Enterprise Risk Management Policy
Comprehensive risk governance framework aligned with ISO 31000 and COSO principles, establishing three lines of defense, systemic risk appetite, and threat mitigation across TopLogical Nigeria Limited.
1. Purpose & Scope
This Enterprise Risk Management (ERM) Policy establishes the formal principles, operational mandates, and oversight structures for identifying, assessing, mitigating, monitoring, and communicating risks across TopLogical Nigeria Limited (“Company”) and its flagship intelligence engine, TopSafeAI.
As a provider of mission-critical compliance, AML, fraud prevention, and sanctions screening infrastructure to commercial banks, fintechs, and financial institutions, TopLogical operates under strict regulatory scrutiny and adheres to the Central Bank of Nigeria (CBN) Risk-Based Cybersecurity Framework, the Nigeria Data Protection Act (NDPA 2023), and international ISO 31000 standards.
This policy applies to all personnel (permanent staff, contractors, executives, and directors), technical infrastructure (cloud services, APIs, databases, networks), third-party vendors, and operational workflows.
2. Risk Governance & Three Lines of Defense
TopLogical enforces a strict “Three Lines of Defense” organizational model to guarantee independent accountability, risk control, and objective assurance:
Product managers, software engineers, DevOps leads, and operational teams own and manage risks in daily execution. They implement security controls, conduct code reviews, perform data validation, and execute operational procedures in compliance with established limits.
The Chief Compliance Officer (CCO), Data Protection Officer (DPO), and Information Security Lead formulate policies, monitor risk appetite thresholds, conduct independent risk evaluations, track regulatory changes, and facilitate risk remediation across business units.
Independent external auditors, specialized third-party penetration testers, and the Board Risk Committee provide objective assurance on the effectiveness of governance, risk management, and internal controls directly to the Board of Directors.
3. Risk Taxonomy
TopLogical categorizes risk into five fundamental domains to ensure comprehensive visibility and targeted mitigation:
System downtime, infrastructure disruptions, cloud outage, software bugs, algorithmic screening latency, and data pipeline failures.
Unauthorized access, data breaches, API key compromise, denial-of-service (DDoS), ransomware, and insider threats.
Violations of NDPA, CBN regulations, NFIU reporting omissions, Money Laundering (Prevention and Prohibition) Act, or contractual covenants.
Loss of client trust, negative audit findings by financial partners, public disclosure of vulnerabilities, or misleading product performance claims.
4. Risk Appetite Statement
TopLogical operates under a Zero-Tolerance / Low-Appetite stance regarding legal non-compliance, customer data privacy compromise, financial corruption, and deliberate security breaches:
- Zero Tolerance: Data breaches exposing client PII, regulatory non-compliance with NDPC/CBN mandates, insider fraud, bribery, and unauthorized modification of audit trails.
- Low Appetite: Production service outages, delayed watchlist syncs, and reliance on unverified single-vendor dependencies.
- Balanced / Calculated Appetite: Innovation in AI screening algorithms, exploratory sandboxes, and controlled beta rollouts with synthetic or anonymized datasets.
5. Risk Assessment & Heat Matrix
Risks are scored systematically on a standard 5x5 Likelihood vs. Impact matrix:
| Severity Rating | Score (L x I) | Operational Action & Resolution SLA | Reporting Threshold |
|---|---|---|---|
| Critical (High-High) | 15 – 25 | Immediate containment within 4 hours; root cause mitigation within 24 hours. | Board Risk Committee & CEO within 12 hours |
| Major (High Impact / Med Likelihood) | 10 – 14 | Mitigation plan formalized within 48 hours; resolution within 7 business days. | Executive Committee weekly briefing |
| Moderate | 5 – 9 | Standard operational remediation within sprint cycle (14–30 days). | Monthly Risk Dashboard |
| Low / Negligible | 1 – 4 | Accept or address during regular scheduled maintenance windows. | Quarterly Risk Review |
6. Risk Treatment & Monitoring
Identified risks are logged in the TopLogical Central Risk Register with an assigned Risk Owner and must be treated according to one of four established protocols:
- Mitigate (Treat): Enforce technical, administrative, or contractual controls to reduce likelihood or impact below the appetite threshold.
- Transfer (Share): Procure cyber-insurance coverage, escrow arrangements, or distribute liability via vendor service level agreements.
- Avoid (Terminate): Discontinue high-risk features, unvetted third-party integrations, or non-compliant client relationships.
- Accept: Retain low-priority residual risk subject to documented approval by the Chief Compliance Officer.
7. Incident Escalation & Review
Any employee, contractor, or institutional client who identifies an emerging risk event or control failure is required to submit an immediate report to risk@toplogical.com.
This policy is formally reviewed annually by the Board Risk Committee or immediately following any significant security incident, major regulatory revision, or organizational restructuring.