Risk Management
Goal and Performance Highlights
Supporting the SDGs
Stakeholders Directly Impacted
Challenges and Opportunities
In today’s fast-evolving environment, the hospital industry faces various risks—including increasing competition, stricter public health regulations, growing exposure to medical litigation, and heightened cybersecurity threats. These risks can significantly impact business operations and undermine patient trust. Nonetheless, these challenges present opportunities for Sikarin Public Company Limited to adopt advanced technologies and innovations, such as AI and Big Data to enhance treatment efficiency, telemedicine to broaden service accessibility, and electronic medical records to improve the accuracy of patient care.
To address these risks and harness new opportunities, the Company is committed to strengthening its risk management processes in alignment with international standards such as ISO 31000 and the COSO ERM framework. These efforts aim to build stakeholder confidence—among patients, shareholders, and broader stakeholders—while elevating cybersecurity and corporate governance practices to foster sustainable business growth.
Management Approach and Value Creation
Sikarin Public Company Limited places strong emphasis on comprehensive risk management across all dimensions of the organization. The Company implements an integrated Enterprise Risk Management (ERM) system, embedding risk considerations into strategic planning to enhance competitiveness, business continuity, and sustainable growth. Risk management is conducted in accordance with good corporate governance principles and international best practices, while also meeting stakeholder expectations. Sikarin is committed to managing risk systematically, transparently, and proactively to support sustainable operations in a rapidly changing environment.
Risk Management Policy and Framework
Sikarin has established a clear Risk Management Policy aligned with ISO 31000 and the COSO ERM Framework. This policy provides a structured approach to identifying, assessing, managing, and monitoring risks—covering strategic, operational, financial, legal compliance, and Environmental, Social, and Governance (ESG) risks.
- Risk management is a shared responsibility at all organizational levels
- Risk management must be integrated into strategy setting, business planning, and operations
- ESG risks must be analyzed and evaluated on par with business risks
- A consistent and transparent system for monitoring, reviewing, and reporting risks must be maintained
Risk Governance Structure
Sikarin’s risk management is guided by a clear governance structure with defined roles and responsibilities at every level to ensure effectiveness and alignment with corporate strategy while maintaining long-term resilience.
Board of Directors: Sets risk management policy, direction, and enterprise-wide framework in line with corporate strategy; approves the acceptable risk appetite; closely monitors risk performance and conducts annual reviews of the risk management system. The Board also promotes a risk-aware culture across the organization.
Enterprise Risk Management Committee: Oversees enterprise-wide risk strategy, planning, and integration—including strategic, operational, financial, and ESG risks. This committee monitors systemic and material risks, promotes risk integration across departments, and reports outcomes to the Board as scheduled.
Board of Director established Risk Management function with Mr. Suriyan Kojonroj, Deputy Managing Director responsible for specific operational level risk management. This Risk Management function is responsible for integrate risk into planning and decision-making; continuously monitor and improve risk management processes; and report outcomes to the Risk Management Committee.
Operational Units and Risk Owners: Identify, assess, and manage risks related to their operations; implement and refine control measures; prepare quarterly risk reports or event-triggered reports; and collaborate with management to strengthen internal controls.
Internal Audit: Evaluates the adequacy and effectiveness of the risk management system; audits compliance with policies and internal risk-related procedures; provides recommendations to enhance the risk management framework to respond to evolving business contexts; and reports systematically to the Audit Committee and Board.
All Employees: Play a key role in supporting risk management by operating within policy frameworks, identifying and reporting risks, adhering to control measures, and participating in regular training to promote a transparent, accountable, and learning-focused culture that mitigates risk impacts.
Risk Management Process
Sikarin Public Company Limited conducts risk management through a systematic and integrated process across all operational levels to ensure risks are identified, assessed, managed, and monitored in alignment with strategic objectives.
The process begins with systematic risk identification, analyzing both internal and external factors that may impact the Company’s ability to meet its goals. Risks considered include organizational structure, operations, human resources, technology, and external forces such as economic trends, regulatory changes, and ESG factors. A deep understanding of the organizational context is essential to laying the foundation for effective risk management.
Following identification, risks are assessed based on their likelihood of occurrence and potential impact. Prioritization is determined using a severity matrix, considering financial effects, reputational damage, patient safety, legal compliance, and ESG impacts. This holistic assessment enables efficient resource allocation and responsive risk treatment.
Risk responses are then designed to align with the assessed risk level and the organizational context. These include avoiding risks that are highly severe and deemed unacceptable; mitigating risks through the development of internal controls and operational guidelines; transferring risks through insurance or contractual agreements; and accepting risks that fall within manageable thresholds under existing resources. Each approach is selected based on a careful cost-benefit analysis to ensure that the chosen risk treatment is both effective and sustainable.
Ongoing monitoring and review are prioritized, with Key Risk Indicators (KRIs) used for early detection and performance tracking. Measures are regularly reviewed and refined to reflect changing conditions.
The final step emphasizes transparent communication and reporting, with structured risk reports presented to the Risk Management Committee and Board. This process enhances oversight and builds stakeholder trust in the Company’s commitment to professional, best-practice-aligned risk management.
Top-priority residual risks for monitoring
Analysis of Potential Emerging Sustainability Risks
1. Risk from changing global demographic structure trends
Risk Impacts
The current global demographic structure has resulted in significant volatility in the demand of service users. Global population statistics indicate that the demographic structure has entered a Super-Aged Society. Thailand is one of the top three countries with the fastest-growing elderly or Silver Age population in the world. The elderly population tends to increase, while the population of reproductive age has declined. Thailand ranks third in the world for the lowest birth rate, with a decline of as much as 81 percent over the past 74 years, resulting in a further decline in births over the next three years. This may affect business units relating to newborns through adolescents, such as the Pediatrics Department, the Obstetrics and Gynecology Department, as well as children’s hospitals, which account for 19 percent of revenue in the hospital business group. This creates a risk of a decline in total revenue and loss of business opportunities if there is no adaptation to changes in the demographic structure.
- Monitor data on changes in the demographic structure together with service user data in order to adjust strategies and design services in line with the service demand situation in a timely manner and effectively respond to the expectations of service users.
- Recognize the importance of personnel as the key driving force in business operations that must adjust strategies to keep pace with change, particularly in the nursing profession and pediatric nursing groups, by promoting competency building and enhancing capabilities through Upskill & Reskill to align with changes in the health needs of service users in the digital society era, through creating a learning society within the Nurse Society group in order to concretely develop nursing personnel into the online society, in a direction aligned with organizational change.
- Implement the BeBetter Wellness Clinic project/service, which is a center providing comprehensive holistic health services, with a focus on preventive healthcare and anti-aging medicine, offering health check-up services, skincare, beauty, body balance adjustment, and the promotion of a good quality of life, helping everyone live better through holistic wellness, not only disease treatment.
2. Risk from Economic Slowdown
Risk Impacts
Economic slowdown may affect people’s savings and spending, which in turn affects decisions to receive medical services, particularly for non-emergency services or those that can be postponed. At the same time, the hospital business continues to face challenges in managing costs that remain at a high level, such as personnel costs, medicine and medical supply costs, energy costs, and expenses for upgrading technology/service standards, which may affect business operations and the profitability of each operator at different levels. However, Thailand has continuously upgraded medical services and has standards that are internationally accepted, together with the advantage of competitive medical treatment costs, which are supporting factors for maintaining the competitiveness of the hospital sector in the long term.
- Diversify the service portfolio to cover alternative services, preventive healthcare services, and specialized treatment services that are less sensitive to demand volatility, in order to maintain revenue stability.
- Develop package models/treatment plans that meet value-for-money needs and increase access to services, by appropriately managing service pricing levels and supporting payment options/health insurance entitlement use to help reduce the cost burden of service users.
- Enhance operational efficiency and cost control systematically, such as the management of medicine and medical supply costs, increasing service process efficiency, managing doctor schedules and workforce in line with patient volume, and increasing the efficiency of resource/energy use.
- Conduct prudent supply chain and procurement management in order to reduce risks from cost volatility and delivery delays, as well as increase the continuity of critical medical supplies.
- Closely monitor economic indicators and service user behavior, together with preparing scenario planning in order to adjust marketing plans, service provision, and budgets in a timely manner in response to changes.
3. Risk in managing the spread of emerging diseases
The spread of emerging diseases may result in a rapid increase in demand for medical services, while also increasing safety risks for service users and personnel, as well as affecting the continuity of operations and the availability of medical supplies. The Company therefore must adapt to greater use of online technology to support operations, with the management and preparation of information technology resources, as well as necessary safety and biosecurity equipment to be in place, together with operational manuals for epidemic situations for employees to use as guidelines, and to support the needs of service users whose behavior has shifted increasingly toward online services, such as home medicine delivery, home vaccination services, including the development of a Telemedicine system to communicate with patients, through which care, medical history review, and symptom follow-up can be provided for both Thai and foreign patients who are unable to travel to see a doctor, as well as the development of a wellness center, rehabilitation center, and the use of modern medical tools/equipment, in order for the Company to maintain its competitiveness.
- Prepare and review public health preparedness and infection prevention & control plans, including manuals for epidemic situations, so that operations are carried out under the same standard and risks to service users and personnel are reduced.
- Prepare necessary resources, such as biosecurity equipment, critical medical supplies, and reserve inventory management according to risk levels, in order to support sudden increases in demand.
- Enhance service continuity through the use of technology and remote service channels (Telemedicine), including home delivery services for medicine/vaccines, in order to reduce congestion and increase convenience in accessing services.
- Conduct periodic drills of emergency plans and crisis communication so that responses to incidents can be made quickly, disruptions can be reduced, and the quality of treatment and care can be maintained.
- Monitor emerging disease situations and health trends together with relevant agencies, in order to use such information in workforce planning, resource allocation, and the adjustment of service models to align with the situation.
4. Risk from changes in future standards and regulations
Sikarin Public Company Limited operates its business under the supervision of the Ministry of Public Health, other relevant government agencies, and in accordance with the license to operate a healthcare facility, including company laws and other relevant laws. At present, the enactment of laws tends to become more stringent, including the promulgation of the Personal Data Protection Act B.E. 2562 (2019), which is a law issued for the collection, gathering, use, and disclosure of personal data, including the data of service recipients. Under such law, the Company is designated as the data controller and is required to implement appropriate security measures to prevent loss, access, alteration, correction, or disclosure of personal data without authority, including requesting consent for the use/disclosure of personal data and supporting the rights of data owners as prescribed by law.
- Monitor changes in relevant laws, regulations, and standards on a regular basis, together with assessing operational and strategic impacts, in order to improve internal policies/processes to ensure compliance and reduce non-compliance risk.
- Establish a compliance management system and internal communication, including training for relevant personnel, so that they understand the requirements and are able to comply correctly.
- Establish a personal data protection policy and implement appropriate data security measures to prevent loss, access, or improper disclosure of data, including establishing systematic procedures for obtaining consent and managing the rights of data owners.
- Conduct periodic assessments of personal data and security risks (such as reviews of data access and risk assessments of systems/external service providers) in order to strengthen controls and reduce the likelihood of data leakage incidents.
- Establish guidelines for incident response and reporting/communication when an incident occurs, including reviewing lessons learned after the incident, in order to improve preventive measures and build confidence among service recipients and stakeholders.
Risk Management Culture
Sikarin Public Company Limited places great importance on fostering a risk management culture at all levels of the organization, grounded in the belief that building risk awareness is a fundamental foundation for driving sustainable achievement of strategic goals, particularly in an increasingly dynamic and uncertain environment.
To promote this culture, the Company regularly conducts training sessions and seminars on risk management. These aim to ensure that employees across all levels understand the concepts, principles, and practices involved in identifying, assessing, managing, and monitoring risks. Training programs also cover specialized risk topics such as ESG risks, information technology risks, and patient safety risks to enable personnel to effectively apply this knowledge to their responsibilities.
Internal communication on risk and risk management practices is another key element that the Company strongly emphasizes. Continuous knowledge sharing and experience exchange across departments are encouraged to foster mutual learning and strengthen a shared understanding of risk-related issues relevant to each operational context.
Furthermore, the Company supports an environment in which employees are encouraged and empowered to report risks or anomalies without fear of negative consequences. By cultivating an organizational culture rooted in transparency, accountability, and constructive learning from mistakes, the Company believes that open and fearless communication of risk-related information leads to more effective risk management and significantly reduces the likelihood of severe incidents.
Risk Awareness and Risk Management Training
Sikarin Public Company Limited places great importance on comprehensive risk management across all dimensions of the organization. The company is committed to cultivating a deeply rooted culture of risk awareness at every operational level. Most recently, the company organized a risk management training session for executives and employees. This initiative is a key mechanism that demonstrates the organization’s mission to drive quality, safety, and sustainability.
The training was directly supported by the company’s senior management, reflecting the belief that risk management is not merely the responsibility of a single department but a “shared culture across the organization.” Executives emphasized the importance of developing employees’ perspectives and skills in depth to enable them to apply risk management effectively in their daily work.
Key Training Highlights:
Strategic Risk Thinking: Participants learned that effective risk management involves more than just responding to incidents. It includes proactive planning, seeing the big picture, and making visionary decisions at all organizational levels.
Holistic Perspective: Risk management is not limited to hospital operations. The training also covered financial, operational, reputational, and legal risks, promoting an integrated, cross-departmental approach to risk management.
Hands-on Practice through Real-life Scenarios: Through workshop activities, participants practiced analyzing simulated events, assessing impacts, and making decisions under uncertainty. This practical approach aimed to prepare them realistically for actual situations.
Leadership Role in Fostering a Risk Culture: The training underscored the critical role of leadership in instilling preventive behaviors, encouraging open communication about risks, and creating a safe space for learning from mistakes.
Finally, the Company has formally integrated risk management principles into the annual performance evaluation process. Employees are assessed based on their risk awareness, ability to manage risks within their scope of responsibility, and contribution to the development of the Company’s risk management system. This approach reinforces the understanding that risk management is not the sole responsibility of any one department but is a shared responsibility of all employees in driving the organization toward long-term sustainability.
Quality Control of Service Delivery
At Sikarin, the highest priority in service quality control is placed on minimizing risks in the medical treatment process as well as in other related operations. Significant emphasis is given to risk identification, risk prevention, and risk reporting. Each year, Sikarin develops a Hospital Risk Matrix to assess organizational risks. The results of this assessment identify key areas where risk prevention measures are required, including the five highest-risk areas. These insights also inform the development of improvement programs and the selection of appropriate Key Performance Indicators (KPIs) within the Hospital Matrix.
Procress Hospital Matrix and KPI Selection
Quality Control Process / Operational Integration
At Sikarin, quality control is based on the principles of Quality Assurance (QA), incorporating both international and national Hospital Accreditation systems as the standard framework for operations. The hospital primarily relies on three accreditation systems: the Joint Commission International (JCI) Accreditation and the Critical Care Program Certification (CCPC), both of which are prestigious quality certifications from the United States and are highly respected worldwide. Additionally, Sikarin adheres to the Thailand Hospital Accreditation standard, which is certified by the Healthcare Accreditation Institute (Public Organization), an independent body established to accredit hospital standards in Thailand.
JCI Standards
HA Standards
