RISK MANAGEMENT

Effective risk management is a key success factor for realizing our strategic objectives. ASMI has implemented an internal risk management and control framework to identify risks and opportunities that may impact us and to take appropriate mitigation initiatives.

CORPORATE GOVERNANCE FRAMEWORK

ASMI's risk management and control framework is based on the COSO reference model and is an integral part of our Corporate Governance Framework. The Corporate Governance Framework describes how ASMI's strategy, mission, vision, and objectives are embedded across the organization.

Our Code of Ethics sets clear standards in different areas of business life. Its purpose is to provide a clear, strong, and consistent culture of ethics that apply to all who work at ASMI. ASMI's policies and regulatory framework guide how we work. Key components are our financial, IT, product safety, EHS, compliance, and business continuity frameworks which are supported by transparency and accountability through our monthly business review cycle and our internal control framework.

The objective of the risk management and control framework is to identify and manage the strategic, operational, financial, and compliance risks to which ASMI is exposed. In addition, the framework enables us to improve effectiveness and efficiency in our operations and it promotes reliable financial reporting, and compliance with laws and regulations.

Our risk management and internal control activities are organized through the three lines of defense model; the Management Board is ultimately responsible for risk management and compliance in line with the risk appetite and is supported by:

• First line of defense: Business and operations management owns and manages risk, which includes identifying, assessing, controlling, and mitigating risks;
• Second line of defense: Oversight functions support business and operations management and help ensure that the risk and control procedures are operating as intended; and
• Third line of defense: Internal Audit provides independent objective assurance on the effectiveness of governance, risk management, and internal controls, including the manner in which business and operations management and the oversight functions manage and control risk. Internal Audit brings a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control and governance processes.

RISK CULTURE

ASMI strives for a culture of openness and transparency in which identified risks are disclosed proactively and unexpected events are reported as soon as they occur. We aim to continually increase risk awareness and to make it an integral part of the company culture. Our Code of Ethics applies to all ASMI employees and temporary staff and describes how we work in an open, transparent, honest, and socially responsible way. The effectiveness of, and compliance with, the Code is enabled through annual online training and assessed by actively detecting and investigating any alleged misconduct and taking appropriate disciplinary action if misconduct is substantiated.

RISK APPETITE

Undertaking business activity inevitably leads to taking risks. Each type of risk encountered is dealt with in a manner that matches the risk appetite established by the Management Board. Risk appetite is the level of risk we deem acceptable to achieve our objectives. ASMI’s risk appetite is primarily determined based on the defined and agreed strategy and the individual objectives within this strategy. Risk appetite is further guided by our Code of Ethics as well as detailed policies and procedures. The risk appetite is the total residual impact of the risks that ASMI is willing to accept in the pursuit of its (strategic) objectives. The risk appetite per objective or risk area is determined annually by the Management Board. Overall, ASMI's risk appetite in 2018 did not change significantly compared to 2017.

The nature of the risk is a key determinant of our risk appetite:

RISK MANAGEMENT APPROACH

Every year we assess the risks that could impact achievement of our strategic objectives at a consolidated level (top-down approach) and on a segment level (bottom-up approach). If necessary, we implement countermeasures to mitigate the risks within the defined risk appetite, and integrate these countermeasures in our risk management and control framework, which contains all mandatory corporate policies and operating procedures.

Business management provides the Management Board with a quarterly assurance letter regarding the reliability of their financial reporting, the effectiveness of their internal controls, risk management, and compliance with internal policies and laws and regulations.

CONTROL EFFECTIVENESS STATEMENT

The Management Board is responsible for ASMI’s internal risk management and control framework. This system is designed to manage the main risks that may prevent ASMI from achieving its objectives. The internal risk management and control framework, and the evaluation of the effectiveness of our internal controls and areas for improvement, are regularly discussed with the Audit Committee and KPMG Accountants, our external auditor. The Audit Committee reports on these matters to the Supervisory Board.

The Management Board conducted an assessment of the design and operating effectiveness of the internal risk management and control framework. Based on this assessment and the current state of affairs, to the best of its knowledge and belief, the Management Board confirms that:

• the internal risk management and control framework provides reasonable assurance for the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with Generally Accepted Accounting Principles;
• the management report includes a fair review of the development and performance of the business, and the position of the company and the undertakings, included in the consolidation as a whole, as well as a description of the principal risks and uncertainties that the company faces;
• there are no material risks or uncertainties that could reasonably be expected to have a material adverse effect on the continuity of ASMI's operations in the coming twelve months; and
• there is a reasonable expectation that ASMI will be able to continue its operations and meet its liabilities for at least twelve months, therefore it is appropriate to adopt the going concern basis in preparing the financial reporting.

All internal control systems, no matter how well designed and implemented, have inherent limitations. Even systems determined to be effective may not prevent or detect misstatements or fraud, and can only provide reasonable assurance with respect to disclosure and financial statement presentation and reporting. Additionally, projections of any evaluation of effectiveness to future periods are subject to the risk that controls may become inadequate due to changed conditions and that the degree of compliance with the policies or procedures may deteriorate.

In view of all of the above, the Management Board believes that it complies with the requirements of best practice provision 1.2 and 1.4 of the Dutch Corporate Governance Code.