Risk Management remains a key driver of managing a healthcare institution. At Nawaloka Hospitals, we have embedded a proactive and structured approach to identifying, evaluating, and mitigating risks across all facets of our operations. This approach extends to risks arising from our dynamic operating environment, evolving healthcare practices, and rapid advancements in medical technology. This cohesive approach enables us to ensure continuity of care, safeguard patient trust, and uphold our responsibility to deliver excellence in healthcare.

The Nawaloka Risk Management Framework

Our risk management framework integrates a structured and comprehensive approach to identifying, assessing, mitigating, and controlling risks that may arise from both routine operations and unforeseen developments, beyond our control. As such, we effectively address risks across the organisation in a consistent manner, underpinned by robust oversight and clear accountability.

In addition, the framework is aligned with internationally recognised standards. Further, it integrates the regulatory expectations of the Sri Lanka Medical Council (SLMC), the Private Health Services Regulatory Council (PHSRC), and the Central Environmental Authority (CEA). Through this holistic approach, the Nawaloka Risk Management Framework reinforces our commitment to patient safety, operational resilience, and institutional integrity.

Risk Governance at Nawaloka

We recognise that robust risk governance is essential to embedding cohesive and adaptive risk management practices across our operations. Accountability for the effectiveness and adequacy of the Group's risk management framework rests with the Board of Directors, underscoring our commitment to governance at the highest level. The Audit Committee and the Risk Management Committee assist the Board of Directors to provide structured oversight, independent review, and strategic guidance to ensure that risk management remains both rigorous and responsive to the evolving healthcare landscape.

The Audit Committee carries retains oversight and responsibility for matters relating to risk and internal controls, while the Risk Management Committee is entrusted with ensuring the effective execution of risk management processes across the organisation. The Risk Management Committee meets on a monthly basis to present regular reports to the Board, outlining the key risks identified, evaluated, and addressed.

This structured top-down approach to governance has enabled Nawaloka to embed risk considerations into every aspect of our operations. Over the years, it has fostered a culture of heightened risk awareness, accountability, and control across the organisation, reinforcing both operational resilience and institutional integrity.

Risk Governance

Risk Management Committee

Our Risk Management Committee consists of members from the Board of Directors and other working officers to ensure that all risks applicable to a healthcare operator are considered on a timely basis.

Collectively, the Risk Management Committee is responsible for:

• Ensuring the comprehensive risk management framework.
• Putting in place risk measurement, monitoring, and management processes.
• Compliance with regulatory and internal prudential requirements.

Risk Assurance

To ensure risk assurance, Nawaloka Hospitals takes a Three Lines of Defence Approach. This approach ensures accountability while distinguishing responsibility between owning and managing risks, overseeing risks, and providing independent assurance.

With this Three Lines of Defence Approach, embedding risk management processes into our day-to-day operations becomes more streamlined and ensures that the Group is better equipped to identify events impacting our risk appetite and improve risk control measures to support strategic imperatives.