Page 53 - ar2013

Corporate Governance
& Sustainability
first greenfield development
project, Westgate. Westgate has
commenced its mall operations
on 2 December 2013 and
Westgate Tower is expected
to obtain temporary occupation
permit by end-2014.
The development of new projects
usually takes a few years to
complete, depending on the
project size and its complexity.
In the event that the projects
cannot be completed within
the anticipated time frame and
budget, these may have a material
adverse effect on CMT Group’s
business, financial position, results
of operations and prospects. In
addition, significant pre-operating
costs incurred may not be recovered
within the expected period or at all.
The Manager mitigates such risk
through continual monitoring and
regular reviews on the progress of
these projects. The Manager has
established standard operating
procedures (SOPs) to guide project
management personnel and ensure
that all required applications are
submitted for the authorities’
approvals. These SOPs are subject
to a series of continuity and
consistency reviews by the Manager
and an independent ISO 9001
qualified auditor. In addition, the
Manager has set up a framework
for evaluating and pre-qualifying
contractors and service providers
that would be invited for project-
related tenders.
Information Technology
Security Risk
Information technology (IT)
security risk consists of loss of data,
inaccuracy of data, unavailability of
systems and damage to systems.
To mitigate IT security risk, the
Manager has established an IT
governance framework consisting
of IT security/management policies,
procedures and controls. These
policies, procedures and controls
are periodically reviewed and
benchmarked for effectiveness.
One of the benchmarks is the
ISO/IEC 20000, which is the first
international standard for IT service
management. The Manager is happy
to report that its leasing system and
shopper loyalty system are ISO/IEC
20000 certified. The Manager also
engages the services of external
experts to complement its internal
IT security controls, such as periodic
network penetration tests and
websites vulnerability scanning.
51