Risk Management in Procurement

BUKHATIR GROUP

Strength through Diversity

Group Policy and Procedure

Group Supply Chain (GSC)

Risk Management in Procurement

Assessment, Mitigation & Register

Document No: P-POL-016

Copyright © 2026 Bukhatir Group

Revision Control

This document is issued under the authority of Bukhatir Group and applies when carrying out the activities described. Revisions may be issued as necessary under the authority of the Group Head of Procurement. Revision history is recorded below with every revised policy.

Revision History

Revision Sign-Off

Distribution List

1. Purpose

This policy establishes a structured approach to identifying, assessing, treating and monitoring risk across procurement and supply chain activities.

2. Scope

Applies to all sourcing events, supplier relationships, contracts and supply chain operations across the Group.

3. Risk Categories

4. Risk Assessment

A documented risk assessment is required for all orders and contracts above AED 500,000. The assessment rates likelihood (1–5) and impact (1–5). The resulting risk score drives mitigation requirements. BU Procurement shall share signed risk assessment forms with GSC in a timely manner.

5. Mitigation Strategies

• Dual-sourcing or multi-sourcing for critical categories.

• Safety stock and buffer inventory for high-risk items.

• Long-term framework agreements with price escalation clauses.

• Performance bonds, parent company guarantees, advance payment guarantees.

• Business continuity clauses and supplier BCM plans for Tier 1.

• Cyber due diligence for all suppliers handling Group data.

6. Risk Register

GSC maintains a Procurement Risk Register, reviewed monthly and escalated to the GSC–BU Steering Committee quarterly.

7. Reference Form

Form — Procurement Risk Assessment Form.

Input Tax Credit (ITC) Compliance — FTA Decision No. 13 of 2026

Effective 1 October 2026, the following FTA-mandated risk indicators must be incorporated into the procurement risk assessment framework per FTA Decision No. 13 of 2026, Article 3.3, and P-POL-032:

FTA Risk Indicators (Mandatory Monitoring):

• Supplier address change frequency: Flag if changed more than twice in the previous 12 months.

• Key employee / manager turnover: Flag if key contacts changed more than twice in the previous 12 months.

• Transaction proportionality: Flag if commercial transactions are disproportionate or unexpected relative to the supplier's size, business nature, and transaction history.

Where any of these risk indicators are triggered, the responsible procurement officer must retain a clear and justified written explanation. This explanation must not contradict available evidence and must be submitted to the FTA upon request.

• Integrate FTA risk indicators into the supplier risk scoring model and quarterly risk reviews.

• Maintain a risk register entry for each triggered indicator, including the date identified, explanation provided, and resolution status.

8. Definitions & Acronyms