Risk Management Policy

1. Purpose

Risk is inherent in international oil and gas operations and can create both threat and opportunity. Bridgehampton will identify, assess, treat, monitor, and report risk in a manner aligned with strategy, legal obligations, capital discipline, and risk appetite.

2. Governance

The Board owns oversight and approves risk appetite. The Audit and Risk Committee reviews framework effectiveness and material enterprise risks. Other committees oversee risks within their charters. Management designs and operates the framework. Each business leader owns risks arising from assigned activities. Every worker must report hazards, control failures, and emerging risk.

3. Risk framework

1. Establish context, objectives, legal obligations, and decision criteria.
2. Identify risks and opportunities using operational, financial, technical, legal, and stakeholder input.
3. Assess inherent likelihood, impact, velocity, interdependence, and uncertainty.
4. Define controls and accountable owners; assess control design and operating effectiveness.
5. Determine residual risk against Board-approved appetite and tolerance.
6. Treat, transfer, avoid, accept, or pursue risk through documented action.
7. Monitor indicators, incidents, changes, and assurance results; escalate material exceptions.

4. Principal risk categories

• Geological uncertainty, reserves and resource estimation, drilling, completion, well control, production, process safety, and asset integrity.
• HSE, emissions, climate, biodiversity, water, waste, remediation, abandonment, and decommissioning.
• Licenses, concessions, fiscal terms, government relations, political instability, expropriation, currency controls, security, and country exit.
• Bribery, sanctions, export controls, money laundering, competition, tax, local content, human rights, land access, and cultural heritage.
• Commodity price, trading, market, credit, liquidity, treasury, financing, insurance, guarantees, and covenant compliance.
• Joint venture, partner, operator, contractor, supply chain, transportation, storage, and customer concentration.
• Cybersecurity, data privacy, operational technology, fraud, business continuity, and crisis communications.
• People, succession, capability, culture, conduct, labor, and reputation.

5. Country and project gates

No material country entry, asset acquisition, drilling commitment, or development sanction may proceed without a risk assessment, legal-readiness review, HSE basis, economic downside analysis, counterparty diligence, sanctions screening, insurance review, community plan, and defined approval under delegated authority.

6. Reporting and escalation

Management will maintain an enterprise risk register and report material changes and appetite breaches. Immediate escalation is required for threats to life, well control, material environmental harm, license continuity, sanctions breach, fraud, bribery, major cyber incident, liquidity, or Company solvency.

7. Assurance and continuous improvement

Risk-based assurance may include control testing, internal audit, technical review, drills, independent expert review, and lessons from incidents. The framework will be updated as the Company enters new jurisdictions, changes scale, or adds material business lines.