company shall periodically review the effectiveness of the Risk Mitigation Plan and associated controls.
• Internal reviews/audits shall examine whether risks are identified, rated, treated, monitored and documented consistently.
• Findings shall have responsible owners and target dates and shall be tracked to closure.
• Material weaknesses shall be escalated to Senior Management and, where appropriate, the Board. -
18. Policy Review
This Risk Mitigation Plan shall be reviewed at least annually and additionally following material changes in operations, supply chains, legal or regulatory requirements, RJC requirements, significant incidents, audit findings, material changes in risk exposure or other circumstances that could affect the effectiveness of the Plan. -
19. Related Controlled Documents
• Supply Chain Policy – RJC COP 2024
• AML/CFT Policy – RJC COP 2024
• KYC / Due Diligence SOP
• Human Rights Policy – RJC COP 2024
• Health & Safety Risk Assessment Policy – RJC COP 2024
• Security Risk Assessment Policy – RJC COP 2024
• Grievance Redressal Policy – RJC COP 2024 - For Mahavir Bullion & Refinery Private Limited
| Prepared By | Reviewed & Approved By |
|---|---|
| Compliance Officer | Director |
| Rushikesh Rajendra Deshmukh | Jitendra Panditrao Deshmukh |
PURPOSE
The Anti-Bribery Policy (“Policy”) emphasizes Mahavir Bullion & Refinery Private Limited’s (hereinafter referred to as “MBR/Company”) zero-tolerance approach to bribery and corruption. It establishes the principles with respect to applicable anti-bribery and anti-corruption laws. The policy provides information and guidance on how to recognise and deal with bribery and corruption issues. It guides us to act professionally, fairly and with utmost integrity in all our business dealings and relationships, wherever we operate.
POLICY STATEMENT
Bribery is the offering, promising, giving, accepting or soliciting of an advantage as an inducement for action which is illegal or a breach of trust. A bribe is an inducement or reward offered, promised or provided in order to gain any commercial, contractual, regulatory or personal advantage.
It is our policy to conduct our business in an honest and ethical manner. We take a zero-tolerance approach to bribery and corruption. We are committed to acting professionally, fairly and with integrity in all our business dealings and relationships wherever we operate and implementing and enforcing effective systems to counter bribery. We will uphold all laws relevant to countering bribery and corruption in all jurisdictions in which we operate.
It is our policy to conduct our business in an honest and ethical manner. We take a zero-tolerance approach to bribery and corruption. We are committed to acting professionally, fairly and with integrity in all our business dealings and relationships wherever we operate and implementing and enforcing effective systems to counter bribery. We will uphold all laws relevant to countering bribery and corruption in all jurisdictions in which we operate.
SCOPE
The principles set forth in this policy are applicable to all directors, officers, employees, consultants, contractors, associates and business partners of the company. It is, therefore, the responsibility of all to follow and adhere to all elements described in the policy. In countries where there are more stringent applicable laws, regulations or industry codes, MBR requires compliance with the most restrictive requirement, and the principles set out in this policy shall be superseded in those specific countries.
ANTI-BRIBERY AND CORRUPTION STANDARDS
It is prohibited for the company or its directors, officers, employees, consultants, business partners or contractors to:
a) Give, promise to give, or offer a payment, gift or hospitality to a third party or otherwise engage in or permit a bribery offence to occur, with the expectation or hope that an advantage in business will be received, or to reward a business advantage already given.
b) Give, promise to give, or offer a payment, gift, or hospitality to a third party to "facilitate" or expedite a routine procedure.
c) Accept a payment, gift or hospitality from a third party if you know or suspect that it is offered or provided with an expectation that a business advantage will be provided by the company in return.
d) Threaten or retaliate against another employee or worker who has refused to commit a bribery offence or who has raised concerns under this Policy or the company’s whistleblower policy.
e) Engage in any activity that might lead to a breach of this Policy.
a) Give, promise to give, or offer a payment, gift or hospitality to a third party or otherwise engage in or permit a bribery offence to occur, with the expectation or hope that an advantage in business will be received, or to reward a business advantage already given.
b) Give, promise to give, or offer a payment, gift, or hospitality to a third party to "facilitate" or expedite a routine procedure.
c) Accept a payment, gift or hospitality from a third party if you know or suspect that it is offered or provided with an expectation that a business advantage will be provided by the company in return.
d) Threaten or retaliate against another employee or worker who has refused to commit a bribery offence or who has raised concerns under this Policy or the company’s whistleblower policy.
e) Engage in any activity that might lead to a breach of this Policy.
GIFTS, HOSPITALITY AND ENTERTAINMENT
a) MBR acknowledges that exchange of nominal gifts and sharing of entertainment is customary in many parts of the world during national, cultural and religious occasions.
b) The giving or receipt of gifts by Associates is not prohibited, if following requirements are met:
- No quid pro quo – There must always be a legitimate business purpose to support gifts related expenses. Customary gifts, meals, entertainment, travel or lodging may never be given or received in return for a favour/ favourable treatment or to refrain from doing something disadvantaging Company.
- It complies with all applicable Anti-bribery and Anti-corruption laws;
- It does not include cash or a cash equivalent (such as gift certificates or vouchers);
- Considering, the reason and nature of the gift, it is of an appropriate type and value and given at an appropriate time;
- It is given openly, not secretly.
c) MBR appreciate that the practice of giving business gifts varies between countries and regions and what may be normal and acceptable in one region may not be in another. The test to be applied is whether in all the circumstances the gift or hospitality is reasonable and justifiable. The intention behind the gift should always be considered.
b) The giving or receipt of gifts by Associates is not prohibited, if following requirements are met:
- No quid pro quo – There must always be a legitimate business purpose to support gifts related expenses. Customary gifts, meals, entertainment, travel or lodging may never be given or received in return for a favour/ favourable treatment or to refrain from doing something disadvantaging Company.
- It complies with all applicable Anti-bribery and Anti-corruption laws;
- It does not include cash or a cash equivalent (such as gift certificates or vouchers);
- Considering, the reason and nature of the gift, it is of an appropriate type and value and given at an appropriate time;
- It is given openly, not secretly.
c) MBR appreciate that the practice of giving business gifts varies between countries and regions and what may be normal and acceptable in one region may not be in another. The test to be applied is whether in all the circumstances the gift or hospitality is reasonable and justifiable. The intention behind the gift should always be considered.
FACILITATION PAYMENTS AND KICKBACKS
Facilitation payments are a form of bribery made for the purpose of expediting or facilitating the performance of a public official for a routine governmental action and not to obtain or retain business or any improper business advantage. Facilitation payments tend to be demanded by low-level officials to obtain a level of service that one would normally be entitled to.
MBR’s strict policy is that facilitation payments must not be paid. MBR recognizes, however, that its employees may be faced with situations where there is a risk to the personal security of an employee or his/her family and where a facilitation payment is unavoidable, in which case the following steps must be taken:
- Keep any amount to the minimum;
- Create a record concerning the payment; and
- Report it to your manager.
In order to achieve our aim of not making any facilitation payments, each business of the company will keep a record of all payments made, which must be reported to the management in order to evaluate the business risk and to develop a strategy to minimize such payments in the future.
MBR’s strict policy is that facilitation payments must not be paid. MBR recognizes, however, that its employees may be faced with situations where there is a risk to the personal security of an employee or his/her family and where a facilitation payment is unavoidable, in which case the following steps must be taken:
- Keep any amount to the minimum;
- Create a record concerning the payment; and
- Report it to your manager.
In order to achieve our aim of not making any facilitation payments, each business of the company will keep a record of all payments made, which must be reported to the management in order to evaluate the business risk and to develop a strategy to minimize such payments in the future.
POLITICAL CONTRIBUTIONS
MBR do not make donations, whether in cash or kind, in support of any political parties or candidates, as this can be perceived as an attempt to gain an improper business advantage.
CHARITABLE CONTRIBUTIONS
Charitable support and donations are acceptable (and indeed are encouraged), whether of in- kind services, knowledge, time, or direct financial contributions. However, employees must be careful to ensure that charitable contributions are not used as a scheme to conceal bribery. MBR only does charitable donations that are legal and ethical under local laws and practices. No donation must be offered or made without the prior approval of the Management.
RECORD-KEEPING
MBR maintains financial records and has appropriate internal controls in place, which will evidence the business reason for making payments to third parties. MBR maintains a written record of all hospitality or gifts accepted or offered, which will be subject to managerial review. All expense claims relating to hospitality, gifts, or expenses incurred to third parties are submitted in accordance with the company’s expenses policy and specifically record the reason for the expenditure. All accounts, invoices, memoranda, and other documents and records relating to dealings with third parties, such as clients, suppliers, and business contacts, should be prepared and maintained with strict accuracy and completeness. MBR ensures that no accounts are kept "off-book" to facilitate or conceal improper payments.
RAISING A CONCERN AND PROTECTION
a) All MBR associates are encouraged to raise concerns about any issue or suspicion of malpractice at the earliest possible stage. If they are unsure whether a particular act constitutes bribery or corruption, or if they have any other queries, these should be raised with the manager.
b) An associate who refuses to accept or offer a bribe, or those who raise concerns or report another's wrongdoing, are sometimes worried about possible repercussions. MBR aims to encourage openness and will support anyone who raises genuine concerns in good faith under this policy, even if they turn out to be mistaken.
c) MBR will ensure that no one will suffer any detrimental treatment as a result of refusing to take part in bribery or corruption, or because of reporting in good faith their suspicion that an actual or potential bribery or other corruption offence has taken place, or may take place in the future. Detrimental treatment includes dismissal, disciplinary action, threats or other unfavourable treatment connected with raising a concern.
b) An associate who refuses to accept or offer a bribe, or those who raise concerns or report another's wrongdoing, are sometimes worried about possible repercussions. MBR aims to encourage openness and will support anyone who raises genuine concerns in good faith under this policy, even if they turn out to be mistaken.
c) MBR will ensure that no one will suffer any detrimental treatment as a result of refusing to take part in bribery or corruption, or because of reporting in good faith their suspicion that an actual or potential bribery or other corruption offence has taken place, or may take place in the future. Detrimental treatment includes dismissal, disciplinary action, threats or other unfavourable treatment connected with raising a concern.
TRAINING AND COMMUNICATION
Training on this policy forms part of the induction process for all new employees. All existing employees will receive regular, relevant training on how to implement and adhere to this policy. In addition, all employees will be asked to formally accept conformance to this policy on an annual basis. Our zero-tolerance approach to bribery and corruption must be communicated to all suppliers, customers, contractors and business partners at the outset of our business relationship with them and as appropriate thereafter.
MONITORING AND REVIEW
The Board of Directors shall monitor the effectiveness and review the implementation of this policy, regularly considering its suitability, adequacy and effectiveness. Any improvements identified will be made as soon as possible. Internal control systems and procedures will be subject to regular audits to provide assurance that they are effective in countering bribery and corruption. All employees are responsible for the success of this policy and should ensure they use it to disclose any suspected danger or wrongdoing. Employees are invited to comment on this policy and suggest ways in which it might be improved. Comments, suggestions and queries should be addressed to the Board of Directors. This policy does not form part of any employee's contract of employment and it may be amended at any time.