Implementation of Risk Management for Pension Funds

To:
Board of Directors and Acting Board of Directors of Pension Funds

COPY

CIRCULAR LETTER OF THE FINANCIAL SERVICES AUTHORITY REPUBLIC OF INDONESIA NUMBER 28 /SEOJK.05/2020

CONCERNING

IMPLEMENTATION OF RISK MANAGEMENT FOR PENSION FUNDS

In relation to the mandate of Article 25 of Financial Services Authority Regulation Number 44/POJK.05/2020 concerning the Implementation of Risk Management for Non-Bank Financial Service Institutions (State Gazette of the Republic of Indonesia Year 2020 Number 200, Supplement to the State Gazette of the Republic of Indonesia Number 6552), it is necessary to further regulate the implementation of risk management, the organizational structure of the Risk Management Committee, the organizational structure of the Risk Management function, the relationship between business and operational functions with the Risk Management function, and the management of risks arising from the development or expansion of business activities for pension funds in this Financial Services Authority Circular Letter as follows:

I. GENERAL PROVISIONS

In this Financial Services Authority Circular Letter, the following terms are defined:

Pension Fund is a legal entity that manages and runs a program promising pension benefits, including Pension Funds that carry out all or part of their business using Sharia principles.
Employer Pension Fund, hereinafter abbreviated as DPPK, is a Pension Fund formed by a person or entity that employs employees, as the founder, to carry out a defined benefit pension program or a defined contribution pension program, for the benefit of some or all of its employees as participants, and which creates obligations for the employer.
Financial Institution Pension Fund, hereinafter abbreviated as DPLK, is a Pension Fund formed by a bank or life insurance company to carry out a defined contribution pension program for individuals, both employees and self-employed workers, separate from the DPPK for employees of the respective bank or life insurance company.
Risk is the potential for losses that cannot be controlled and/or can be controlled due to the occurrence of a specific event.
Risk Management is a series of procedures and methodologies used to identify, measure, control, and monitor Risks arising from all business activities of the Pension Fund.
Strategic Risk is Risk due to inaccuracies in making and/or implementing strategic decisions and failures in anticipating changes in the business environment.
Operational Risk is Risk due to insufficient and/or non-functioning internal processes, human error, system failures, and/or external events affecting the operations of the Pension Fund.
Credit Risk is Risk due to the failure of other parties to fulfill obligations to the Pension Fund.
Market Risk is Risk on asset and liability positions due to overall changes in market conditions.
Liquidity Risk is Risk due to the Pension Fund's inability to meet maturing liabilities from cash flow funding sources and/or from liquid assets that can be easily converted into cash, without disrupting the Pension Fund's activities and financial condition.
Legal Risk is Risk arising from legal claims and/or weaknesses in legal aspects.
Compliance Risk is Risk due to the Pension Fund not complying with and/or not implementing applicable laws and regulations and provisions for Pension Funds.
Reputational Risk is Risk due to a decrease in the level of trust of stakeholders stemming from negative perceptions of the Pension Fund.
Founder is:
a. a person or entity that forms a DPPK; or b. a bank or life insurance company that forms a DPLK.
Co-Founder is an employer that participates in a Founder's DPPK, for the benefit of some or all of its employees.
Participant is every person who meets the regulatory requirements of the Pension Fund.
Board of Directors is the Board of Directors of the Pension Fund.
Acting Board of Directors is an official from the DPLK Founder who is tasked with carrying out the operational activities of the DPLK.
Board of Supervisors is the Board of Supervisors of the Pension Fund.
Sharia Supervisory Board is a board responsible for providing advice and suggestions and supervising the fulfillment of Sharia principles in the implementation of pension programs based on Sharia principles.

II. STANDARDS AND GUIDELINES FOR THE IMPLEMENTATION OF RISK MANAGEMENT

The implementation of Risk Management must be adjusted to the objectives, business policies, size, and complexity of the Pension Fund's business, considering the development of conditions and potential problems faced.
In the implementation of Risk Management as referred to in item 1, the Pension Fund must have and apply written Risk Management strategies, policies, and procedures.
The implementation of Risk Management as referred to in items 1 and 2 refers to the standards and guidelines for the implementation of Risk Management as contained in Appendix I, which is an integral part of this Financial Services Authority Circular Letter.
The written Risk Management strategies, policies, and procedures as referred to in item 2 can be formulated in the form of an internal Pension Fund Risk Management guideline.
The standards and guidelines for the implementation of Risk Management as referred to in item 3 are the minimum reference for Pension Funds in implementing Risk Management, to ensure that all Risks faced by the Pension Fund are identified, measured, controlled, and monitored accurately.
The Risk Management strategies, policies, and procedures as referred to in item 4 must at least cover:
a. the implementation of Risk Management, which must at least cover:
1) active supervision by the Board of Directors/Acting Board of Directors, Board of Supervisors, and Sharia Supervisory Board;
2) adequacy of Risk Management policies and procedures and the establishment of Risk limits;
3) adequacy of the Risk identification, measurement, control, and monitoring processes, as well as the Risk Management information system; and
4) a comprehensive internal control system;
b. the implementation of Risk Management for each type of Risk, which covers the implementation of Risk Management for 8 (eight) types of Risk, namely Strategic Risk, Operational Risk, Credit Risk, Market Risk, Liquidity Risk, Legal Risk, Compliance Risk, and Reputational Risk; and
c. risk profile assessment, which covers the assessment of inherent risk and the assessment of the quality of Risk Management implementation reflecting the Risk control system for the Pension Fund. This assessment is conducted against the 8 (eight) types of Risk as referred to in letter b. The Pension Fund's risk profile assessment is conducted by referring to Financial Services Authority Regulations regarding the assessment of the health level of non-bank financial service institutions.
Pension Funds must have an organizational structure that supports the effective implementation of Risk Management, including the organizational structure of the Risk Management Committee and the organizational structure of the Risk Management function, which are an integral part of the Pension Fund's Risk Management organizational structure.
The Pension Fund's Risk Management organizational structure as referred to in item 7 must explain the relationship between business and operational functions with the Risk Management function.
The Risk Management organizational structure as referred to in items 7 and 8 refers to Appendix II, which is an integral part of this Financial Services Authority Circular Letter.
In the context of Risk measurement, Pension Funds may use various Risk measurement approaches, including using models for internal purposes (internal model). Measurement using internal models is intended to anticipate the increasingly complex business activities of Pension Funds as well as future Pension Fund policies. The application of internal models requires various minimum quantitative and qualitative requirements so that risk assessment results can better reflect the actual condition of the Pension Fund.
In the context of implementing effective Risk Management, Pension Funds take preparatory, developmental, and/or improvement steps, including:
a. conducting an analysis of the organization, Risk Management strategies, policies, and procedures, or internal Risk Management guidelines; b. formulating a plan to improve the Pension Fund's Risk Management in accordance with the reference in the standard guidelines for the implementation of Risk Management for Pension Funds, in the event of inconsistencies between the Pension Fund's Risk Management strategies, policies, and procedures, or internal Risk Management guidelines, and the standard guidelines for the implementation of Risk Management for Pension Funds as per the standard guidelines in this Financial Services Authority Circular Letter;
c. socializing the Risk Management strategies, policies, and procedures, or internal Risk Management guidelines to employees so that they understand Risk Management practices, and developing a risk culture among all employees at every level of the Pension Fund's organizational structure; and
d. ensuring that the internal audit function participates in monitoring the formulation and improvement of internal Risk Management guidelines and the implementation of Risk Management, as well as the risk profile assessment as regulated in Financial Services Authority Regulations regarding the assessment of the health level of non-bank financial service institutions.
The implementation of Risk Management in Pension Funds also includes the implementation of anti-money laundering and counter-terrorism financing programs as regulated in Financial Services Authority Regulations regarding the implementation of anti-money laundering and counter-terrorism financing programs in the financial services sector.

III. MANAGEMENT OF RISKS ARISING FROM THE DEVELOPMENT OR EXPANSION OF PENSION FUND BUSINESS ACTIVITIES

Pension Funds must have written policies and procedures to manage the inherent risks associated with the development or expansion of business activities.
The Risk Management policies and procedures for the development or expansion of business activities must be in line with the Pension Fund's business plan.
Pension Fund business activities categorized as a form of development or expansion of business activities are business activities that:
a. have never been previously conducted by the Pension Fund, such as the implementation of other benefit programs by a Pension Fund that has not yet implemented other benefit programs or the periodic payment of pension benefits by a Pension Fund implementing a defined contribution pension program; or b. have been previously implemented by the Pension Fund, but involve development that changes or increases certain Risk exposures for the Pension Fund, such as the addition of Co-Founders for DPPK or changes in investment package offerings for DPLK.
The Pension Fund's Risk Management strategies, policies, and procedures, or internal Risk Management guidelines regarding the aspects referred to in Section II item 6 letters a and b must be adjusted in the event that the development or expansion of the Pension Fund's business activities has a significant impact on the Pension Fund's overall business activities.

IV. OTHER PROVISIONS

Pension Funds that already have Risk Management strategies, policies, and procedures, or internal Risk Management guidelines, but which are not yet in accordance with the standards and guidelines for the implementation of Risk Management as referred to in the appendix of this Financial Services Authority Circular Letter, must adjust and improve their Risk Management strategies, policies, and procedures, or internal Risk Management guidelines by referring to this Financial Services Authority Circular Letter.
Pension Funds may broaden and deepen the standards and guidelines for the implementation of Risk Management as referred to in the appendix of this Financial Services Authority Circular Letter according to the needs of the Pension Fund.
The implementation of Risk Management for DPLK may be combined with the implementation of Risk Management by the DPLK Founder if the DPLK can ensure that the implementation of Risk Management by the DPLK Founder has met all aspects of Risk Management implementation as referred to in this Financial Services Authority Circular Letter.

V. CLOSING

Upon the effective date of this Financial Services Authority Circular Letter, Financial Services Authority Circular Letter Number 10/SEOJK.05/2016 concerning Guidelines for the Implementation of Risk Management and Self-Assessment Report on the Implementation of Risk Management for Non-Bank Financial Service Institutions is declared not applicable to Pension Funds.

This copy is in accordance with the original
Director of Law 1
Legal Department signed
Mufli Asmawidjaja

The provisions in this Financial Services Authority Circular Letter shall take effect on the date of determination.

Determined in Jakarta on December 30, 2020

EXECUTIVE HEAD OF SUPERVISOR
FOR INSURANCE, PENSION FUNDS,
LENDING INSTITUTIONS, AND
OTHER FINANCIAL SERVICE INSTITUTIONS
FINANCIAL SERVICES AUTHORITY
REPUBLIC OF INDONESIA, signed
RISWINANDI

APPENDIX I
CIRCULAR LETTER OF THE FINANCIAL SERVICES AUTHORITY REPUBLIC OF INDONESIA NUMBER 28 /SEOJK.05/2021 CONCERNING IMPLEMENTATION OF RISK MANAGEMENT FOR PENSION FUNDS

TABLE OF CONTENTS
I. IMPLEMENTATION OF RISK MANAGEMENT ................................................... 2
A. Active Supervision by Board of Directors/Acting Board of Directors, Board of Supervisors, and Sharia Supervisory Board .................................. 2
a. Authority and Responsibilities of Board of Directors/Acting Board of Directors, Board of Supervisors, and Sharia Supervisory Board ............................................................................. 3
b. Human Resources (HR) ............................................ 8
c. Risk Management Organization ............................................ 10
B. Adequacy of Risk Management Policies and Procedures and Establishment of Risk Limits ............................................................ 11
a. Risk Management Strategy ................................................ 12
b. Risk Appetite and Risk Tolerance ........................................ 13
c. Policies and Procedures ..................................................... 14
d. Establishment of Risk Limits ...................................................... 18
C. Adequacy of Risk Identification, Measurement, Control, and Monitoring Processes, as well as Risk Management Information System .. 19
a. Risk Identification .............................................................. 20
b. Risk Measurement ............................................................ 20
c. Risk Control .......................................................... 24
d. Risk Monitoring ........................................................... 25
e. Risk Management Information System ................................... 26
D. Comprehensive Internal Control System ....................... 29
II. IMPLEMENTATION OF RISK MANAGEMENT FOR EACH RISK TYPE 31
A. Strategic Risk ........................................................................ 31
B. Operational Risk ................................................................... 41
C. Credit Risk ............................................................................ 53
D. Market Risk ............................................................................. 62
E. Liquidity Risk ...................................................................... 68
F. Legal Risk .......................................................................... 77
G. Compliance Risk ..................................................................... 82
H. Reputational Risk ........................................................................ 87
III. RISK PROFILE ASSESSMENT .............................................................. 91

STANDARDS AND GUIDELINES FOR THE IMPLEMENTATION OF RISK MANAGEMENT FOR PENSION FUNDS

I. IMPLEMENTATION OF RISK MANAGEMENT

As regulated in Financial Services Authority Regulation Number 44/POJK.05/2020 concerning the Implementation of Risk Management for Non-Bank Financial Service Institutions, Pension Funds are required to implement Risk Management effectively, which generally covers at least 4 (four) pillars, namely:

active supervision by the Board of Directors/Acting Board of Directors, Board of Supervisors, and Sharia Supervisory Board;
adequacy of Risk Management policies and procedures and the establishment of Risk limits;
adequacy of the Risk identification, measurement, control, and monitoring processes, as well as the Risk Management information system; and
a comprehensive internal control system.

The Risk Management principles of each of these pillars are described as follows:

A. Active Supervision by Board of Directors/Acting Board of Directors, Board of Supervisors, and Sharia Supervisory Board

The Board of Directors/Acting Board of Directors, Board of Supervisors, and Sharia Supervisory Board are responsible for the effectiveness of Risk Management implementation in the Pension Fund. Therefore, the Board of Directors/Acting Board of Directors, Board of Supervisors, and Sharia Supervisory Board must at least:
a. have a good understanding of the types and levels of inherent risk in the Pension Fund's business activities; b. provide clear direction in the implementation of Risk Management;
c. conduct active supervision and mitigation of Risk;
d. ensure an adequate organizational structure to support the effective implementation of Risk Management; e. establish clear duties and responsibilities in the implementation of Risk Management for each function; and f. ensure the adequacy of the quantity and quality of human resources to support the effective implementation of Risk Management.
Matters to be considered in the implementation of active supervision by the Board of Directors/Acting Board of Directors, Board of Supervisors, and Sharia Supervisory Board include the following:
a. Authority and Responsibilities of Board of Directors/Acting Board of Directors, Board of Supervisors, and Sharia Supervisory Board
1) The Board of Directors/Acting Board of Directors, Board of Supervisors, and Sharia Supervisory Board, according to the scope of their respective authorities, are responsible for ensuring that the implementation of Risk Management has been effective in accordance with the characteristics, complexity, and risk profile of the Pension Fund;
2) The Board of Directors/Acting Board of Directors and Board of Supervisors must ensure that each function in the Pension Fund implements Risk Management;
3) The authority and responsibilities of the Board of Directors/Acting Board of Directors must at least include:
a) formulating written and comprehensive Risk Management policies and strategies, including among others:
(1) formulating and updating procedures and tools to identify, measure, control, and monitor Risk; (2) determining overall Risk limits and per Risk type, considering the risk appetite and risk tolerance in accordance with the Pension Fund's conditions, and specifically for DPPK implementing defined benefit pension programs, also considering the impact of Risk on funding adequacy; (3) ensuring that all policies, provisions, systems, and procedures, as well as business activities conducted by the Pension Fund comply with applicable laws and regulations; (4) after obtaining approval from the Board of Supervisors for the Risk Management policy, the Board of Directors/Acting Board of Directors establishes the Risk Management strategies, policies, and procedures, or internal Risk Management guidelines; and (5) evaluating and updating the Risk Management strategies, policies, and procedures, or internal Risk Management guidelines at least once (1) in one (1) year or at a more frequent frequency in the event of changes in factors affecting the Pension Fund's business activities, Risk exposure, or risk profile significantly; b) being responsible for the implementation of Risk Management policies and the Risk exposure taken by the Pension Fund as a whole, including among others:
(1) evaluating and providing direction based on reports submitted by the Risk Management function, including reports regarding the risk profile; (2) taking necessary actions in accordance with the Pension Fund's risk profile, including by providing recommendations or proposals regarding the implementation of Risk Management to each function in the Pension Fund; (3) ensuring that all material Risks and the impacts caused by such Risks have been followed up and submitting accountability reports on such follow-up to the Board of Supervisors periodically. Such reports include among others reports on the development and problems related to material Risks accompanied by improvement steps that have been, are being, and will be taken. If necessary, such reports can also be submitted to the Founder; (4) ensuring the implementation of improvement steps for problems or deviations in the Pension Fund's business activities found by the internal audit function; and (5) submitting accountability reports on the implementation of Risk Management policies and the Risk exposure taken by the Pension Fund to the Board of Supervisors and Sharia Supervisory Board at least once (1) in six (6) months; c) evaluating and deciding on transactions and Risk limits that require the approval of the Board of Directors/Acting Board of Directors, including formulating and establishing transaction approval mechanisms, including those exceeding limits and authority for each job level in the Pension Fund; d) developing a Risk Management culture at all levels of the organization, including developing Risk awareness at all levels of the organization, including among others adequate communication to all levels of the organization about the importance of effective internal control; e) ensuring the improvement of competence of human resources related to Risk Management so that the Pension Fund has adequate human resource support to manage and control Risk, including among others through continuous education and training programs related to the implementation of Risk Management; f) ensuring that the Risk Management function has operated independently, reflected among others by:
(1) the separation of functions between the Risk Management function that performs Risk identification, measurement, monitoring, and control and the internal control function; and (2) the implementation of Risk Management being free from conflicts of interest between functions; g) conducting periodic reviews to ensure:
(1) the accuracy of Risk assessment methodologies; (2) the adequacy of the implementation of the Risk Management information system; and (3) the appropriateness of Risk Management policies and procedures and the establishment of Risk limits, such reviews are conducted to anticipate if there are changes in external and internal factors;
4) The authority and responsibilities of the Board of Supervisors must at least include:
a) approving the Risk Management policies formulated by the Board of Directors/Acting Board of Directors and evaluating such policies,

including the Risk Management strategy prepared by the Board of Directors/Acting Board of Directors, at least 1 (one) time in 1 (one) year or at a more frequent frequency in the event of changes in factors that significantly affect the business activities of the Pension Fund; b) evaluate the accountability of the Board of Directors/ Acting Board of Directors at least 1 (one) time in 6 (six) months and provide guidance for improvement regarding the implementation of Risk Management policies on a regular basis. The evaluation is conducted to ensure that the Board of Directors/Acting Board of Directors manages Pension Fund activities and Risks effectively and ensures that Risk Management policies and implementation are carried out effectively and integrated into the overall business process. In conducting the evaluation, the Board of Supervisors may form a risk monitoring committee tasked with assisting the Board of Supervisors in monitoring the implementation of Risk Management prepared by the Board of Directors/Acting Board of Directors; c) evaluate and decide on requests from the Board of Directors/Acting Board of Directors regarding transactions and Risk limits that require the approval of the Board of Supervisors. Such transactions and Risk limits are business or operational activities that have exceeded the authority of the Board of Directors/Acting Board of Directors to do so, according to the internal policies and procedures of the Pension Fund;

Authority and responsibility of the Sharia Supervisory Board,
at least including:
a) evaluating policies, including the
Risk Management strategy prepared by the
Board of Directors/Acting Board of Directors that relates to the fulfillment of Sharia principles at least 1 (one) time in 1 (one) year or at a more frequent frequency in the event of changes in factors that affect the business activities of the Pension Fund significantly and providing guidance regarding policies for Risk Management established in the context of fulfilling Sharia principles; and b) evaluating the accountability of the Board of Directors/Acting Board of Directors regarding the implementation of Risk Management policies related to the fulfillment of Sharia principles at least 1 (one) time in 6 (six) months. The evaluation is conducted to ensure that Risk Management policies and processes are implemented in accordance with Sharia principles. b. Human Resources (HR) In carrying out the responsibility for implementing Risk Management related to HR, the Board of Directors/Acting Board of Directors must:
establish clear HR qualifications for each
job level related to the implementation of
Risk Management;
ensure the sufficiency of the quantity and quality of existing HR
in the Pension Fund and ensure that the aforementioned HR understands their duties and responsibilities, both for business and operational functions (risk taking function), Risk Management function, internal audit function, as well as supporting functions that are responsible for the implementation of Risk Management;
develop employee recruitment, development,
and training systems, including managerial succession plans and adequate remuneration to ensure the availability of competent employees in the field of Risk Management;
ensure the improvement of competence and integrity
of leaders and employees in the business and operational functions (risk taking function), Risk Management function, and internal audit function, by considering factors such as knowledge, experience or track record and adequate ability in the field of Risk Management through continuous education and training programs, to guarantee the effectiveness of the Risk Management process;
place competent employees in each
function according to the nature, number, and complexity of the Pension Fund's business activities;
ensure that employees placed in each
of these functions have:
a) an understanding of the Risks inherent
(inherent risk) in each business activity of the Pension Fund; b) an understanding of relevant Risk factors and external factor conditions that affect the business activities of the Pension Fund, as well as the ability to estimate the impact of changes in these factors on the sustainability of the Pension Fund's business; and c) the ability to communicate the implications of the Pension Fund's Risk exposure to the Board of Directors/Acting Board of Directors and the Risk Management committee in a timely manner.
ensure that all HR understands the strategy, the level of Risk to be taken (risk appetite) and
Risk tolerance (risk tolerance), and policies
Risk Management that have been established by the Board of Directors/Acting Board of Directors and approved or known by the Board of Supervisors and implement them consistently in all business activities of the Pension Fund.
c. Risk Management Organization
In order to implement effective Risk Management, the Board of Directors/Acting Board of Directors establishes the Risk Management organizational structure by considering at least the following matters:
The organizational structure prepared must be accompanied
by clarity of duties and responsibilities generally as well as regarding the implementation of Risk Management in all functions adjusted to the objectives and business policies, size and complexity of the Pension Fund's business activities;
The Pension Fund has a Risk Management committee and
an independent Risk Management function;
The organizational structure must be designed to
ensure that the internal audit function and the Risk Management function are independent of the business and operational functions (risk taking function) of the Pension Fund;
The organizational structure is designed so that the Risk Management
function has direct access and reporting to the Board of Directors/Acting Board of Directors, the Board of Supervisors, and the Sharia Supervisory Board for matters such as:
a) assessment of Risks and Risk exposure positions as well as steps to be taken to manage such Risks; b) assessment of changes in the Pension Fund's Risk profile; c) assessment of established Risk limits; d) Risk Management related to strategy, for example, the Pension Fund's investment strategy; and e) assessment of Risks that have occurred and

identification of appropriate corrective actions for such Risks;
5) The person in charge of the Risk Management function has
the authority and obligation to inform the Board of Supervisors of any event that may have a material impact on the Pension Fund's Risk Management system;
6) Sufficiency of the framework for delegation of authority
is adjusted to the characteristics and complexity of the business line, the level of Risk to be taken (risk appetite) of the Pension Fund, as well as the experience and expertise of the respective personnel. The delegated authority is evaluated regularly to ensure that the authority is appropriate with current conditions and the performance level of the relevant employees. B. Sufficiency of Risk Management Policies and Procedures and Establishment of Risk Limits

The implementation of effective Risk Management must be supported
by a Risk Management framework, or internal Risk Management guidelines that include Risk Management strategy, policies, and procedures as well as established Risk limits clearly aligned with the vision, mission, and strategy of the Pension Fund.
The formulation of Risk Management strategy, policies, and procedures, or internal Risk Management guidelines is done
by considering among other things the type, complexity of business activities, Risk profile, and level of Risk to be taken (risk appetite) as well as applicable legislation and healthy Pension Fund practices.
The implementation of Risk Management policies and procedures owned by the Pension Fund must be supported by sufficient
funding support, quality HR, and adequate infrastructure.
The policies and procedures owned by the Pension Fund must be
based on the Risk Management strategy and supplemented with Risk tolerance (risk tolerance) and Risk limits.
The Pension Fund's Risk Management policy must explain
how the relationship between Risk Management and the objectives, strategy, and current condition of the Pension Fund.
Matters to be considered in the establishment of strategy,
policies, procedures, and limits include the following:
a. Risk Management Strategy

The Pension Fund formulates Risk Management strategy in accordance with the overall business strategy
by considering the level of Risk to be taken (risk appetite) and Risk tolerance (risk tolerance).
Risk Management strategy is prepared to
ensure that Risk exposure is managed in a controlled manner in accordance with applicable legislation.
Risk Management strategy is prepared based on
the following general principles:
a) Risk Management strategy must be long-term oriented to ensure the sustainability of the Pension Fund's business, specifically for DPPK that administer defined benefit pension programs, also including achieving the expected funding adequacy; b) comprehensive Risk Management strategy can control and manage Pension Fund Risks; and c) Risk Management strategy is accompanied by adequate resource allocation.
Risk Management strategy is prepared by
considering the following factors:
a) the Pension Fund's objectives and strategic plans; b) economic and industry developments and their impact on Pension Fund Risks;

c) the Pension Fund's organization including the sufficiency of HR and supporting infrastructure; d) the Pension Fund's financial condition including the ability to manage investments, and e) the Pension Fund's ability to manage Risks that arise as a result of changes in external factors and internal factors.
5) The Board of Directors/Acting Board of Directors must
describe the Risk Management strategy into
Risk Management policies and procedures.
6) The Board of Directors/Acting Board of Directors must
communicate the Risk Management strategy effectively to all relevant employees so that it is clearly understood.
7) The Board of Directors/Acting Board of Directors must
evaluate the Risk Management strategy regularly, including its impact on the financial performance of the Pension Fund, to determine whether changes to the Pension Fund's Risk Management strategy are necessary. b. Level of Risk to be Taken (Risk Appetite) and Risk Tolerance (Risk Tolerance)

In formulating Risk Management policies,
the Board of Directors/Acting Board of Directors must provide clear guidance regarding the level of Risk to be taken (risk appetite) and Risk tolerance (risk tolerance) of the Pension Fund. In addition, the Board of Directors/Acting Board of Directors must inform the level of Risk to be taken (risk appetite) and Risk tolerance (risk tolerance) to all levels of the organization in the Pension Fund.
The level of Risk to be taken (risk appetite)
is the level and type of Risk that can be taken by the Pension Fund in order to achieve the Pension Fund's objectives. The level of Risk to be taken (risk appetite) is reflected in the strategy and

business objectives of the Pension Fund which are formulated in the Pension Fund's business plan and established in the form of establishing the level of Risk to be taken (risk appetite statement).
3) The level of Risk to be taken (risk appetite) can
be in the form of the amount of Risk and/or characteristics of Risk that are acceptable to the Pension Fund.
4) Risk tolerance (risk tolerance) is the maximum
limit of the level of Risk and amount of Risk established by the Pension Fund. Risk tolerance (risk tolerance) is an elaboration of the level of Risk to be taken (risk appetite).
5) Risk tolerance (risk tolerance) can be in the form of
quantitative and/or qualitative limits. An example of a quantitative limit is the limit on the range of technical interest rates that can be used by the Pension Fund. An example of a qualitative limit is a management decision stating that there is no tolerance (zero tolerance) for fraud (fraud) or money laundering practices. If there are conditions that deviate from the quantitative and/or qualitative limits, the Pension Fund must immediately take action.
6) The establishment of Risk tolerance (risk tolerance) is done
by considering the level of Risk to be taken (risk appetite), the objectives and strategy of the Pension Fund as a whole, as well as the ability of the Pension Fund to accept Risk (risk bearing capacity).
c. Policies and Procedures

Risk Management policy is written guidance in implementing Risk Management and
must align with the vision, mission, and strategy of the Pension Fund, which in its formulation must be coordinated with related functions.
Risk Management procedures are the methods or
mechanisms for implementing Risk Management policies, including policies in identification, measurement, control, and monitoring of Risks.
Policies and procedures must be designed and
implemented by considering the characteristics and complexity of business activities, level of Risk to be taken (risk appetite) and Risk tolerance (risk tolerance), Risk profile as well as applicable legislation and healthy Pension Fund practices.
Risk Management policies and procedures
are adequately documented and communicated to all employees and are reviewed regularly and updated to accommodate changes in factors that impact the Risks of the Pension Fund.
Risk Management policies must:
a) be relevant to the types of Risks that have been determined, both Risks related to strategy as well as related to daily operational activities of the Pension Fund; b) describe the relationship between the Pension Fund's tolerance limits, regulations regarding funding, and Risk monitoring methods; and c) explain the relationship between Risk Management with the objectives, strategy and current conditions of the Pension Fund.
Risk Management policies must at least contain:
a) the establishment of Risks related to the business activities of the Pension Fund based on the results of the Pension Fund's analysis of Risks that are inherent (inherent risk) in each business activity of the Pension Fund that has been and will be done by the Pension Fund; b) the establishment of methods and information systems in performing identification, measurement,

monitoring and control of Risks in each business activity of the Pension Fund; c) the establishment of the level of Risk to be taken (risk appetite), Risk tolerance (risk tolerance), and Risk limits; d) the establishment of data that must be reported, format of reports, and types of information that must be included in reports related to the implementation of Risk Management so that they reflect the Risk exposure that is considered in the context of decision making while still considering the principle of prudence; e) the establishment of authority and magnitude of limits in a hierarchical manner including transaction limits that require approval from the Board of Directors/Acting Board of Directors; f) the establishment of Risk profile rankings as a basis for the Pension Fund to determine steps for improvement of business activities of the Pension Fund and specific activity areas of the Pension Fund and evaluate the results of implementation of Risk Management policies and strategies; g) an organizational structure that clearly formulates the roles and responsibilities of the Board of Directors/Acting Board of Directors, Board of Supervisors, Sharia Supervisory Board, committees, Risk Management function, business and operational functions (risk taking function), internal audit function, and other supporting functions; h) business continuity plan policies (business continuity plan or business continuity management) for possible worst-case external and internal conditions, so that the continuity of the Pension Fund's business activities can be maintained, including the disaster recovery plan (disaster recovery plan) and

contingency plan (contingency plan).
The formulation of business continuity plan policies meets among other things the following:
(1) involves various related functions;
(2) is flexible to be able to respond to various unexpected and specific disruption scenarios, i.e., description of certain conditions and actions that are needed immediately; (3) periodic testing and evaluation of the business continuity plan; and (4) the Board of Directors/Acting Board of Directors must update the business continuity plan regularly to ensure the effectiveness of the business continuity plan that has been prepared; i) the establishment of an internal control system in the implementation of Risk Management to ensure compliance with applicable external and internal regulations, effectiveness and efficiency of the Pension Fund's operational activities, effectiveness of Risk culture (risk culture) at each level of the Pension Fund's organization, as well as the availability of accurate, complete, useful, and timely management and financial information; and j) the development of pension benefits as well as asset and liability management which clearly elaborates on the determination of the nature of assets and liabilities, the role of asset and liability management activities, and the relationship between the development of business activities, valuation, and investment management.
7) Risk Management procedures must at least include:
a) clear process stages;

b) clear accountability and levels of delegation of authority c) periodic review of procedures at least 1 (one) time in 1 (one) year or more frequent frequency, depending on the type of Risk, needs, and development of the Pension Fund; and d) adequate documentation of procedures to facilitate review implementation and audit trail. d. Establishment of Risk Limits

The Pension Fund must have Risk limits that are appropriate
with the level of Risk to be taken (risk appetite), Risk tolerance (risk tolerance), and strategy of the Pension Fund as a whole by considering the Pension Fund's funding ability to absorb Risk exposure or losses that arise, past loss experience, HR ability, and compliance with applicable external regulations.
The establishment of Risk limits must at least include:
a) clear accountability and levels of delegation of authority b) periodic review of the establishment of Risk limits at least 1 (one) time in 1 (one) year or more frequent frequency, depending on the type of Risk, needs and development of the Pension Fund; and c) adequate documentation of the establishment of Risk limits to facilitate review implementation and audit trail.
The establishment of Risk limits is done comprehensively
over all aspects related to Risk, which includes overall Risk limits, limits per Risk, and limits per Pension Fund activity that has Risk exposure.
Risk limits must be understood by all relevant parties and communicated well, including
in the event of changes.
In the context of Risk control, Risk limits
are used as a threshold to determine the level of intensity of Risk mitigation to be implemented by management.
The Pension Fund must have an approval mechanism
in the event of exceeding Risk limits.
The magnitude of Risk limits is proposed by the business and
operational functions (risk taking function) concerned, which are then recommended by the Risk Management function to obtain approval from the Board of Directors/Acting Board of Directors or the Board of Supervisors through the Risk Management committee, or the Board of Directors/Acting Board of Directors according to their respective authorities as regulated in the internal policies of the Pension Fund.
C. Sufficiency of Risk Identification, Measurement, Control, and
Monitoring Processes, and Risk Management Information System

Identification, measurement, control, and monitoring
of Risk are the main part of the Risk Management implementation process. Risk identification is proactive, covering all Pension Fund activities and is conducted to analyze the sources and possible occurrence of Risks and their impact. Risk measurement is done according to the characteristics and complexity of business activities of the Pension Fund. The effectiveness of Risk Management implementation also needs to be supported by Risk control by considering the results of Risk measurement, including establishing Risk mitigation strategies. Subsequently, monitoring is conducted on the results of Risk measurement and control.
The Pension Fund establishes a function that is independent from the party
conducting transactions to monitor the level and trends and analyze the direction of Risk Management implementation.
In order to support the process of identification, measurement,
control, and monitoring of Risk, the Pension Fund also needs to develop a Risk Management information system that is adjusted to the characteristics and complexity of business activities of the Pension Fund.
Matters to be considered in the implementation of the process
of identification, measurement, control, and monitoring of Risk as well as the Risk Management information system include the following:
a. Risk Identification

The Pension Fund conducts periodic identification of all Risks,
including Risks inherent (inherent risk) in the business activities of the Pension Fund.
The Pension Fund has methods or systems for
performing Risk identification in all business activities of the Pension Fund.
The Risk identification process is conducted by
analyzing all Risk sources, at least conducted against Risks from the business activities of the Pension Fund and ensuring that Risks from the development of business activities have gone through a proper Risk Management process before being introduced or run. b. Risk Measurement
The Risk measurement system is used to
measure the Pension Fund's Risk exposure as a reference for conducting control. Risk measurement is conducted periodically for all business activities of the Pension Fund.
The system must at least be able to measure:
a) the sensitivity of the Pension Fund's business activities to changes in factors that affect them, both in normal and abnormal conditions; b) the tendency of changes in the aforementioned factors based on fluctuations that occurred in the past and their correlations; c) Risk factors individually; d) overall Risk exposure as well as per type of Risk, considering the interconnection between Risks; and e) all Risks inherent (inherent risk) in all business activities of the Pension Fund, including the development of business activities and can be integrated into the Pension Fund's management information system.
The selection of measurement methods is adjusted to the
characteristics and complexity of business activities of the Pension Fund.
Risk measurement methods can be conducted quantitatively and/or qualitatively. The measurement methods can be methods established by
the regulator in the context of Risk assessment and wealth calculation for funding as well as methods developed by the Pension Fund itself. Examples of simple qualitative methods include the use of checklists or subjective risk ratings such as low, medium-low, medium, medium-high, and high. Examples of quantitative methods include statistical methods such as Credit Scoring Tools, Value at Risk (VaR).
For Pension Funds that use alternative methods with models for internal purposes (internal model) in the measurement of Credit Risk,
Market Risk, and Operational Risk must at least consider:
a) Requirements for the use of internal models (internal model), at least including:
(1) the content and quality of data created or maintained must be in accordance with general standards that apply so that reliable statistical results are possible;

(2) availability of an information management system that enables the system to obtain appropriate and accurate data and information at the right time; (3) availability of documentation from the data sources used for the risk measurement process; and (4) the database and data storage process must be part of the system design to prevent the interruption of a series of statistical data; b) In the event that the Pension Fund conducts back testing against models for internal purposes (internal model) such as Credit Scoring Tools, Value at Risk (VaR), and stress testing for exposures containing certain Risks, the Pension Fund must use historical data or a series of parameters and assumptions compiled by the Pension Fund itself or assumptions requested by the regulator; c) In order to overcome weaknesses that may arise from the use of certain risk measurement models, the Pension Fund must validate those models which is carried out by an independent internal party relative to the function that applies the model; d) If necessary, validation is carried out or supplemented with the results of a review conducted by an external party who has competence and technical expertise in the development of risk measurement models. Model validation is a process:
(1) evaluation of the internal logic of a particular model by verifying mathematical accuracy; (2) comparing model predictions with

events after a certain date position (subsequent events); and (3) comparing one model with other existing models, both internal and external, if available; e) Validation must also be performed on new models, whether developed internally by the Pension Fund or provided by external parties. Models used by the Pension Fund must be evaluated periodically and ad hoc, especially in the event of significant changes in market conditions; and f) Risk measurement methods must be clearly understood by employees involved in risk control, among others the Risk Management Committee, the Risk Management function, and the Board/Acting Board members who oversee the Risk Management function.
6) The risk measurement system must be evaluated and improved periodically at least once every 6 (six) months or ad hoc when necessary to ensure the appropriateness of assumptions, accuracy, reasonableness and integrity of data, as well as the procedures used to measure Risk.
7) The risk measurement process must clearly contain the validation process, validation frequency, data and information documentation requirements, and evaluation requirements for the assumptions used, before a model is applied by the Pension Fund.
8) Stress testing is conducted to complement the risk measurement system by estimating potential losses of the Pension Fund under abnormal market conditions using specific scenarios to view the sensitivity of the Pension Fund's performance to changes in Risk factors and to identify impacts that significantly affect the

Pension Fund portfolio.
9) The Pension Fund needs to conduct periodic stress testing and evaluate the results of such stress testing and take appropriate steps if the estimated conditions to occur exceed the acceptable tolerance level. The results are used as input during the establishment or change of policies and limits.
10) The Pension Fund measures Risk based on its ability to assess its own Risks.
c. Risk Control

The Pension Fund must have a risk control system referring to established policies and procedures.
The risk control process implemented by the Pension Fund must be adjusted to the Risk exposure or the level of Risk to be taken (risk appetite) and Risk tolerance (risk tolerance).
Risk control can be carried out by the Pension Fund, among others through hedging mechanisms and other Risk mitigation methods to absorb potential losses.
Examples of Risk mitigation methods in Pension Funds can include steps for handling potential risks, for example by using the Accept, Control, Avoid, and Transfer (ACAT) method. Steps for handling potential risks that can be taken by the Pension Fund are as follows:
a) Accept, the Pension Fund decides to accept the Risk if the magnitude of impact and potential occurrence of Risk is still within the Risk tolerance (risk tolerance) set by the Pension Fund.

Example: Risks categorized as "low" and "relatively low" are decided to be accepted, or Risks categorized as "medium" and "relatively high" are decided to be accepted by taking other preventive steps, for example asking the Founder to bear additional funding. b) Control, the Pension Fund decides to reduce the impact or likelihood of occurrence of Risk. Example: formulating asset allocation strategy policies adjusted to liability maturity and formulating early warning indicators to monitor Risks with potentially significant impact. c) Avoid, the Pension Fund decides not to carry out an activity or choose alternative activities that produce the same output to avoid the occurrence of Risk. Example: investment placement policy on liquid asset investments. d) Transfer, the Pension Fund decides to transfer all or part of the responsibility for carrying out a process to a third party. Example: insuring buildings owned by the Pension Fund.
4) The Pension Fund must have a responsive framework to changes occurring due to the types of Risks present in the Pension Fund.
d. Risk Monitoring

Risks that have been identified, measured, and controlled by the Pension Fund can be monitored in the form of risk documentation (risk register).
Example of creating a risk register at minimum covering:

a) determination of all activities in the Pension Fund containing Risk that have been carried out in the Risk identification process; b) ranking of likelihood of occurrence and impact (inherent risk assessment) obtained from the results of Risk measurement; c) steps for handling potential risks (potential risk treatment), for example Accept, Control, Avoid, or Transfer (ACAT) used in the Risk control process; and d) ranking of likelihood of occurrence and impact after the Risk mitigation process.
2) The Pension Fund must have a monitoring system and procedure that among others covers monitoring of the magnitude of Risk exposure, Risk tolerance (risk tolerance), internal limit compliance, and the results of stress testing as well as consistency of implementation with established policies and procedures.
3) Monitoring is carried out by both business and operational functions (risk taking function) and the Risk Management function.
4) The results of monitoring are presented in periodic reports submitted to the Board/Acting Board members in the context of Risk mitigation and necessary actions.
e. Risk Management Information System

The Risk Management information system is part of the management information system that must be owned and developed according to the needs of the Pension Fund in the context of implementing effective Risk Management.
As part of the Risk Management process, the Pension Fund's Risk Management information system is used to support the implementation of the Risk identification, measurement, control, and monitoring processes.
The Risk Management information system must be able to

ensure:
a) the availability of accurate, complete, informative, timely, and reliable information so that it can be used by the Board/Acting Board members, Supervisory Board, Sharia Supervisory Board, and related functions in implementing Risk Management to assess, mitigate, and monitor the Risks faced by the Pension Fund, both overall Risk or per type of Risk or in the context of decision-making by the Board/Acting Board members; b) the effectiveness of Risk Management implementation covering policies, procedures, and the establishment of Risk limits; and c) the availability of information about the results or realization of Risk Management implementation compared to targets set by the Pension Fund in accordance with the policies and strategies for implementing Risk Management.
4) The Risk Management information system and the information generated must be adjusted to the characteristics and complexity of the Pension Fund and adaptive to changes.
5) The adequacy of the scope of information generated from the Risk Management information system must be reviewed periodically to ensure that the scope is adequate according to the development of the level of complexity of the Pension Fund's business activities.
6) As part of the Risk Management information system, the Risk profile report is prepared periodically by the independent Risk Management function relative to the business and operational functions (risk taking function) and internal control functions. The frequency of submission of reports to the Board/Acting
Board members concerned must be increased according to needs, especially when market conditions change rapidly.
7) The Risk Management information system must support the implementation of reporting to the Financial Services Authority.
8) In developing new information system technology and software, the Pension Fund must ensure that the implementation of new information systems and technologies will not disrupt the continuity of the Pension Fund's information system.
9) If the Pension Fund decides to assign outsourced workforce in the development of software and system improvement, the Pension Fund must ensure that the decision to appoint the third party is done objectively and independently. In outsourcing agreements or contracts, clauses regarding maintenance and updating as well as anticipatory steps to prevent disturbances that may occur in its operation must be included.
10) Before implementing a new management information system, the Pension Fund must conduct testing to ensure that the processes and outputs generated have gone through effective development, testing, and re-evaluation processes, and the Pension Fund must ensure that historical accounting and management data can be accessed by the new system or software properly.
11) The Pension Fund must account for and update system documentation, which contains hardware, software, databases, parameters, process stages, assumptions used, data sources, and outputs generated so as to facilitate embedded control and audit trail implementation.
12) The Pension Fund must prepare a backup system and effective procedures to prevent disturbances in the Risk monitoring process and conduct checks and re-evaluations periodically on the backup system.
D. Comprehensive Internal Control System

The process of implementing effective Risk Management must be equipped with a reliable internal control system. Effective implementation of the internal control system can help the Pension Fund in maintaining its assets, ensuring the availability of reliable financial and managerial reporting, increasing the Pension Fund's compliance with internal regulations and legislation, and reducing the Risk of loss, deviation, and violation of prudential aspects. The implementation of a reliable and effective internal control system of the Pension Fund becomes the responsibility of all business and operational functions (risk taking function) and supporting functions as well as internal audit functions.
Matters that need to be considered in the implementation of the internal control system include the following:
a. The Pension Fund implements the internal control system effectively in the implementation of the Pension Fund's Risk Management by referring to established policies and procedures. Example, the application of the principle of separation of duties (four eyes principle) that is adequate and consistent. b. The internal control system in the implementation of Risk Management at minimum covers:

conformity between the internal control system and the type and level of inherent Risk in the Pension Fund's business activities;
determination of authority and responsibility for monitoring compliance with Risk Management policies and procedures as well as the establishment of Risk limits;
determination of reporting lines and clear separation of duties from the business and operational functions (risk taking function) to the internal audit function;
organizational structure that clearly describes the tasks and responsibilities of each function and individual;
accurate and timely financial and operational activity reporting;
adequacy of procedures to ensure the Pension Fund's compliance with internal regulations and legislation;
effective, independent, and objective review of the Pension Fund's policies, frameworks, and operational procedures;
adequate testing and evaluation of the management information system;
complete and adequate documentation of the scope, operational procedures, audit findings, and responses from the Board/Acting Board members, Supervisory Board, and Sharia Supervisory Board based on audit results; and
verification and periodic and continuous review of the handling of material weaknesses of the Pension Fund and actions by the Board/Acting Board members to correct deviations that occur.
c. Implementation of review on the implementation of Risk Management at minimum as follows:
periodic review and evaluation at least once every 1 (one) year by the Risk Management function and internal audit function;
Frequency and intensity of review and evaluation can be increased based on the development of the Pension Fund's Risk exposure, changes in market conditions, measurement methods, and Risk management; and
Review by the internal audit function among others covers:
a) reliability of the Risk Management framework, which includes policies, organizational structure, resource allocation, design of Risk Management processes, information systems, and Risk reporting of the Pension Fund; and b) implementation of Risk Management by business and operational functions (risk taking function) or supporting functions, including review of the implementation of monitoring by the Risk Management function.
The results of the review assessment by the Risk Management function are submitted to the Supervisory Board, internal audit function, audit committee (if any), and relevant Board/Acting Board members as input in the context of improving the Risk Management framework and process.
Monitoring by the internal audit function regarding improvements over the results of internal and external audit findings. Audit findings that have not been followed up must be informed by the internal audit function to the Board/Acting Board members to take necessary steps.
The responsiveness level of the Pension Fund to weaknesses and deviations that occur regarding applicable internal and external regulations.
II. IMPLEMENTATION OF RISK MANAGEMENT FOR EACH TYPE OF RISK
A. Strategic Risk

Definition
a. Strategic Risk is Risk due to inaccuracies in the making and/or implementation of strategic decisions as well as failures in anticipating changes in the business environment. b. Strategic Risk can originate from among others:

setting strategies that are less aligned with the vision and mission of the Pension Fund;
conducting strategic environment analysis that is not comprehensive;
existence of inconsistencies in strategic plans across strategic levels; and
failure to anticipate changes in the business environment such as changes in technology, changes in macroeconomic conditions, competition in the market, and changes in relevant authority policies.

Objective
The main objective of Risk Management for Strategic Risk is to ensure that the Risk Management process can minimize the possibility of negative impacts from inaccurate strategic decision-making and failures in anticipating changes in the business environment.
Implementation of Risk Management
Implementation of Risk Management for Strategic Risk is adjusted to the size and complexity of the Pension Fund's business activities. Implementation of Risk Management for Strategic Risk at minimum covers:
a. Active Supervision by the Board/Acting Board Members, Supervisory Board, and Sharia Supervisory Board In the implementation of active supervision by the Board/Acting Board members, Supervisory Board, and Sharia Supervisory Board for Strategic Risk, in addition to carrying out active supervision as referred to in item I.A., in each aspect of active supervision, the Pension Fund must add the application of:

Authority and Responsibility
of the Board/Acting Board Members, Supervisory Board, and Sharia Supervisory Board

a) The Board/Acting Board members, Supervisory Board, and Sharia Supervisory Board must ensure that the implementation of Risk Management for Strategic Risk is carried out integrated with the implementation of Risk Management for other Risks that can impact the overall Risk profile of the Pension Fund. b) The Board/Acting Board members, Supervisory Board, and Sharia Supervisory Board must formulate and approve strategic plans and business plans in accordance with their respective duties and responsibilities, which cover matters as regulated in the provisions and communicate them to every level of organization within the Pension Fund. c) The Board/Acting Board members are responsible for the implementation of Risk Management for Strategic Risk which covers:
(1) ensuring that strategic objectives set are aligned with the vision and mission, culture, investment direction, and Risk tolerance (risk tolerance) of the Pension Fund; (2) providing clear guidance regarding the level of Risk to be taken (risk appetite) and Risk tolerance (risk tolerance) that can be accepted by the Pension Fund; (3) ensuring that the structure, culture, infrastructure, financial conditions, manpower and managerial competence including executive officials, as well as existing systems and controls in the Pension Fund are adequate to support the implementation of the established strategy; and (4) ensuring that every strategic problem that arises can be resolved effectively by the relevant work unit and monitoring of corrective actions by the strategic policy work unit. d) The Board/Acting Board members must monitor internal conditions (weaknesses and strengths of the Pension Fund) and developments of external factors/conditions that directly or indirectly affect the business activities of the Pension Fund. e) The Board/Acting Board members are responsible for ensuring that Risk Management for Strategic Risk has been implemented effectively and consistently across all related levels of organization. In the event that the Board/Acting Board members delegate some of their responsibilities to executive officials and management below them, such delegation does not eliminate the obligation of the Board/Acting Board members as the primary party responsible.
2) Human Resources (HR)
The Pension Fund ensures the adequacy of HR for Strategic Risk by referring to the provisions as referred to in item I.A.2.b.
3) Organizational Risk Management for Strategic Risk
a) All business and operational functions (risk taking function) and supporting functions in the Pension Fund are responsible for assisting the Board/Acting Board members in formulating strategic planning, and implementing strategies effectively. b) Business and operational functions (risk taking function) and other supporting functions are responsible for ensuring at minimum:

(1) Risk Management practices for Strategic Risk and controls in business and operational functions (risk taking function) are consistent with the overall Risk Management framework for Strategic Risk; and (2) business and operational functions (risk taking function) and other supporting functions have policies, procedures, and resources to support the effectiveness of the Risk Management framework for Strategic Risk. c) The Board/Acting Board members who oversee the Risk Management function lead the change programs necessary in the context of implementing the established strategy. d) The Risk Management function in the Risk Management process for Strategic Risk at minimum:
(1) coordinates with business and operational functions (risk taking function) in the process of formulating strategic plans; (2) monitors the development of strategic plan implementation, and provides input regarding opportunities and options available for the continuous development and improvement of strategy; and (3) ensures that all strategic issues and their impact on the achievement of strategic objectives are followed up promptly. b. Adequacy of Risk Management Policies and Procedures as well as Establishment of Risk Limits In ensuring the adequacy of Risk Management policies and procedures as well as the establishment of Risk limits for Strategic Risk, in addition to ensuring the adequacy of Risk Management policies and procedures as well as the establishment of Risk limits as referred to in item I.B., in each aspect thereof, the Pension Fund needs to add the application of:

Risk Management Strategy
a) In formulating strategy, the Pension Fund evaluates the position of the Pension Fund in the industry as a whole. In this regard, the Pension Fund needs to:
(1) understand the environmental, economic, and Pension Fund industry conditions where the Pension Fund conducts business activities, including how changes in the environment affect business activities, technology, and office networks; (2) measure the strengths and weaknesses of the Pension Fund related to competitive position, business position of the Pension Fund in the financial industry, financial performance, organizational structure and Risk Management, infrastructure for current and future business needs, managerial capability, as well as availability and limitations of Pension Fund resources; (3) understand the conditions of the Founder and Employer in the context of pension program funding (for DPPKs administering defined benefit pension programs); and (4) analyze all available strategy alternatives after considering strategic objectives as well as Risk tolerance (risk tolerance) of the Pension Fund. Depth and

the scope of analysis must align with the scale and complexity of the Pension Fund's business activities. b) Pension Funds must establish written strategic plans and business plans and implement them. c) Strategic plans and business plans must be evaluated and adjusted in the event of deviations from targets due to significant external and internal changes. d) In the event that a Pension Fund plans to implement long-term and sustainable strategies, the Pension Fund must have sufficient managerial succession plans to support the effective implementation of strategies sustainably. e) Pension Funds have sufficient funding support to implement strategic plans.
2) Risk Appetite and Risk Tolerance
The determination of Risk Appetite and Risk Tolerance for Strategic Risk refers to the provisions as referred to in item I.B.6.b.
3) Policies and Procedures
a) Pension Funds must have and implement policies and procedures to formulate and approve strategic plans. b) Pension Funds must have sufficient procedures to identify and respond to changes in the business environment. c) Pension Funds must have procedures to measure progress achieved from the realization of business plans and performance according to the established schedule.
4) Determination of Risk Limits
Strategic Risk limits generally relate to limitations on deviations from established strategic plans, such as budget deviation limits and target completion time deviation limits.
c. Adequacy of Risk Identification, Measurement, Control, and Monitoring Processes, as well as Risk Management Information Systems for Strategic Risk
In ensuring the adequacy of risk identification, measurement, control, and monitoring processes, as well as risk management information systems for Strategic Risk, in addition to meeting the provisions as referred to in item I.C., in each of these processes, Pension Funds must additionally apply:

Identification of Strategic Risk
a) Pension Funds must identify and account for deviations resulting from the non-realization or ineffectiveness of implemented business strategies or established business plans, particularly those significantly impacting the Pension Fund's business activities. b) Pension Funds must conduct risk analysis, particularly regarding strategies requiring many resources or high risk, such as investment placement strategies in new instruments, information technology development strategies for pension benefit payments, or marketing strategies to attract new Participants for DPLK.
Measurement of Strategic Risk
a) In measuring Strategic Risk, indicators/parameters may include:
(1) alignment of business strategy with business environment conditions; (2) the Pension Fund's strategic position in the Pension Fund industry for DPLK; and (3) achievement of business realization by the Pension Fund. b) Pension Funds may conduct stress testing on strategy implementation to identify any events or changes in the business environment that could negatively impact the fulfillment of initial assumptions of strategic plans and measure the potential negative impact of such events on the Pension Fund's business activities, both financially and non-financially. c) Stress testing results must provide feedback to the strategic planning process. d) In the event that stress testing results yield a higher Risk level than Risk Tolerance (risk tolerance) or the Pension Fund's ability to absorb Risk, the Pension Fund develops contingency plans or strategies to mitigate such Risk.
Control of Strategic Risk
a) Pension Funds must have systems and controls to monitor strategy implementation, business decision-making, and the Pension Fund's response to external changes to ensure that taken Risks remain within tolerance limits and to report significant deviations to the Board of Directors/Acting Board of Directors. Risk control systems must be approved and reviewed periodically by the Board of Directors/Acting Board of Directors to ensure their continuous suitability. b) Pension Funds must have good strategy formulation and determination processes and have good monitoring of the implementation of the Pension Fund's strategic plans to ensure conditions after strategy implementation regarding the Pension Fund's business activities.
Monitoring of Strategic Risk
a) Pension Funds must have processes to monitor and control strategy implementation periodically. Monitoring is conducted by, among others, considering past loss experiences caused by Strategic Risk or deviations in strategic plan implementation. b) Strategic issues arising from operational and business environment changes that negatively impact business activities or the Pension Fund's financial conditions are reported to the Board of Directors/Acting Board of Directors in a timely manner, accompanied by impact analysis on Strategic Risk and necessary corrective actions.
Risk Management Information Systems for Strategic Risk
a) Pension Funds must ensure that the management information systems owned are adequate to support the strategic planning and decision-making processes and are reviewed periodically. b) The Risk Management function is responsible for ensuring that all material Risks arising from changes in the business environment and strategy implementation are reported to the Board of Directors/Acting Board of Directors in a timely manner. d. Comprehensive Internal Control Systems The implementation of internal control systems for Strategic Risk refers to the provisions as referred to in item I.D. B. Operational Risk

Definition
a. Operational Risk is Risk resulting from the inadequacy and/or malfunction of internal processes, human error, system failures, and/or external events affecting the Pension Fund's operations. b. Operational Risk may originate from:

human resource weaknesses;
internal process weaknesses;
inadequate systems and infrastructure; and
external events adversely affecting the Pension Fund.
c. Operational Risk at DPPK implementing defined benefit pension programs also includes risks arising from insufficient liabilities caused by weaknesses in actuarial assumption setting processes and/or actuaries' inability to set actuarial assumptions appropriate to the conditions faced.
d. These Risk sources can cause events negatively impacting Pension Fund operations, so the emergence of Operational Risk events is one measure of the success or failure of Risk Management for Operational Risk. Some examples of Operational Risk events can be categorized as internal fraud, external fraud, physical asset damage, system failures, process and execution errors, including fraud arising from money laundering and terrorism financing activities.

Objective
The main objective of Risk Management for Operational Risk is to minimize the likelihood of negative impacts from the malfunction of internal processes, human error, system failures, including information systems used by Pension Funds, or events originating from outside the Pension Fund's environment.
Implementation of Risk Management
The implementation of Risk Management for Operational Risk is adjusted to the size and complexity of the Pension Fund's business activities. The implementation of Risk Management for Operational Risk must at least cover:
a. Active Oversight by the Board of Directors/Acting Board of Directors, Supervisory Council, and Sharia Supervisory Council In conducting active oversight by the Board of Directors/Acting Board of Directors, Supervisory Council, and Sharia Supervisory Council for Operational Risk, in addition to implementing active oversight as referred to in item I.A., in each aspect of active oversight, Pension Funds must additionally apply:

Authority and Responsibility of the Board of Directors/Acting Board of Directors, Supervisory Council, and Sharia Supervisory Council
a) The Board of Directors/Acting Board of Directors, Supervisory Council, and Sharia Supervisory Council must ensure that the implementation of Risk Management for Operational Risk is integrated with the implementation of Risk Management for other Risks that can impact the overall Risk profile of the Pension Fund. b) The Board of Directors/Acting Board of Directors, Supervisory Council, and Sharia Supervisory Council are responsible for developing a Risk Management culture for Operational Risk and fostering commitment to managing Operational Risk according to the Pension Fund's business strategy. c) The Board of Directors/Acting Board of Directors creates a culture of objective disclosure of Operational Risk across all organizational elements so that Operational Risk can be identified quickly and mitigated appropriately. d) The Board of Directors/Acting Board of Directors establishes effective reward policies, including remuneration and punishment, for Pension Fund employees, integrated into the performance evaluation system to support optimal Risk Management implementation. e) The Board of Directors/Acting Board of Directors must ensure that the exercise of authority and responsibility delegated to third-party service providers has been carried out well and responsibly. f) The Board of Directors/Acting Board of Directors ensures that the exercise of authority and responsibility required by pension fund legislation, such as actuarial valuation by DPPK implementing defined benefit pension programs by actuaries, is based on professional practice standards and pension fund legislation. g) The Supervisory Council ensures that the selection of third-party service providers under the Supervisory Council's responsibility, such as actuaries and public accountants, has been conducted in accordance with provisions regarding Pension Fund governance. h) Founders ensure that the Pension Fund's remuneration policies for the Board of Directors/Acting Board of Directors, Supervisory Council, and Sharia Supervisory Council are consistent with the Pension Fund's Risk Management strategy. i) The Supervisory Council ensures that the Pension Fund's remuneration policies for Pension Fund employees are consistent with the Pension Fund's Risk Management strategy. j) For DPLK, the Acting Board of Directors must be actively involved in marketing plan formulation.
Human Resources (HR)
a) Pension Funds must have codes of ethics applied to all employees at every organizational level. b) Pension Funds must consistently impose sanctions on employees proven to have committed deviations and violations. c) All Pension Fund employees are part of the implementation of Risk Management for Operational Risk.
Risk Management Organization for Operational Risk
a) Pension Fund business and operational management functions (risk taking function) or support functions are risk owners responsible for daily Risk Management processes for Operational Risk and reporting specific problems and Operational Risks in their functions according to reporting levels. b) To facilitate the Risk Management process for Operational Risk in business and operational functions (risk taking function) or support functions, and to ensure consistent implementation of Risk Management policies for Operational Risk, Pension Funds may appoint dedicated operational risk officers with dual reporting lines, namely directly to the heads of business and operational functions (risk taking function) or support functions, and to the Risk Management function. The responsibilities of dedicated operational risk officers include developing specific risk indicators for business and operational functions (risk taking function) or support functions, determining escalation boundaries, and preparing Risk Management reports for Operational Risk. b. Adequacy of Risk Management Policies and Procedures and Determination of Risk Limits In ensuring the adequacy of Risk Management policies and procedures and the determination of Risk Limits for Operational Risk, in addition to ensuring the adequacy of Risk Management policies and procedures and the determination of Risk Limits as referred to in item I.B., in each aspect, Pension Funds need to additionally apply:
Risk Management Strategy
Strategy formulation for Operational Risk refers to the provisions as referred to in item I.B.6.a.
Risk Appetite and Risk Tolerance
The determination of Risk Appetite and Risk Tolerance for Operational Risk refers to the provisions as referred to in item I.B.6.b.
Policies and Procedures
a) Pension Funds must establish Risk Management policies for Operational Risk that must be internalized into the business processes of all business activities and support activities of Pension Funds, including Operational Risk policies unique to the needs of business activities and support activities. b) Pension Funds must have procedures that are derivatives of Risk Management policies for Operational Risk. These procedures may include:
(1) general controls, namely general operational controls on all business activities and support activities of Pension Funds, such as function separation or mandatory leave requirements; and (2) specific controls, namely operational controls specific to each business activity and support activity of Pension Funds, such as participant document management, pensioner management, and parties entitled, or the process of exercising authority and responsibility delegated to third-party service providers. c) Pension Funds must have business continuity management, namely an integrated and comprehensive management process to ensure the continuity of Pension Fund operations. Some policies that can be implemented include formulating business impact analysis and recovery strategies executed by Pension Funds for each type of disruption that occurs. d) Pension Funds have early warning procedures to handle unexpected changes in information technology systems that increase the likelihood of Operational Risk. e) To mitigate Operational Risk arising from the complexity of internal processes, Pension Funds must have policies covering at least:
(1) controls to prevent Operational Risk, for both internal processes and those related to external parties; (2) transaction settlement procedures for internal processes, including ensuring the effectiveness of transaction settlement processes; (3) accounting execution procedures to ensure accurate accounting records, including the alignment of accounting methods used, accounting processes executed, and supporting document management; and (4) fraud prevention and settlement procedures. f) To reduce the likelihood of Operational Risk arising from HR, Pension Fund Risk Management policies must at least include policies:
(1) recruitment and placement according to organizational needs; (2) selection of third-party service providers; (3) effective rewards and punishments for Pension Fund employees; (4) competitive remuneration and incentive structures; (5) training and development; (6) periodic rotation; (7) career planning and succession policies; and (8) handling employment termination issues. g) To reduce the likelihood of Operational Risk arising from systems and infrastructure, Pension Fund Risk Management policies must at least be supported by procedures for accessing management information systems, accounting information systems, risk management systems, document room security, and data processing rooms. h) To reduce the likelihood of Operational Risk arising from external events, Pension Fund Risk Management policies must be supported, among others, by insurance protection for Pension Fund physical assets and backup systems. i) For DPLK, particularly for self-registration of participants, to reduce the likelihood of Operational Risk arising from the profiles of Participants, pensioners, entitled parties, and prospective Participants, pensioners, and entitled parties, Risk Management policies must include the DPLK's obligation to conduct Customer Due Diligence (CDD) or Enhanced Due Diligence (EDD) periodically and consistently according to Operational Risk exposure. The implementation of CDD/EDD refers to all requirements and guidelines as regulated in applicable provisions regarding anti-money laundering and terrorism financing prevention. CDD/EDD must be supported by effective internal control systems, particularly efforts to prevent DPLK against internal crimes (internal fraud).
Determination of Risk Limits
The determination of limits for Operational Risk refers to the provisions as referred to in item I.B.6.d.
c. Adequacy of Risk Identification, Measurement, Control, and Monitoring Processes, as well as Risk Management Information Systems for Operational Risk
In ensuring the adequacy of risk identification, measurement, control, and monitoring processes, as well as risk management information systems for Operational Risk, in addition to meeting the provisions as referred to in item I.C., in each of these processes, Pension Funds must additionally apply:
Identification of Operational Risk
a) Pension Funds must identify and measure parameters affecting Operational Risk exposure, including the frequency and impact of:
(1) system failures and errors;
(2) information technology system weaknesses;
(3) failures in relationships with Participants, pensioners, and entitled parties; (4) accounting calculation errors; (5) errors in setting actuarial assumptions; (6) delays and errors in benefit payment settlements; (7) fraud; (8) accounting manipulation; and/or (9) classification recording errors. b) Pension Funds develop a database regarding:
(1) types and impacts of losses caused by Operational Risk based on risk identification results, including loss data that may be predictable and difficult to predict; (2) violations of control systems; and (3) other operational issues that may cause losses in the future. c) Pension Funds consider various internal and external factors in identifying Operational Risk, including:
(1) Pension Fund organizational structure, Risk culture, HR management, organizational changes, and employee turnover; (2) design and implementation of systems and processes used; and (3) external environment, including social and political conditions.
Measurement of Operational Risk
a) In measuring Operational Risk, indicators/parameters may include:
(1) characteristics and complexity of Pension Fund activities; (2) HR; (3) infrastructure and information technology systems; (4) fraud risk; (5) disruptions to Pension Funds; and (6) use of third-party services. b) Pension Funds consider various internal and external factors in measuring Operational Risk. c) Methods that Pension Funds can use to measure Operational Risk include scorecards, risk mapping, and frequency matrices. d) For Pension Funds that have not yet developed special methods for measuring Operational Risk, the main source of Operational Risk information is internal audit findings related to Operational Risk.
Control of Operational Risk
a) Risk controls are conducted consistently according to Risk Appetite, identification results, and Operational Risk measurement. b) In implementing Operational Risk controls, Pension Funds may develop programs to mitigate Operational Risk, including securing information technology processes and outsourcing some operational activities of Pension Funds. c) In the event that Pension Funds develop information technology process security, Pension Funds must ensure the security level of electronic data processing. d) Pension Funds must have support systems, covering at least:
(1) early error identification;
(2) efficient, accurate, and timely processing and settlement of all transactions; and (3) confidentiality, truthfulness, and security of all transactions. e) Pension Funds must periodically review procedures, documentation, data processing systems, contingency plans, and other operational practices to reduce the likelihood of human error.
Monitoring of Operational Risk
a) Pension Funds must continuously monitor Operational Risk exposure and losses that may be caused by business activities conducted by Pension Funds, including by implementing internal control systems and providing periodic reports on losses caused by Operational Risk. b) Pension Funds must periodically review the causes of Operational Risk and the impact of losses.
Risk Management Information Systems for Operational Risk
a) Management information systems must be able to generate complete and accurate reports to detect and correct deviations in a timely manner. b) Pension Funds must have reporting mechanisms for Operational Risk that provide information according to Pension Fund needs, including the following:
(1) Operational Risk profiles and losses caused by Operational Risk; (2) results from various Operational Risk measurement methods and trends, as well as summaries of internal audit function findings; (3) status and effectiveness reports on the implementation of action plans for operational risk issues; (4) procedure deviation reports; (5) incident reports when finding practices by third-party service providers that do not comply with regulations

legislation in the field of Pension Funds;
(6) fraud incident reports, for example in the form of a whistleblowing system; and (7) recommendations from the Risk Management function regarding reviews conducted on the assessment of Operational Risk of Pension Funds. d. Comprehensive Internal Control System In implementing an internal control system for Operational Risk, in addition to applying internal controls as referred to in item I.D., Pension Funds must have a routine rotation system to avoid potential self-dealing, collusion, or concealment of documentation or transactions that are not normal.
C. Credit Risk

Definition
a. Credit Risk is the Risk arising from the failure of other parties to fulfill their obligations to the Pension Fund. This includes investment failure risks, including: Risk of Credit due to the concentration of investment placements (investment concentration risk), Risk of Credit due to counterparty failure (counterparty credit risk), and Risk of Credit due to settlement failure (settlement risk). b. Credit Risk is generally present in all Pension Fund activities whose performance depends on investment performance, counterparty performance, or issuer performance.
c. Investment concentration risk is the Risk arising from the concentration of fund placements to 1 (one) party or a group of parties, industry, sector, and/or specific geographic area that has the potential to cause significant losses that could threaten the continuity of the Pension Fund's business.
d. Risk of Credit due to counterparty failure (counterparty credit risk) arises from the failure of the counterparty to fulfill its obligations and arises from transaction types with specific characteristics, for example, transactions influenced by fair value or market value movements. e. Risk of Credit due to settlement failure (settlement risk) arises from the failure to deliver cash and/or financial instruments on the agreed settlement date from the sale and/or purchase of financial instruments.
Objectives
a. The main objective of Risk Management for Credit Risk is to ensure that Pension Fund investment management activities are not exposed to Credit Risk that could cause losses to the Pension Fund. b. For DPPK (Pension Fund Management Companies), Credit Risk exposure must be controlled to maintain the Pension Fund's condition in a fully funded state.
Implementation of Risk Management
The implementation of Risk Management for Credit Risk is adjusted to the size and complexity of the Pension Fund's business activities. The implementation of Risk Management for Credit Risk must at least include:
a. Active Supervision by the Board of Directors/Acting Board of Directors, Supervisory Board, and Sharia Supervisory Board In carrying out active supervision by the Board of Directors/Acting Board of Directors, Supervisory Board, and Sharia Supervisory Board for Credit Risk, in addition to carrying out active supervision as referred to in item I.A., the Pension Fund must add the application of the following in each aspect of active supervision:

Authority and Responsibilities of the Board of Directors/Acting Board of Directors, Supervisory Board, and Sharia Supervisory Board
a) The Board of Directors/Acting Board of Directors, Supervisory Board, and Sharia Supervisory Board must ensure that the implementation of Risk Management for Credit Risk is carried out in an integrated manner with the implementation of Risk Management for other Risks that can impact the overall Risk profile of the Pension Fund. b) The Board of Directors/Acting Board of Directors is responsible for ensuring that all fund management or investment activities are carried out in accordance with the Credit Risk strategy and policies approved by the Supervisory Board and investment guidelines established for DPPK, and are in accordance with applicable legislation. c) The Board of Directors in DPPK must prepare a fund management or investment plan for the implementation of Risk Management for Credit Risk. d) The Acting Board of Directors in DPLK (Pension Fund Administration Companies) ensures that Participants receive information regarding the possibility of Risk arising from investment choices or types of investments made by Participants through the Pension Fund. e) The Board of Directors/Acting Board of Directors must ensure that the implementation of Risk Management is carried out effectively in fund management or investment activities, for example by monitoring developments and problems in the Pension Fund's fund management or investment activities. f) The Supervisory Board and Sharia Supervisory Board, according to their respective authorities, monitor the implementation of fund management or investment by the Board of Directors/Acting Board of Directors to ensure compliance with applicable legislation.
Human Resources (HR)
Pension Funds must have adequate HR in the field of investment management or Risk Management. In addition, Pension Funds must have HR capable of developing relevant models for mitigating Credit Risk.
Risk Management Organization for Credit Risk
In the implementation of Risk Management for Credit Risk, Pension Funds must have a fund management or investment management function. If needed, Pension Funds may form a committee specifically handling fund management or investment. b. Adequacy of Risk Management Policies and Procedures and Establishment of Risk Limits In ensuring the adequacy of Risk Management policies and procedures and the establishment of Risk limits for Credit Risk, in addition to ensuring the adequacy of Risk Management policies and procedures and the establishment of Risk limits as referred to in item I.B., the Pension Fund needs to add the application of the following in each aspect:
Risk Management Strategy
a) The Risk Management Strategy for Credit Risk must include strategies for all activities with significant Credit Risk exposure. b) The Risk Management Strategy for Credit Risk must align with the Pension Fund's objectives to maintain Pension Fund growth and the quality of funding for DPPK.
Risk Appetite and Risk Tolerance
a) Risk Appetite must reflect the Pension Fund's perspective on Credit Risk, such as investment style, investment diversification, and funding quality. b) Risk Tolerance for Credit Risk must reflect the Pension Fund's efforts to achieve its goals and be consistent with the established Risk Appetite, such as limits on the percentage of Pension Fund asset portfolios, percentage of securities to be placed, and limits on expected investment return targets. For example, the established rating limit is investment grade.
Policies and Procedures
a) In implementing Risk Management for Credit Risk for all Pension Fund fund management or investment activities, a framework for healthy fund management or investment must be established, including policies and procedures for controlling Credit Concentration Risk. b) Risk Management Policies for Credit Risk are reflected in related policies regarding fund management or investment, put in writing, containing the nature, role, and level of fund management or investment activities, and policies to comply with applicable legislation. c) Risk Management Policies for Credit Risk must be in accordance with the investment guidelines established by the Founder for DPPK organizing defined benefit pension programs or by the Founder and Supervisory Board for DPPK organizing defined contribution pension programs. d) Pension Funds must develop and apply policies and procedures accurately so that they can support:
(1) healthy fund management activities or activities; and (2) monitoring and control of Credit Risk. e) Pension Funds must have early warning procedures to handle unexpected and significant changes in Credit Risk in fund management or investment activities. f) Pension Funds must account for, document, and update all quantitative and qualitative information and material evidence in fund management or investment archives.
Establishment of Risk Limits
a) Pension Funds must establish limits for all activities related to fund management or investment activities containing Credit Risk. b) Pension Funds must establish Risk Limits for Credit Risk. c) The establishment of Credit Risk limits must be documented in writing and completely to facilitate audit trail setting for internal and external auditors.
c. Adequacy of Risk Identification, Measurement, Control, and Monitoring Processes, and Risk Management Information Systems for Credit Risk
In ensuring the adequacy of risk identification, measurement, control, and monitoring processes, and Risk Management information systems for Credit Risk, in addition to meeting the provisions as referred to in item I.C., the Pension Fund must add the application of the following in each process:
Credit Risk Identification
a) The system for identifying Credit Risk must be able to provide adequate information, including regarding the composition of the investment portfolio. b) In identifying Credit Risk, factors that can affect the level of Credit Risk in the future must be considered, such as the possibility of changes in economic and political conditions and the assessment of Credit Risk exposure in stressed conditions. c) In identifying Credit Risk with Credit Risk exposure due to counterparty failure (counterparty credit risk), the credibility of the counterparty and other factors impacting the counterparty's ability to fulfill its obligations must be considered.
Credit Risk Measurement
a) In measuring Credit Risk, indicators/parameters can be used, including:
(1) portfolio composition and level of investment concentration; (2) investments in affiliated parties; (3) default risk (wanprestasi); and (4) external factors. b) Measurement tools must be able to measure Credit Risk exposure quantitatively. This measurement must be monitored periodically according to the Pension Fund's needs. Examples of Credit Risk measurement tools include using statistical methodologies, such as credit scoring tools. c) Pension Funds must conduct stress testing routinely to support Credit Risk measurement analysis. d) Pension Funds that develop and use internal rating systems in Credit Risk management must adjust to the characteristics, size, and complexity of the Pension Fund's business activities. e) Pension Funds using measurement techniques with an internal rating approach must update data periodically. f) Basic principles in the use of internal ratings are:
(1) the procedure for using the internal rating system must be formalized and documented; (2) the internal rating system must be able to identify early changes in the Risk profile caused by potential or actual decreases in Credit Risk; (3) the internal rating system must be evaluated periodically by the Risk Management function; and (4) the results of the internal rating system must be reported periodically to the Board of Directors/Acting Board of Directors. g) Pension Funds must document assumptions, data, and other information used in Credit Risk measurement, including changes thereto, as well as data and information updates carried out periodically.
Credit Risk Control
a) Pension Funds must ensure that the fund management or investment function and other functions related to fund management or investment activities function adequately and that Credit Risk exposure is kept consistent with established limits and meets prudential standards. b) Credit Risk control can be done in several ways, including Risk mitigation, active portfolio position and Risk management, setting concentration Risk targets in the Pension Fund's investment plan, setting authority levels in the investment management approval process, and periodic concentration analysis at least once (1) in one (1) year. c) Pension Funds must have an effective system to detect problematic investments or other problematic transactions. Each strategy and result of handling problematic investments or other problematic transactions must be accounted for, which is subsequently used as input for the fund management or investment function.
Credit Risk Monitoring
In monitoring Credit Risk exposure, the Risk Management function must prepare reports on the development of Credit Risk periodically or as needed, including the causes thereof, and submit them to the Risk Management Committee and the Board of Directors/Acting Board of Directors.
Risk Management Information System for Credit Risk
The information system owned must be able to accommodate Credit Risk mitigation strategies through various methods or policies, for example, limit setting and hedging. d. Comprehensive Internal Control System In implementing an internal control system for Credit Risk, in addition to applying internal controls as referred to in item I.D., Pension Funds must also apply:
an independent and continuous review system regarding the effectiveness of the implementation of Risk Management for Credit Risk;
for Pension Funds with Credit Risk exposure due to counterparty failure (counterparty credit risk), an independent and continuous review system regarding the effectiveness of the implementation of Risk Management for Credit Risk due to counterparty failure (counterparty credit risk) must at least contain an evaluation of the Risk measurement model approval process and validation of significant changes in the Credit Risk measurement process due to counterparty failure (counterparty credit risk); and
an efficient and effective reporting system to provide adequate information, including information regarding significant Credit Risk exposure, to the Board of Directors/Acting Board of Directors, Supervisory Board, Sharia Supervisory Board, and Founder.
D. Market Risk

Definition
a. Market Risk is the Risk on asset and liability positions, due to overall changes in market conditions. b. Market Risk includes Interest Rate Risk, Exchange Rate Risk, and Equity Risk.
c. The implementation of Risk Management for Equity Risk is applied by Pension Funds that consolidate with subsidiaries.
Objectives
The main objective of Risk Management for Market Risk is to minimize the possibility of negative impacts due to changes in market conditions on Pension Fund assets and funding.
Implementation of Risk Management
The implementation of Risk Management for Market Risk is adjusted to the size and complexity of the Pension Fund's business activities. The implementation of Risk Management for Market Risk must at least include:
a. Active Supervision by the Board of Directors/Acting Board of Directors, Supervisory Board, and Sharia Supervisory Board In carrying out active supervision by the Board of Directors/Acting Board of Directors, Supervisory Board, and Sharia Supervisory Board for Market Risk, in addition to carrying out active supervision as referred to in item I.A., the Pension Fund must add the application of the following in each aspect of active supervision:

Authority and Responsibilities of the Board of Directors/Acting Board of Directors, Supervisory Board, and Sharia Supervisory Board
a) The Board of Directors/Acting Board of Directors, Supervisory Board, and Sharia Supervisory Board must ensure that the implementation of Risk Management for Market Risk is carried out in an integrated manner with the implementation of Risk Management for other Risks that can impact the overall Risk profile of the Pension Fund. b) The Board of Directors/Acting Board of Directors must ensure clarity of authority and responsibility for Market Risk management, adequacy of systems to measure Market Risk, adequate structure of limits for Risk taking, effective internal controls, and comprehensive, periodic, and timely reporting systems.
Human Resources (HR)
Pension Funds ensure the adequacy of HR for Market Risk by referring to the provisions as referred to in item I.A.2.b.
Risk Management Organization for Market Risk
Pension Funds ensure the adequacy of the Risk Management organization for Market Risk by referring to the provisions as referred to in item I.A.2.c. b. Adequacy of Risk Management Policies and Procedures and Establishment of Risk Limits In ensuring the adequacy of Risk Management policies and procedures and the establishment of Risk limits for Market Risk, in addition to implementing Risk Management policies and procedures and the establishment of Risk limits as referred to in item I.B., the Pension Fund needs to add the application of the following in each aspect:
Risk Management Strategy
In implementing Risk Management Strategy for Market Risk, Pension Funds must consider the Pension Fund's market conditions, including the financial industry as a whole, Participant categories for DPLK, and the composition of instruments or investment packages for DPLK.
Risk Appetite and Risk Tolerance
The establishment of Risk Appetite and Risk Tolerance for Market Risk refers to the provisions as referred to in item I.B.6.b.
Policies and Procedures
a) Pension Funds must have policies and processes for setting the difference between reference interest rates and market interest rates in specific transactions, considering overall financial conditions and prudential principles. b) Pension Funds must have policies to address market price changes for assets owned by the Pension Fund. These policies must consider the Pension Fund's asset and liability positions in both the short term and long term. c) Pension Funds must have adequate investment valuation procedures to address changes in market conditions.
Establishment of Risk Limits
a) Pension Funds must ensure consistency in establishing limits for various types of instruments with Market Risk exposure. b) Pension Funds may establish limits based on the grouping of instrument types with similar characteristics.
c. Adequacy of Risk Identification, Measurement, Control, and Monitoring Processes, and Risk Management Information Systems for Market Risk
In ensuring the adequacy of risk identification, measurement, control, and monitoring processes, and Risk Management information systems for Market Risk, in addition to meeting the provisions as referred to in item I.C., the Pension Fund must add the application of the following in each process:
Market Risk Identification
Pension Funds must have a risk identification process adjusted to the Market Risk inherent in fund management or investment activities, including Interest Rate Risk, Exchange Rate Risk, and Equity Risk.
Market Risk Measurement
a) In measuring Market Risk, indicators/parameters can be used, including:
(1) allocation and/or investment portfolio;
(2) investment objectives and strategies;
(3) investment portfolio volatility;
(4) ease of investment portfolio transactions; and (5) investment valuation. b) Pension Funds must have a Market Risk measurement system or model to measure positions and sensitivities related to Market Risk in both normal and stressed conditions. c) Pension Funds must conduct quantitative measurement of Market Risk. Some examples of measurement methods that can be used include sensitivity analysis, earnings at risk, value at risk, and economic value of equity; d) Pension Funds must be able to measure potential profits or losses periodically for fund management or investment activities with Market Risk exposure. e) Pension Funds must document every assumption, data, and information used in Market Risk measurement. f) Pension Funds must understand the weaknesses of the methods used, and calculate and mitigate the impact of the weaknesses of those methods. g) Pension Funds must review Market Risk measurement models, including conducting back testing and refinement if necessary.
Market Risk Control
a) Pension Funds must take Risk control measures, including preventing the occurrence of greater Market Risk losses. b) Pension Funds holding securities must periodically review the condition, credibility, and repayment ability of the issuer of the securities. This review must be documented and carried out at least every 6 (six) months. c) In the event that Pension Funds hold securities listed or traded in the capital market and based on the review results there is a possibility of increased failure of the security issuer, Pension Funds must carry out controls, for example, by closely monitoring the credit spread of the securities and taking necessary actions to reduce losses, for example, by forming provisions.
Market Risk Monitoring
Pension Funds must monitor limit compliance periodically and follow up to address limit breaches. This reporting is submitted to interested parties according to the Pension Fund's internal policies.
Risk Management Information System for Market Risk
a) The Risk Management information system for Market Risk must at least be able to quantitatively measure Risk exposure and monitor changes in market factors (interest rates, exchange rates, and equity prices) on a real-time basis. b) In the event that the Pension Fund's fund management or investment instruments are very varied, the Risk Management information system for Market Risk must be able to be used to estimate

potential losses in the future for each of those instruments. c) The Risk Management Information System for Market Risk must be able to facilitate stress testing, especially to identify Risks quickly, so that corrective actions can be taken immediately, including as a response to changes in market factors that may have a negative impact on the health level of the Pension Fund. d. Comprehensive Internal Control System In implementing an internal control system for Market Risk, in addition to applying internal controls as referred to in item I.D., the Pension Fund must also apply:

The Pension Fund must have an adequate internal control system to ensure that transactions and processes related to market risk taking are conducted with reference to the policies, procedures, and limits established;
the application of segregation of duties must be adequate and implemented consistently so that there are no conflicts of interest; and
The Pension Fund may have a function that performs the valuation of trading positions and conducts validation of Market Risk measurement models. This function must be independent of the business and operational functions (risk taking function).

E. Liquidity Risk

Definition
a. Liquidity Risk is the Risk arising from the Pension Fund's inability to meet maturing liabilities from cash flow funding sources, and/or from liquid assets that can be easily converted into cash, without disrupting the activities and financial condition of the Pension Fund.

b. Liquidity Risk can be caused by the Pension Fund's inability to liquidate assets without incurring a material discount due to the absence of an active market or severe market disruption, which is called market liquidity risk.
c. Liquidity Risk in DPPKs that administer defined benefit pension programs also includes Risks arising from the DPPK's inability to provide assets to fund liabilities due to insufficient contribution setting.
2. Objective
The main objective of Risk Management for Liquidity Risk is to minimize the possibility of the Pension Fund's inability to meet its obligations to Participants, retirees, and entitled parties.
3. Implementation of Risk Management
The implementation of Risk Management for Liquidity Risk is adjusted to the size and complexity of the Pension Fund's business activities. The implementation of Risk Management for Liquidity Risk must at least cover:
a. Active Supervision by the Board of Directors/Acting Board of Directors, Supervisory Board, and Sharia Supervisory Board In carrying out active supervision by the Board of Directors/Acting Board of Directors, Supervisory Board, and Sharia Supervisory Board for Liquidity Risk, in addition to carrying out active supervision as referred to in item I.A., in each aspect of active supervision, the Pension Fund must add the application of:

Authority and Responsibility of the Board of Directors/Acting Board of Directors, Supervisory Board, and Sharia Supervisory Board
a) The Board of Directors/Acting Board of Directors, Supervisory Board, and Sharia Supervisory Board must ensure that the implementation of Risk Management for Liquidity Risk is carried out in an integrated manner with the implementation of Risk Management for other Risks that can impact the Pension Fund's overall Risk profile. b) In DPPKs, the Board of Directors and Supervisory Board must ensure that contributions submitted by the Founder are deposited on time and in the correct amount. c) The Board of Directors/Acting Board of Directors must periodically monitor the position and Liquidity Risk in both normal situations and unfavorable market situations. d) The Board of Directors/Acting Board of Directors must ensure that the Pension Fund does not experience difficulties in meeting its obligations to Participants, retirees, and entitled parties. e) The Board of Directors/Acting Board of Directors must adjust the policies and strategies for Risk Management for Liquidity Risk based on the results of evaluations of the position and Liquidity Risk. f) The Board of Directors/Acting Board of Directors must submit reports to the Supervisory Board and the Founder (in DPPKs) regarding the position and Liquidity Risk profile, as well as the implementation of policies and procedures for Risk Management for Liquidity Risk.
Human Resources (HR)
The Board of Directors/Acting Board of Directors must ensure that every function responsible for Risk management has HR with adequate competence.
Risk Management Organization for Liquidity Risk
The Pension Fund ensures the adequacy of the Risk Management organization for Liquidity Risk with reference to the provisions as referred to in item I.A.2.c. b. Adequacy of Risk Management Policies and Procedures and Risk Limit Setting In ensuring the adequacy of Risk Management policies and procedures and risk limit setting for Liquidity Risk, in addition to ensuring the adequacy of Risk Management policies and procedures and risk limit setting as referred to in item I.B., in each of those aspects, the Pension Fund needs to add the application of:
Risk Management Strategy
The Pension Fund must have a Risk Management Strategy for Liquidity Risk that implements Assets and Liabilities Management (ALMA).
Risk Appetite and Risk Tolerance
a) The Risk Appetite is reflected in the asset composition or wealth for funding and the Pension Fund's obligations, as well as the gapping strategy carried out by the Pension Fund. b) Risk Tolerance for Liquidity Risk must consider every factor that affects Liquidity Risk exposure, such as the composition of liquid assets and funding conducted by the Founder.
Policies and Procedures
a) Liquidity management policies and procedures must at least include:
(1) asset and liability composition;
(2) the level of liquid assets that the Pension Fund must maintain;

(3) the determination of the type and allocation of assets classified as high-quality liquid assets; (4) stability of funding sources; (5) liquidity management on various funding sources, including the Founder and counterparties; (6) the application of life cycle funds for Pension Funds that administer defined contribution pension programs; and (7) Liquidity Risk limits. b) The Pension Fund must establish indicators that serve as early warning indicators for Liquidity Risk as a tool for identifying problems and determining Liquidity Risk mitigation. c) Early warning indicators include internal and external indicators. Internal indicators include, among others, deteriorating asset quality, increased concentration in certain assets, increased overall costs, and/or worsening cash flow positions as a result of large maturity mismatches, especially in the short-term time scale. External indicators include, among others, negative information from Participants, retirees, and entitled parties regarding the Pension Fund. d) The Pension Fund must conduct stress testing for Liquidity Risk, adjusted to the fund management or investment strategy, so that it can accurately describe the Pension Fund's Liquidity Risk profile. e) DPPKs that administer defined benefit pension programs must be able to explain to the Founder in the event of a funding shortage that results in the Founder's obligation to deposit additional contributions to the Pension Fund to maintain the Pension Fund's funding condition.
4) Risk Limit Setting
a) Liquidity Risk limits must be consistent and relevant to the Pension Fund's business activities. In addition, Liquidity Risk limits must also be adjusted to the Pension Fund's condition, including the number of Participants who will retire, solvency liability positions, and/or actuarial present value. b) Liquidity Risk limits may include, among others, cash flow mismatch limits in both the short and long term, including concentration limits on assets and liabilities, and other liquidity ratios.
c. Adequacy of Risk Identification, Measurement, Control, and Monitoring Processes, and Risk Management Information Systems for Liquidity Risk
In ensuring the adequacy of risk identification, measurement, control, and monitoring processes, as well as risk management information systems for Liquidity Risk, in addition to meeting the provisions as referred to in item I.C., in each of those processes, the Pension Fund must add the application of:

Liquidity Risk Identification
a) In order to identify Liquidity Risk, the Pension Fund must conduct an analysis of all sources of Liquidity Risk, such as all Pension Fund activities that affect asset and liability positions. b) The Pension Fund must consider the possibility of increased Liquidity Risk due to increased other Risks, such as Credit Risk, Market Risk, and Operational Risk.
Liquidity Risk Measurement
a) In measuring Liquidity Risk, among others, indicators/parameters can be used in the form of:
(1) current asset and current liability profiles; (2) cash flow profiles; (3) long-term asset profiles; (4) long-term liability profiles; (5) comparison between long-term assets and long-term liabilities; and (6) the difference between expected investment performance and achieved investment performance. b) The Pension Fund must have a measurement tool that can measure Liquidity Risk quantitatively, accurately, and comprehensively. This measurement tool must also be able to measure Liquidity Risk arising from assets and liabilities. c) The measurement tool must at least include:
(1) current asset or liability profiles, which must at least include minimum liquidity ratios, current asset ratios, and current liability ratios; and (2) cash flow profiles, namely cash inflows from investment, operational, and funding activities compared with cash outflows from investment, operational, and funding activities. d) The approach taken in Liquidity Risk measurement can be simulation-based and more dynamic, supported by various relevant assumptions. e) The Pension Fund must conduct stress testing on Liquidity Risk, namely testing the Pension Fund's ability to meet liquidity needs under specific stress conditions for the Pension Fund or stress conditions in the market.
Liquidity Risk Control
a) Liquidity Risk control is carried out through funding strategies, periodic control of liquidity positions and Liquidity Risk, management of high-quality liquid assets, and funding plans through additional contributions for DPPKs that administer defined benefit pension programs. b) Active management of liquidity positions and periodic Liquidity Risk aims to meet the Pension Fund's obligations on time, for example, when Participants retire, the Pension Fund is able to meet its obligations, both in normal conditions and crisis conditions, by prioritizing its solvency liabilities. c) The Pension Fund must analyze changes in liquidity positions resulting from pension benefit payments to retirees and entitled parties. This analysis is conducted, among others, based on cash flow projections prepared periodically. d) The Pension Fund must have high-quality liquid assets in sufficient quantities and compositions adjusted to the Liquidity Risk profile in order to meet liquidity needs in both the short and long term. e) In the event that Liquidity Risk exposure for DPPKs that administer defined benefit pension programs causes funding quality to decline, the Pension Fund must coordinate with the Founder for a funding fulfillment plan through additional contributions.
Liquidity Risk Monitoring
a) Liquidity Risk monitoring conducted must consider early warning indicators to know the potential increase in the Pension Fund's Liquidity Risk. b) Monitoring of Liquidity Risk is carried out periodically by considering the application of ALMA. c) The Pension Fund must always maintain its liquidity level in order to meet the obligation to pay pension benefits and other benefits to Participants, retirees, and entitled parties.
Risk Management Information System for Liquidity Risk
a) The Pension Fund must have an adequate and reliable Risk Management information system to support the implementation of identification, measurement, control, and monitoring processes, as well as reporting of Liquidity Risk exposure in normal and crisis conditions, completely, accurately, currently, wholly, and continuously. b) The Risk Management information system must be able to provide information related to Liquidity Risk, including:
(1) cash flows and maturity profiles of assets and liabilities; (2) compliance with limits and ratios used to measure Liquidity Risk; (3) liquidity trends; and (4) other related information, such as positions and valuations of high-quality liquid asset portfolios, concentration of investment placements, or solvency liability positions and actuarial present value for DPPKs that administer defined benefit pension programs. d. Comprehensive Internal Control System In implementing an internal control system for Liquidity Risk, in addition to applying internal controls as referred to in item I.D., the Pension Fund must also apply:
The Pension Fund must apply adequate internal controls and independent reviews on the implementation of Risk Management for Liquidity Risk carried out by internal audit together with the Risk Management function.
Weaknesses identified in internal controls and independent reviews must be reported to relevant parties for follow-up.

F. Legal Risk

Definition
a. Legal Risk is a Risk arising from legal claims and/or weaknesses in legal aspects. b. Legal Risk can originate, among others, from the absence and/or changes in legislation or weaknesses in agreements, such as the non-fulfillment of contract validity requirements and litigation processes arising from third-party lawsuits against the Pension Fund or the Pension Fund against third parties.
Objective
The main objective of Risk Management for Legal Risk is to ensure that the Risk Management process can minimize the possibility of negative impacts from the absence or changes in legislation, weaknesses in agreements or cooperation, and litigation processes.
Implementation of Risk Management
The implementation of Risk Management for Legal Risk is adjusted to the size and complexity of the Pension Fund's business activities. The implementation of Risk Management for Legal Risk must at least cover:
a. Active Supervision by the Board of Directors/Acting Board of Directors, Supervisory Board, and Sharia Supervisory Board In carrying out active supervision by the Board of Directors/Acting Board of Directors, Supervisory Board, and Sharia Supervisory Board for Legal Risk, in addition to carrying out active supervision as referred to in item I.A., in each aspect of active supervision, the Pension Fund must add the application of:

Authority and Responsibility of the Board of Directors/Acting Board of Directors, Supervisory Board, and Sharia Supervisory Board
a) The Board of Directors/Acting Board of Directors, Supervisory Board, and Sharia Supervisory Board must ensure that the implementation of Risk Management for Legal Risk is carried out in an integrated manner with the implementation of Risk Management for other Risks that can impact the Pension Fund's overall Risk profile. b) The Board of Directors/Acting Board of Directors must establish effective communication mechanisms, including involving Pension Fund employees, regarding legal problems faced with relevant functions so that Legal Risk can be prevented and controlled immediately. c) The Board of Directors/Acting Board of Directors, Supervisory Board, and Sharia Supervisory Board must apply legal governance, namely a governance system to form, execute, and interpret provisions of legislation and internal provisions, including standard agreements used. d) The Board of Directors/Acting Board of Directors must ensure legal consistency in all its business activities, namely the alignment between business activities carried out and provisions, and not causing ambiguity in agreements made by the Pension Fund. e) The Board of Directors/Acting Board of Directors must ensure legal completeness, so that all matters regulated by national and international provisions can be well implemented by the Pension Fund, including prohibitions in provisions, which are clearly regulated in the Pension Fund's internal provisions.
Human Resources (HR)
The Pension Fund must consistently apply sanctions to Pension Fund employees who are proven to have deviated from and violated provisions, both external and internal provisions, as well as the Pension Fund's internal code of ethics.
Risk Management Organization for Legal Risk
a) The Pension Fund must have a function that acts as a legal watch or a function that oversees the legal field, providing analysis or legal advice to all employees at every level of the organization. This must also be supported by HR with knowledge in the legal field related to the Pension Fund. b) The Risk Management function, business and operational functions (risk taking function), and the function overseeing the legal field must jointly assess the impact of changes in certain provisions on Legal Risk exposure. c) The Risk Management function must conduct an analysis of Legal Risk exposure when the Pension Fund develops or expands its business activities. b. Adequacy of Risk Management Policies and Procedures and Risk Limit Setting In ensuring the adequacy of Risk Management policies and procedures and risk limit setting for Legal Risk, in addition to ensuring the adequacy of Risk Management policies and procedures and risk limit setting as referred to in item I.B., in each of those aspects, the Pension Fund needs to add the application of:
Risk Management Strategy
The Risk Management Strategy for Legal Risk is an inseparable part of the Pension Fund's Risk Management Strategy as referred to in item I.B.6.a.
Risk Appetite and Risk Tolerance
The determination of Risk Appetite and Risk Tolerance for Legal Risk refers to the provisions as referred to in item I.B.6.b.
Policies and Procedures
a) The Pension Fund must have and carry out an analysis of legal aspects regarding the development or expansion of the Pension Fund's business activities. b) The Pension Fund must periodically evaluate and update policies and procedures for Legal Risk control, in accordance with external and internal developments of the Pension Fund, such as changes in provisions.
Risk Limit Setting
The determination of limits for Legal Risk refers to the provisions as referred to in item I.B.6.d.

c. Adequacy of Risk Identification, Measurement, Control, and Monitoring Processes, and Risk Management Information Systems for Legal Risk
In ensuring the adequacy of risk identification, measurement, control, and monitoring processes, as well as risk management information systems for Legal Risk, in addition to meeting the provisions as referred to in item I.C., in each of those processes, the Pension Fund must add the application of:

Legal Risk Identification
The implementation of identification for Legal Risk refers to the provisions as referred to in item I.C.4.a.
Legal Risk Measurement
a) The Pension Fund must have adequate and integrated Risk measurement methods for Legal Risk with the Pension Fund's Risk Management framework, using both quantitative and qualitative approaches. b) In measuring Legal Risk, among others, indicators/parameters can be used in the form of:
(1) absence or changes in legislation;
(2) weaknesses in legal aspects (legal issues); and (3) litigation or dispute resolution.
Legal Risk Control
The function overseeing the legal field must periodically review contracts and agreements between the Pension Fund and other parties, among others by re-evaluating the effectiveness of the enforceability process to check the validity of rights in the contracts and agreements.
Legal Risk Monitoring
The implementation of monitoring for Legal Risk refers to the provisions as referred to in item I.C.4.d.
Risk Management Information System for Legal Risk
The Pension Fund must document and administer every incident, including litigation processes related to Legal Risk, along with the amount of potential losses caused by such incidents, in a data administration system. d. Comprehensive Internal Control System The implementation of an internal control system for Legal Risk refers to the provisions as referred to in item I.D.

G. Compliance Risk

Definition
a. Compliance Risk is the Risk arising from the Pension Fund's failure to comply with and/or implement applicable legislation and provisions for the Pension Fund. b. Compliance Risk can originate, among others, from:

legal behavior, namely the behavior or activities of the Pension Fund that deviate from or violate provisions of legislation and Pension Fund Regulations; and
organizational behavior, namely the behavior or activities of the Pension Fund that deviate from or contradict generally applicable standards.

Objective
The main objective of Risk Management for Compliance Risk is to ensure that the Risk Management process can minimize the possibility of negative impacts from the Pension Fund's behavior that deviates from or violates generally applicable standards, provisions, or legislation.
Implementation of Risk Management
The implementation of Risk Management for Compliance Risk is adjusted to the size and complexity of the Pension Fund's business activities. The implementation of Risk Management for Compliance Risk must at least cover:
a. Active Supervision by the Board of Directors/Acting Board of Directors, Supervisory Board, and Sharia Supervisory Board In carrying out active supervision by the Board of Directors/Acting Board of Directors, Supervisory Board, and Sharia Supervisory Board for Compliance Risk, in addition to carrying out active supervision as referred to in item I.A., in each aspect of active supervision, the Pension Fund must add the application of:

Authority and Responsibility of the Board of Directors/Acting Board of Directors, Supervisory Board, and Sharia Supervisory Board
a) The Board of Directors/Acting Board of Directors, Supervisory Board, and Sharia Supervisory Board must ensure that the implementation of Risk Management for Compliance Risk is carried out in an integrated manner with the implementation of Risk Management for other Risks that can impact the Pension Fund's overall Risk profile. b) The Board of Directors/Acting Board of Directors, Supervisory Board, and Sharia Supervisory Board must ensure that every compliance problem that arises can be resolved effectively by the relevant work unit and that monitoring of corrective actions is carried out by the compliance function. c) The Board of Directors/Acting Board of Directors, Supervisory Board, and Sharia Supervisory Board [all policies, provisions, systems, and procedures, as well as business activities carried out by the Pension Fund...]

Pension funds must comply with applicable legislation.

Human Resources (HR)
Employees assigned to the compliance function must not be placed in positions vulnerable to conflicts of interest in carrying out compliance function responsibilities.
Risk Management Organization for Compliance Risk
Pension Funds must have a compliance function as regulated in the Financial Services Authority Regulation regarding Pension Fund Governance. This function must support the implementation of Risk Management for Compliance Risk.

b. Adequacy of Risk Management Policies and Procedures and Risk Limit Setting In ensuring the adequacy of Risk Management policies and procedures and the setting of Risk limits for Compliance Risk, in addition to ensuring the adequacy of Risk Management policies and procedures and the setting of Risk limits as referred to in item I.B., in each aspect, Pension Funds must add the implementation of:

Risk Management Strategy
The formulation of strategies for Compliance Risk refers to the provisions as referred to in item I.B.6.a.
Risk Appetite and Risk Tolerance
On principle, Pension Funds must meet the applicable laws and regulations. This causes Pension Funds to have zero tolerance for Compliance Risk and to take quick and precise steps in handling Risks.
Policies and Procedures
a) Pension Funds must have an adequate compliance work plan. b) Pension Funds must ensure the effectiveness of the implementation of Risk Management for Compliance Risk, particularly the formulation of policies and procedures to be in accordance with generally accepted standards, regulations, and legislation.
Risk Limit Setting
The setting of limits for Compliance Risk refers to the provisions as referred to in item I.B.6.d.

c. Adequacy of Risk Identification, Measurement, Control, and Monitoring Processes, and Risk Management Information Systems for Compliance Risk
In ensuring the adequacy of risk identification, measurement, control, and monitoring processes, and risk management information systems for Compliance Risk, in addition to meeting the provisions as referred to in item I.C., in each process, Pension Funds must add the implementation of:

Compliance Risk Identification
Pension Funds must conduct identification and analysis of factors that can increase Compliance Risk exposure, including:
a) the type and complexity of the Pension Fund's business activities, including the development or expansion of business activities; and b) the number and materiality of the Pension Fund's non-compliance with internal policies and procedures, regulations or legislation, and healthy business ethics practices and standards.
Compliance Risk Measurement
In measuring Compliance Risk, indicators/parameters such as the following can be used:
a) the type and significance of violations committed; b) the frequency of violations committed and the Pension Fund's non-compliance track record; c) the behavior underlying the violations; and d) follow-up on violations.
Compliance Risk Control
The implementation of controls for Compliance Risk refers to the provisions as referred to in item I.C.4.c.
Compliance Risk Monitoring
The Risk Management function or compliance function must monitor and report Compliance Risks that occur to the Board of Trustees/Acting Board of Trustees both ad hoc at the time of the Compliance Risk occurrence and periodically.
Risk Management Information System for Compliance Risk
The implementation of the management information system for Compliance Risk refers to the provisions as referred to in item I.C.4.e.

d. Comprehensive Internal Control System
In the implementation of internal controls for Compliance Risk, in addition to implementing internal controls as referred to in item I.D., Pension Funds must have an internal control system for Compliance Risk, including to ensure the Pension Fund's responsiveness level to deviations from generally accepted standards, regulations, or legislation.

H. Reputational Risk

Definition
a. Reputational Risk is the Risk resulting from a decrease in the level of trust of stakeholders stemming from negative perceptions of the Pension Fund. b. Reputational Risk can stem from, among others, negative media coverage and/or rumors regarding the Pension Fund, as well as the Pension Fund's ineffective communication strategy.
Objective
The main objective of Risk Management for Reputational Risk is to anticipate and minimize the impact of losses due to the Pension Fund's Reputational Risk.
Implementation of Risk Management
The implementation of Risk Management for Reputational Risk is adjusted to the size and complexity of the Pension Fund's business activities. The implementation of Risk Management for Reputational Risk must at least cover:

a. Active Supervision by the Board of Trustees/Acting Board of Trustees, Board of Supervisors, and Sharia Supervisory Board In the implementation of active supervision by the Board of Trustees/Acting Board of Trustees, Board of Supervisors, and Sharia Supervisory Board for Reputational Risk, in addition to carrying out active supervision as referred to in item I.A., in each aspect of active supervision, the Pension Fund must add the implementation of:

Authority and Responsibility
Board of Trustees/Acting Board of Trustees, Board of Supervisors, and Sharia Supervisory Board a) The Board of Trustees/Acting Board of Trustees, Board of Supervisors, and Sharia Supervisory Board must ensure that the implementation of Risk Management for Reputational Risk is carried out in an integrated manner with the implementation of Risk Management for other Risks that can impact the Pension Fund's overall Risk profile. b) The Board of Trustees/Acting Board of Trustees, Board of Supervisors, and Sharia Supervisory Board must pay attention to the implementation of Risk Management for Reputational Risk by relevant functions in the Pension Fund, particularly functions related to interaction with external parties. c) The Board of Trustees/Acting Board of Trustees, Board of Supervisors, and Sharia Supervisory Board must behave professionally and maintain business ethics so as to serve as an example for all elements of the Pension Fund organization in efforts to build and maintain reputation. d) Pension Funds must establish information flow channels to Participants, retirees, entitled parties, and other external parties regarding the Pension Fund's business activities to control Reputational Risk.
Human Resources (HR)
Pension Funds need to provide centralized services to handle questions, suggestions, or complaints from Participants, retirees, and entitled parties, for example, in the form of a call center service.
Risk Management Organization for Reputational Risk
All employees, including business and operational management (risk-taking function) and supporting functions of the Pension Fund, must be part of the implementation structure of Risk Management for Reputational Risk.

b. Adequacy of Risk Management Policies and Procedures and Risk Limit Setting In ensuring the adequacy of Risk Management policies and procedures and the setting of Risk limits for Reputational Risk, in addition to ensuring the adequacy of Risk Management policies and procedures and the setting of Risk limits as referred to in item I.B., in each aspect, the Pension Fund must add the implementation of:

Risk Management Strategy
The Risk Management Strategy for Reputational Risk is an inseparable part of the Pension Fund's Risk Management Strategy as referred to in item I.B.6.a.
Risk Appetite and Risk Tolerance
The setting of Risk Appetite and Risk Tolerance for Reputational Risk refers to the provisions as referred to in item I.B.6.b.
Policies and Procedures
a) Pension Funds must have written policies and procedures that meet the principle of transparency in the implementation of good governance. These policies must also align with regulations or legislation governing consumer protection. b) Pension Funds must have and implement appropriate communication policies to face negative news or publications or prevent information that tends to be counterproductive, including by applying effective media usage strategies to face negative news.
Risk Limit Setting
Reputational Risk limits are generally not limits that can be quantified financially. Examples of Reputational Risk limits include the time limit for following up on complaints from Participants, retirees, and entitled parties.

c. Adequacy of Risk Identification, Measurement, Control, and Monitoring Processes, and Risk Management Information Systems for Reputational Risk
In ensuring the adequacy of risk identification, measurement, control, and monitoring processes, and risk management information systems for Reputational Risk, in addition to meeting the provisions as referred to in item I.C., in each process, the Pension Fund must add the implementation of:

Reputational Risk Identification
Pension Funds can use several information sources to identify Reputational Risk, including mass media coverage, social network analysis results, Participant complaints through call center services, or Participant satisfaction questionnaires.
Reputational Risk Measurement
In measuring Reputational Risk, indicators/parameters such as the following can be used:
a) the reputational influence of the Founder and/or related companies; b) business ethics violations; c) product complexity (for DPLK); and d) the frequency and materiality of complaints or reports from Participants, including legal issues.
Reputational Risk Control
a) Pension Funds must immediately follow up on and address complaints from Participants, retirees, and entitled parties, including if there are legal lawsuits that can increase Reputational Risk exposure. b) Pension Funds must develop reliable mechanisms to carry out effective Reputational Risk control actions, such as providing information whenever there are changes in Pension Fund regulations to Participants, retirees, and entitled parties. c) Reputational Risk control actions are also followed by improvements to control weaknesses and procedures that trigger Reputational Risk.
Reputational Risk Monitoring
The implementation of monitoring for Reputational Risk refers to the provisions as referred to in item I.C.4.d.
Risk Management Information System for Reputational Risk
Pension Funds must have an early warning system mechanism to provide signals to the Board of Trustees/Acting Board of Trustees, so that follow-up and mitigation can be carried out as needed.

d. Comprehensive Internal Control System
The implementation of the internal control system for Reputational Risk refers to the provisions as referred to in item I.D.

III. RISK PROFILE ASSESSMENT
The Risk Profile is one of the results of the Risk Management information system. Pension Funds conduct Risk assessments on all Pension Fund business activities, both main business activities and other activities, covering 8 (eight) Risks, namely Strategic Risk, Operational Risk, Credit Risk, Market Risk,

This copy is in accordance with the original
Legal Director 1
Legal Department signed
Mufli Asmawidjaja
Liquidity Risk, Legal Risk, Compliance Risk, and Reputational Risk.
Risk assessments are conducted by Pension Funds based on a comprehensive and structured analysis of:

Inherent risks in the Pension Fund's business activities; and
the quality of Risk Management implementation, which reflects the assessment of the adequacy of the Risk control system.
Based on the Risk assessment, a Risk profile is generated containing the Risk level for each Risk and the overall Pension Fund Risk profile rating. The assessment mechanism refers to the Financial Services Authority Regulation regarding the assessment of the health level of non-bank financial service institutions.

Determined in Jakarta on December 30, 2020
EXECUTIVE HEAD OF INSURANCE, PENSION FUND,
FINANCING INSTITUTION, AND
OTHER FINANCIAL SERVICE INSTITUTION SUPERVISOR FINANCIAL SERVICES AUTHORITY REPUBLIC OF INDONESIA, signed RISWINANDI

APPENDIX II
CIRCULAR LETTER OF THE FINANCIAL SERVICES AUTHORITY REPUBLIC OF INDONESIA NUMBER 28 /SEOJK.05/2020 REGARDING IMPLEMENTATION OF RISK MANAGEMENT FOR PENSION FUNDS

PENSION FUND RISK MANAGEMENT ORGANIZATIONAL STRUCTURE

I. General Guidelines
A. The Risk Management organizational structure is adjusted to the size and complexity of the Pension Fund's business.
B. The Risk Management organizational structure also considers relevant and inherent Risks in each Pension Fund business activity.
C. The Risk Management organizational structure must still follow good Pension Fund governance practices as regulated in the Financial Services Authority Regulation regarding Pension Fund Governance.

II. Risk Management Committee Organizational Structure
A. Risk Management Committee Membership

The Risk Management Committee is non-structural, where its members are part of the structure existing within the Pension Fund.
Risk Management Committee members can be permanent and non-permanent. Permanent members are the Board of Trustees/Acting Board of Trustees and executive officials appointed to exercise authority and responsibilities permanently for a certain period, such as the Board of Trustees/Acting Board of Trustees overseeing the compliance or Risk Management function, or executive officials overseeing the Risk Management function, while non-permanent members are the Board of Trustees/Acting Board of Trustees and executive officials related to topics discussed and recommended in the Risk Management Committee, such as the Board of Trustees/Acting Board of Trustees overseeing the investment function and the head of the investment division for topics on investment management and placement.
The Risk Management Committee must consist of at least:
a. half of the Board of Trustees/Acting Board of Trustees members, namely 50% (fifty percent) of the total number of Board of Trustees/Acting Board of Trustees members. For example, if the number of Board of Trustees/Acting Board of Trustees members is 4 (four), then half is 2 (two) Board of Trustees/Acting Board of Trustees members, whereas if the number of Board of Trustees/Acting Board of Trustees members is 3 (three), then half is 2 (two) Board of Trustees/Acting Board of Trustees members; and b. relevant executive officials, namely executive officials from the Pension Fund related to Risks present in the Pension Fund's business activities.

B. Authority and Responsibility of the Risk Management Committee The authority and responsibility of the Risk Management Committee is to provide recommendations to the Chairman of the Board of Trustees/Acting Board of Trustees regarding Risk Management, which must at least include:

formulating policies, strategies, and guidelines for Risk Management implementation, including Risk Appetite and Risk Tolerance, Risk Management framework, and contingency plans to anticipate abnormal conditions;
making improvements or adjustments to Risk Management implementation based on the results of Risk Management implementation evaluations, including refining the Risk Management process periodically or incidentally as a result of changes in external and internal conditions of the Pension Fund that affect funding adequacy, the Pension Fund's Risk profile, and the ineffectiveness of Risk Management implementation based on evaluation results; and
determining matters related to business decisions that deviate from normal procedures, such as exceeding the significant investment placement amount compared to the Pension Fund's previously established business plan, or taking positions or Risk exposures that exceed established limits.

III. Risk Management Function Organizational Structure
A. Organizational Structure

The organizational structure of the Risk Management function is adjusted to the size and complexity of the Pension Fund's business.
The Risk Management function as referred to in number 1 can be carried out by officials/employees specifically assigned to carry out the Risk Management function or by a work unit that specifically carries out the Risk Management function.

B. Independence of the Risk Management Function

The Risk Management function must be independent from business and operational functions and from internal control functions to create 3 (three) lines of defense in the Pension Fund for Risk management (3 lines of defense).
The implementation of Risk Management with the principle of 3 (three) lines of defense in the Pension Fund for Risk management (3 lines of defense), namely:
a. First Line of Defense (1st lines of defense), namely business and operational functions (risk-taking function); b. Second Line of Defense (2nd lines of defense), namely Risk Management function (risk management function); and
c. Third Line of Defense (3rd lines of defense), namely internal control functions implemented by the internal audit function (internal audit function).
The authority and responsibility of each function as referred to in number 2 are described as follows:
a. Business and Operational Function (Risk-Taking Function) The business and operational function (risk-taking function) is the frontline of the Pension Fund in Risk Management implementation, having authority and responsibility including:

reporting inherent Risk exposure present in each business and operational unit to the Risk Management function periodically;
ensuring a conducive Risk control environment in each business and operational unit;
implementing established Risk Management policies in carrying out business and operational activities; and
carrying out recommendations from the Risk Management function for Risk control in each business and operational unit.

b. Risk Management Function
The Risk Management function (risk management function) has the following authority and responsibility:

identifying Risks, including inherent Risks in the Pension Fund's business activities;
formulating Risk measurement methods appropriate to the size and complexity of the Pension Fund's business, including designing and implementing devices needed for Risk Management implementation;
monitoring the implementation of Risk Management strategies formulated by the Board of Trustees/Acting Board of Trustees, including monitoring Risk Management strategies in business and operational functions;
monitoring overall (composite) Risk positions, per Risk type, and per functional activity type against Risk Tolerance and established limits, and conducting:
(1) testing using scenario/assumptions of abnormal conditions (stress testing), to know the impact of implementing Risk Management policies and strategies on the Pension Fund's overall performance; and (2) testing using historical data (back testing), to know how accurate the Risk measurement method is based on historical data owned by the Pension Fund against established Risk Management policies and strategies;
periodically reviewing the Risk Management process, including:
(1) developing devices needed for Risk Management implementation, from the risk identification, measurement, monitoring, and control processes; (2) ensuring the adequacy of the Risk Management framework; (3) ensuring the accuracy of Risk assessment methods; and (4) ensuring the adequacy of the Risk Management information system.
reviewing proposals for the development or expansion of the Pension Fund's business activities, focusing on the Pension Fund's ability to develop or expand business activities and its impact on the Pension Fund's overall Risk exposure;
evaluating the accuracy of models and validity of data used to measure Risks, for Pension Funds using models for internal purposes (internal models) for Risk measurement;
providing recommendations to:
(1) business and operational functions (risk-taking function), including in determining the Risk exposure limits acceptable to the Pension Fund; and/or (2) the Risk Management Committee, including in formulating policies, strategies, and Risk Management frameworks, according to the authority possessed; and
formulating and submitting Risk profile reports to the Chairman of the Board of Trustees/Acting Board of Trustees or the Board of Trustees/Acting Board of Trustees member overseeing the Risk Management function and the Risk Management Committee periodically, where the report frequency can be increased if market conditions change rapidly.

c. Internal Audit Function
The internal audit function in Risk Management implementation has authority and responsibility including:

evaluating the compliance of all levels of the Pension Fund organization with established Risk Management policies and procedures;
evaluating the effectiveness of Risk Management implementation in accordance with Risk Management strategies and policies; and
evaluating the effectiveness of Risk culture in the Pension Fund as a whole.

IV. Relationship between Business and Operational Functions and Risk Management Functions
A. Information Submission

The business and operational function (risk-taking function) as the first line of defense (1st lines of defense) in the Pension Fund for Risk management must inform inherent Risk exposure to the Risk Management function periodically.
The frequency of submitting inherent Risk exposure information is adjusted to the characteristics of the Risk type. If inherent Risks in the business and operational function (risk-taking function) are faced daily, information submission to the Risk Management function can be done more intensively.

B. Examples of Inter-Function Relationships in the Risk Management Organizational Structure

Format 1
The Risk Management function at the Pension Fund Administration Unit (DPPK) is in another work unit, but the Risk Management function reports directly to the Chairman of the Board. The focus of Risk Management implementation in the current year is related to funding, so the members of the Risk Management Committee are the Chairman of the Board, the head of the work unit overseeing the Risk Management function, the head of the internal audit work unit, and the head of the work unit overseeing the funding function.
Format 2
The Risk Management function at the DPPK is in a separate work unit and reports directly to the Board member overseeing the compliance or Risk Management function. The focus of Risk Management implementation in the current year is related to membership and investment, so the members of the Risk Management Committee are the Chairman of the Board, the Board member overseeing the Risk Management function, the head of the Risk Management work unit, the head of the internal audit work unit, the head of the work unit overseeing

membership functions, and the head of the unit managing investment functions.

Format 3
The Risk Management function in Sharia Pension Funds (DPPK) resides in another separate unit, but the Risk Management function reports directly to the Board Chairman. The focus of Risk Management implementation in the current year relates to membership, so the members of its Risk Management Committee are the Board Chairman, the head of the unit managing the Risk Management function, the head of the unit managing the membership function, and the head of the internal audit unit.
Format 4
The Risk Management function in Pension Fund Managers (DPLK) is combined with the Risk Management unit existing within the Founder. The Founder must ensure that the implementation of Risk Management in the combined DPLK complies with regulations regarding the implementation of Risk Management for Pension Funds. The focus of Risk Management implementation in the current year relates to membership, so the members of its Risk Management Committee are the Acting Board Chairman, the head of the unit managing the membership function, the head of the unit or representative from the Risk Management unit within the Founder, and the head of the internal audit unit.
Other Formats
Pension Funds may develop organizational structures according to the size and complexity of the Pension Fund's operations. The more complex and/or the larger the size of a Pension Fund, the more complete the organizational structure, particularly in the Risk Management organizational structure, such as the formation of special units handling the Risk Management function.

This copy matches the original
Legal Director 1
Legal Department signed
Mufli Asmawidjaja

Established in Jakarta on December 30, 2020
EXECUTIVE HEAD OF THE SUPERVISOR OF
INSURANCE, PENSION FUNDS,
FINANCING INSTITUTIONS, AND
OTHER FINANCIAL SERVICE INSTITUTIONS
FINANCIAL SERVICES AUTHORITY
REPUBLIC OF INDONESIA, signed
RISWINANDI

Implementation of Risk Management for Pension Funds

Lineage: In force

Similar documents from other regulators