Table of Contents

Risk Management Policy

Purpose

This policy establishes a comprehensive framework for identifying, assessing, treating, and monitoring information security and business risks that could impact Qwestly's mission of transforming the hiring landscape through AI-driven talent marketplace technology. The policy ensures proactive risk management that protects candidate data, customer information, and business assets while supporting sustainable growth and regulatory compliance.

As a talent marketplace platform processing sensitive employment and personal data, Qwestly recognizes that effective risk management is fundamental to maintaining stakeholder trust, ensuring business continuity, achieving regulatory compliance, and creating long-term value for candidates, customers, and investors.

Objectives

This policy aims to:

Establish systematic risk identification across all business functions and technology systems
Implement risk-based decision making that balances security, compliance, and business objectives
Ensure regulatory compliance including GDPR, CCPA, employment law, and SOC 2 requirements
Protect stakeholder interests including candidate privacy, customer data, and investor value
Support sustainable growth through proactive risk management and business resilience

Scope

This policy applies to all risks that could affect Qwestly's ability to achieve its business objectives, protect stakeholder interests, and maintain regulatory compliance. The scope encompasses:

Risk Categories:

Information security and data protection risks
Technology and operational risks
Regulatory and compliance risks
Business and strategic risks
Financial and market risks
Reputational and brand risks

Organizational Coverage:

All Qwestly employees and contractors
All business processes and operational activities
All technology systems and infrastructure
All third-party relationships and vendor dependencies
All geographic locations and jurisdictions of operation

Stakeholder Impact:

Candidate privacy and data protection
Customer confidentiality and business information
Employee safety and organizational capability
Investor value and financial performance
Regulatory compliance and legal obligations

Risk Management Statement

Qwestly acknowledges that insufficient risk management poses substantial threats to our mission, stakeholders, and business sustainability. These threats include potential compromise of candidate and customer data, exposure to cyber attacks and business disruption, regulatory non-compliance and legal complications, and reputational damage affecting trust and growth.

To address these challenges, Qwestly commits to embedding risk management as a core component of our governance and operational framework at both strategic and operational levels. Our risk management approach balances startup agility with enterprise-grade protection, ensuring that security and compliance enhance rather than hinder innovation and growth.

The objective of our risk management policy is to safeguard Qwestly's ability to achieve our business objectives while protecting all stakeholders and maintaining the trust essential for our marketplace model.

Risk Management Strategy

Strategic Framework

Risk-Informed Decision Making:

Integration of risk considerations into all strategic business decisions
Risk assessment required for all new products, features, and market expansions
Risk-return optimization for business investments and resource allocation
Risk tolerance alignment with business objectives and stakeholder expectations

Proactive Risk Management:

Continuous risk identification and assessment rather than reactive incident response
Early warning systems and risk indicators for proactive intervention
Risk prevention and mitigation prioritized over risk response and recovery
Risk management capability building and organizational maturity development

Stakeholder-Centric Approach:

Candidate privacy and trust as primary risk management consideration
Customer data protection and confidentiality as core business requirement
Employee safety and capability as organizational sustainability foundation
Investor value protection through prudent risk management and transparency

Risk Management Principles

Proportionate and Practical:

Risk management measures proportionate to actual risk levels and business impact
Practical implementation that supports rather than hinders business operations
Cost-effective risk treatment that maximizes risk reduction per dollar invested
Scalable risk management processes that grow with organizational maturity

Transparent and Accountable:

Clear risk ownership and accountability at all organizational levels
Transparent risk reporting and communication to stakeholders
Regular risk assessment and treatment effectiveness evaluation
Continuous improvement based on lessons learned and industry best practices

Integrated and Comprehensive:

Risk management integration into all business processes and decision-making
Comprehensive risk coverage across all categories and organizational functions
Coordinated risk management across departments and business functions
Alignment with business objectives and organizational strategy

Qwestly Risk Categories and Assessment Framework

Data Privacy and Protection Risks

Candidate Personal Data Risks:

Risk: Unauthorized access to candidate resumes, contact information, and employment history
Impact: Privacy violations, regulatory penalties, candidate trust loss, competitive disadvantage
Assessment Factors: Data volume, sensitivity level, access controls, encryption effectiveness
Treatment Strategies: Access controls, encryption, monitoring, privacy training, incident response

Customer Company Data Risks:

Risk: Exposure of hiring requirements, organizational information, and strategic hiring plans
Impact: Customer trust loss, competitive harm, contract violations, legal liability
Assessment Factors: Data classification, sharing controls, vendor security, employee access
Treatment Strategies: Data classification, access controls, vendor management, contractual protections

Cross-Border Data Transfer Risks:

Risk: Violations of GDPR, CCPA, and other privacy laws in international data processing
Impact: Regulatory penalties, business restrictions, legal liability, operational disruption
Assessment Factors: Data residency requirements, transfer mechanisms, regulatory compliance
Treatment Strategies: Data localization, Standard Contractual Clauses, adequacy decisions, compliance monitoring

AI/ML Privacy Risks:

Risk: Privacy violations in AI training data and algorithmic decision-making
Impact: Discrimination claims, regulatory action, reputational damage, legal liability
Assessment Factors: Training data anonymization, inference privacy, consent management
Treatment Strategies: Privacy-preserving ML, differential privacy, consent systems, algorithmic auditing

Technology and Security Risks

Cloud Infrastructure Security Risks:

Risk: Security vulnerabilities and misconfigurations in AWS and cloud services
Impact: Data breaches, service outages, financial loss, regulatory penalties
Assessment Factors: Configuration management, access controls, monitoring coverage, vendor security
Treatment Strategies: Security hardening, monitoring, access controls, vendor management, incident response

Application Security Risks:

Risk: Vulnerabilities in candidate portal, company portal, and API systems
Impact: Data breaches, system compromise, service disruption, reputational damage
Assessment Factors: Code quality, security testing, dependency management, deployment security
Treatment Strategies: Secure development, security testing, vulnerability management, penetration testing

AI/ML System Security Risks:

Risk: Adversarial attacks, model theft, and AI system manipulation
Impact: Algorithm performance degradation, intellectual property theft, biased outcomes
Assessment Factors: Model security, training data protection, inference security, monitoring
Treatment Strategies: Model protection, adversarial training, access controls, performance monitoring

Third-Party Integration Risks:

Risk: Security vulnerabilities and failures in vendor systems and integrations
Impact: Data exposure, service disruption, compliance violations, customer impact
Assessment Factors: Vendor security posture, integration security, data sharing, monitoring
Treatment Strategies: Vendor assessment, secure integration, monitoring, contract terms, business continuity

Business and Operational Risks

Platform Availability and Performance Risks:

Risk: System outages and performance degradation affecting customer experience
Impact: Customer dissatisfaction, revenue loss, SLA violations, competitive disadvantage
Assessment Factors: System reliability, scalability, monitoring, incident response capability
Treatment Strategies: High availability design, performance monitoring, capacity planning, incident response

Key Personnel Dependency Risks:

Risk: Business disruption due to founder or key personnel unavailability
Impact: Decision-making delays, knowledge loss, operational disruption, investor concern
Assessment Factors: Knowledge concentration, succession planning, cross-training, documentation
Treatment Strategies: Knowledge documentation, cross-training, succession planning, delegation

Vendor Service Failure Risks:

Risk: Critical vendor service disruptions affecting business operations
Impact: Service outages, customer impact, financial loss, operational disruption
Assessment Factors: Vendor criticality, alternative options, contract terms, monitoring
Treatment Strategies: Vendor diversification, service level agreements, monitoring, contingency planning

Scalability and Growth Risks:

Risk: Inability to scale technology and operations to meet growth demands
Impact: Performance degradation, customer loss, growth limitation, competitive disadvantage
Assessment Factors: Scalability architecture, capacity planning, resource availability, growth projections
Treatment Strategies: Scalable architecture, capacity planning, resource management, performance monitoring

Regulatory and Compliance Risks

Privacy Law Compliance Risks:

Risk: Violations of GDPR, CCPA, and other privacy regulations
Impact: Regulatory penalties, legal liability, operational restrictions, reputational damage
Assessment Factors: Regulatory requirements, compliance controls, data processing, rights management
Treatment Strategies: Privacy by design, compliance monitoring, legal review, staff training

Employment Law Compliance Risks:

Risk: Discrimination and bias in AI-driven hiring and candidate matching
Impact: Legal liability, regulatory action, reputational damage, customer loss
Assessment Factors: Algorithm fairness, bias testing, equal opportunity compliance, audit trails
Treatment Strategies: Bias testing, fairness monitoring, legal review, algorithmic transparency

Security Certification Compliance Risks:

Risk: Failure to maintain SOC 2 and other security certifications
Impact: Customer trust loss, competitive disadvantage, contract violations, audit failures
Assessment Factors: Control effectiveness, evidence collection, audit readiness, continuous compliance
Treatment Strategies: Control monitoring, evidence management, audit preparation, continuous improvement

International Regulatory Risks:

Risk: Non-compliance with regulations in international markets and jurisdictions
Impact: Market access restrictions, legal liability, operational complexity, expansion limitations
Assessment Factors: Regulatory landscape, compliance requirements, local representation, monitoring
Treatment Strategies: Legal consultation, local expertise, compliance frameworks, market assessment

Financial and Market Risks

Customer Concentration Risks:

Risk: Revenue dependency on small number of large customers
Impact: Revenue volatility, negotiating power imbalance, business vulnerability
Assessment Factors: Customer concentration, contract terms, market diversification, retention rates
Treatment Strategies: Customer diversification, retention programs, contract optimization, market expansion

Funding and Cash Flow Risks:

Risk: Inability to secure adequate funding for operations and growth
Impact: Operational constraints, growth limitation, competitive disadvantage, business failure
Assessment Factors: Cash runway, funding pipeline, investor relationships, market conditions
Treatment Strategies: Cash management, investor relations, funding diversification, scenario planning

Market Competition Risks:

Risk: Competitive threats affecting market position and customer acquisition
Impact: Market share loss, pricing pressure, customer acquisition cost increase, growth limitation
Assessment Factors: Competitive landscape, differentiation, market position, customer loyalty
Treatment Strategies: Product differentiation, competitive intelligence, customer retention, innovation

Economic Downturn Risks:

Risk: Economic conditions affecting hiring market and customer demand
Impact: Revenue decline, customer churn, funding challenges, operational constraints
Assessment Factors: Economic indicators, market sensitivity, customer stability, financial reserves
Treatment Strategies: Scenario planning, cost management, market diversification, financial reserves

Reputational and Brand Risks

Data Breach Reputation Risks:

Risk: Reputational damage from data breaches and privacy incidents
Impact: Trust loss, customer churn, regulatory scrutiny, competitive disadvantage
Assessment Factors: Incident likelihood, response capability, communication strategy, stakeholder impact
Treatment Strategies: Incident prevention, response planning, communication strategy, trust rebuilding

AI Bias and Discrimination Risks:

Risk: Negative publicity from AI bias incidents and discrimination claims
Impact: Brand damage, legal liability, customer loss, regulatory attention
Assessment Factors: Algorithm fairness, bias testing, monitoring, transparency
Treatment Strategies: Bias prevention, fairness monitoring, transparency, ethical AI practices

Customer Security Incident Risks:

Risk: Reputational impact from customer security incidents reflecting on Qwestly
Impact: Trust erosion, customer concern, competitive vulnerability, market perception
Assessment Factors: Customer security practices, incident response, communication strategy
Treatment Strategies: Customer security support, incident response coordination, communication management

Qwestly Risk Assessment Methodology

Risk Identification Process

Systematic Risk Discovery:

Business Process Analysis: Review of all business processes for inherent risks and vulnerabilities
Technology Assessment: Evaluation of all technology systems and infrastructure for security and operational risks
Stakeholder Input: Collection of risk concerns and observations from employees, customers, and partners
External Intelligence: Integration of threat intelligence, industry trends, and regulatory changes
Historical Analysis: Review of past incidents and near-misses for risk pattern identification

Continuous Risk Monitoring:

Real-Time Monitoring: Automated detection of security events and operational anomalies
Periodic Assessment: Regular formal risk assessments with comprehensive scope and stakeholder input
Change-Driven Assessment: Risk evaluation triggered by business changes, technology updates, and external events
Incident-Driven Learning: Risk identification and assessment based on security incidents and operational failures

Risk Analysis and Evaluation

Qualitative Risk Assessment:

Impact Assessment: Evaluation of potential consequences across financial, operational, reputational, and compliance dimensions
Likelihood Assessment: Estimation of probability based on threat intelligence, vulnerability assessment, and historical data
Risk Level Determination: Combination of impact and likelihood using standardized risk matrix and scoring methodology
Risk Context Analysis: Consideration of risk interdependencies, cascading effects, and cumulative impact

Quantitative Risk Assessment:

Financial Impact Modeling: Quantification of potential losses including direct costs, business interruption, and opportunity costs
Probability Estimation: Statistical analysis of threat frequency and vulnerability exploitation likelihood
Expected Loss Calculation: Probability-weighted impact assessment for risk prioritization and investment decisions
Sensitivity Analysis: Evaluation of risk assessment uncertainty and key assumption impacts

Risk Evaluation Criteria

Risk Impact Categories:

Very Low (1): Minimal impact on operations, limited financial loss (<$10K), no regulatory concern
Low (2): Limited operational impact, minor financial loss ($10K-$50K), minimal compliance concern
Medium (3): Moderate operational disruption, significant financial loss ($50K-$250K), regulatory attention possible
High (4): Major operational impact, substantial financial loss ($250K-$1M), regulatory action likely
Very High (5): Severe operational disruption, major financial loss (>$1M), regulatory penalties and legal action

Risk Likelihood Categories:

Very Unlikely (1): Less than 1% annual probability, strong controls in place, no known threats
Unlikely (2): 1-10% annual probability, adequate controls, limited threat activity
Somewhat Likely (3): 10-30% annual probability, some control gaps, moderate threat activity
Likely (4): 30-70% annual probability, control weaknesses, active threats present
Very Likely (5): Greater than 70% annual probability, inadequate controls, persistent threats

Risk Level Matrix:

Impact/Likelihood	Very Unlikely (1)	Unlikely (2)	Somewhat Likely (3)	Likely (4)	Very Likely (5)
Very High (5)	5 (Medium)	10 (High)	15 (High)	20 (Critical)	25 (Critical)
High (4)	4 (Low)	8 (Medium)	12 (High)	16 (High)	20 (Critical)
Medium (3)	3 (Low)	6 (Medium)	9 (Medium)	12 (High)	15 (High)
Low (2)	2 (Low)	4 (Low)	6 (Medium)	8 (Medium)	10 (High)
Very Low (1)	1 (Low)	2 (Low)	3 (Low)	4 (Low)	5 (Medium)

Risk Treatment and Response Framework

Risk Treatment Strategies

Risk Mitigation:

Technical Controls: Implementation of security technologies, monitoring systems, and protective measures
Process Improvements: Enhancement of procedures, policies, and operational practices
Training and Awareness: Education programs to reduce human error and improve risk awareness
Redundancy and Backup: Implementation of backup systems and alternative arrangements
Monitoring and Detection: Early warning systems and continuous monitoring for risk indicators

Risk Transfer:

Insurance Coverage: Cyber liability, professional liability, and business interruption insurance
Contractual Transfer: Liability allocation through vendor contracts and customer agreements
Third-Party Services: Outsourcing of high-risk activities to specialized service providers
Legal Protections: Indemnification clauses and limitation of liability provisions
Financial Instruments: Risk sharing through partnerships and financial arrangements

Risk Acceptance:

Documented Justification: Business rationale for accepting risk with cost-benefit analysis
Compensating Controls: Alternative measures to reduce residual risk where feasible
Monitoring Requirements: Enhanced monitoring and review for accepted risks
Escalation Triggers: Predetermined conditions requiring risk reassessment and treatment
Regular Review: Periodic evaluation of risk acceptance decisions and changing conditions

Risk Avoidance:

Activity Elimination: Discontinuation of high-risk activities or business functions
Market Avoidance: Geographic or market restrictions to avoid regulatory or competitive risks
Technology Replacement: Substitution of high-risk technologies with safer alternatives
Process Redesign: Fundamental changes to eliminate inherent risks
Strategic Pivots: Business model changes to avoid unacceptable risk categories

Risk Treatment Planning

Treatment Plan Development:

Risk Prioritization: Focus on high-impact and high-likelihood risks with greatest potential for loss reduction
Cost-Benefit Analysis: Evaluation of treatment costs versus risk reduction benefits
Resource Allocation: Assignment of responsibilities and resources for treatment implementation
Timeline Development: Implementation schedule with milestones and completion targets
Success Metrics: Measurable criteria for evaluating treatment effectiveness

Implementation Management:

Project Management: Structured approach to treatment implementation with accountability and tracking
Progress Monitoring: Regular assessment of implementation progress and obstacle identification
Resource Management: Allocation and reallocation of resources based on priorities and effectiveness
Communication: Regular updates to stakeholders on treatment progress and results
Quality Assurance: Validation of treatment implementation and effectiveness measurement

Roles and Responsibilities

Executive Leadership

Chief Executive Officer:

Ultimate Accountability: Overall responsibility for organizational risk management and stakeholder protection
Strategic Risk Decisions: Final approval authority for high-impact risk acceptance and major treatment investments
Risk Tolerance Setting: Establishment of organizational risk appetite and tolerance levels
Stakeholder Communication: Risk-related communication with board, investors, customers, and regulatory authorities
Resource Allocation: Budget approval and resource allocation for risk management activities
Crisis Leadership: Leadership of crisis response and business continuity during major risk events

Chief Technology Officer:

Technical Risk Management: Leadership of technology and information security risk management
Risk Assessment: Oversight of risk identification, analysis, and evaluation processes
Treatment Implementation: Management of risk treatment plan development and implementation
Vendor Risk Management: Oversight of third-party and vendor risk assessment and management
Risk Monitoring: Management of risk monitoring and reporting systems
Incident Response: Leadership of technical risk incident response and recovery

Operational Teams

Engineering Team:

Operational Risk Identification: Daily identification and reporting of technology and security risks
Control Implementation: Implementation and maintenance of technical risk controls and safeguards
Vulnerability Management: Identification and remediation of security vulnerabilities
Incident Response: Participation in risk incident response and recovery activities
Risk Training: Completion of risk awareness training and security education programs

Business Operations Team:

Business Risk Identification: Identification of operational and business process risks
Control Implementation: Implementation of business process controls and risk mitigation measures
Vendor Management: Day-to-day vendor relationship management and risk monitoring
Compliance Monitoring: Monitoring of regulatory compliance and policy adherence
Risk Reporting: Reporting of risk events and control effectiveness to management

All Personnel

Individual Risk Responsibilities:

Risk Awareness: Understanding of risks relevant to individual roles and responsibilities
Risk Reporting: Immediate reporting of risk events, near-misses, and potential vulnerabilities
Policy Compliance: Adherence to risk management policies and procedures
Training Participation: Completion of required risk and security training programs
Continuous Improvement: Contribution to risk management process improvement and effectiveness

Risk Monitoring and Reporting

Continuous Risk Monitoring

Real-Time Risk Indicators:

Security Monitoring: Continuous monitoring of security events and threat indicators
Operational Monitoring: Real-time monitoring of system performance and availability
Compliance Monitoring: Ongoing monitoring of regulatory compliance and policy adherence
Financial Monitoring: Monitoring of financial metrics and performance indicators
Market Monitoring: Tracking of market conditions and competitive developments

Key Risk Indicators (KRIs):

Data Protection KRIs: Data access anomalies, privacy control effectiveness, breach indicators
Technology KRIs: System availability, security incident frequency, vulnerability exposure
Business KRIs: Customer satisfaction, revenue concentration, operational efficiency
Compliance KRIs: Audit findings, regulatory changes, policy violations
Financial KRIs: Cash flow, customer concentration, cost performance

Risk Reporting Framework

Monthly Risk Dashboard:

Executive Summary: High-level risk status and key changes for executive leadership
Risk Metrics: Key risk indicators and trend analysis with performance against targets
Incident Summary: Summary of risk incidents and response effectiveness
Treatment Progress: Status of risk treatment implementation and milestone achievement
Emerging Risks: Identification of new and evolving risks requiring attention

Quarterly Risk Assessment:

Comprehensive Risk Review: Detailed assessment of all risk categories and individual risks
Risk Register Updates: Addition of new risks and updates to existing risk assessments
Treatment Effectiveness: Evaluation of risk treatment effectiveness and residual risk levels
Risk Trend Analysis: Analysis of risk trends and patterns over time
Stakeholder Communication: Risk communication to board, investors, and key stakeholders

Annual Risk Report:

Strategic Risk Assessment: Comprehensive evaluation of strategic and enterprise risks
Risk Management Effectiveness: Assessment of risk management program maturity and effectiveness
Industry Benchmarking: Comparison of risk posture and management practices with industry peers
Future Risk Planning: Identification of emerging risks and long-term risk management strategy
Investment Planning: Risk-based planning for security and risk management investments

Risk Communication

Internal Communication:

Risk Awareness: Regular communication of risk information and awareness to all personnel
Training Integration: Integration of risk information into training and awareness programs
Performance Feedback: Communication of risk performance and improvement opportunities
Change Communication: Communication of risk implications for business changes and decisions

External Communication:

Customer Communication: Risk-related communication with customers regarding data protection and security
Regulatory Communication: Risk reporting and communication with regulatory authorities as required
Investor Communication: Risk disclosure and discussion with investors and stakeholders
Public Communication: Risk-related public communication and transparency reporting

Startup-Specific Risk Considerations

Resource-Appropriate Risk Management

Efficient Risk Management:

Risk-Based Prioritization: Focus on highest-impact risks with limited resources and attention
Automation and Technology: Use of automated tools and technologies to enhance efficiency
External Expertise: Strategic use of external consultants and advisors for specialized risk management
Scalable Processes: Design of risk management processes that scale with organizational growth

Cost-Effective Risk Treatment:

Return on Investment: Evaluation of risk treatment costs versus benefits and risk reduction
Creative Solutions: Development of innovative and cost-effective risk treatment approaches
Shared Resources: Sharing of risk management resources and costs with partners and vendors
Phased Implementation: Gradual implementation of risk treatments based on priorities and resources

Growth and Scaling Risk Management

Scalability Planning:

Growth Risk Assessment: Assessment of risks associated with rapid growth and scaling
Capacity Planning: Planning for risk management capacity and capability growth
Infrastructure Scaling: Scaling of risk management infrastructure and technology
Team Development: Development of risk management skills and capabilities within the organization

Change Management:

Risk Impact Assessment: Assessment of risk implications for business changes and strategic decisions
Adaptive Risk Management: Flexibility and adaptability in risk management approaches
Continuous Learning: Learning from experience and adaptation of risk management practices
Innovation Integration: Integration of risk considerations into innovation and product development

Key Person Risk Management

Founder Dependency Risk:

Knowledge Documentation: Comprehensive documentation of critical knowledge and decision-making processes
Succession Planning: Development of succession plans and backup decision-making authority
Cross-Training: Cross-training of key personnel and development of backup capabilities
External Relationships: Development of external relationships and advisory support

Technical Expertise Risk:

Knowledge Sharing: Sharing of technical knowledge and expertise across team members
Documentation Standards: Comprehensive documentation of technical systems and processes
External Support: Development of external technical support and consulting relationships
Skill Development: Investment in team skill development and technical capability building

Compliance and Regulatory Integration

SOC 2 Risk Management Requirements

Trust Service Criteria Alignment:

Security: Risk assessment and treatment for information security threats and vulnerabilities
Availability: Risk management for system availability and business continuity
Confidentiality: Risk assessment for data confidentiality and information protection
Privacy: Risk management for privacy protection and data subject rights

Evidence and Documentation:

Risk Assessment Documentation: Comprehensive documentation of risk assessment processes and results
Treatment Plan Documentation: Documentation of risk treatment plans and implementation progress
Monitoring Evidence: Evidence of continuous risk monitoring and reporting activities
Review Documentation: Documentation of regular risk management review and improvement activities

Privacy Law Risk Management

GDPR Risk Management:

Data Protection Impact Assessment: Risk assessment for high-risk data processing activities
Privacy by Design: Integration of privacy risk considerations into system design and development
Data Subject Rights: Risk management for data subject rights fulfillment and compliance
Cross-Border Transfer: Risk assessment and management for international data transfers

CCPA Risk Management:

Consumer Rights: Risk management for consumer rights fulfillment and compliance
Data Minimization: Risk assessment for data collection and processing minimization
Opt-Out Management: Risk management for consumer opt-out requests and processing restrictions
Third-Party Sharing: Risk assessment for data sharing with third parties and vendors

Document Management and Governance

Policy Governance

Document Ownership:

Policy Owner: Chief Technology Officer (Dominick Pham)
Policy Approver: Chief Executive Officer (Adam Boender)
Technical Authority: Engineering Leadership Team
Business Authority: Executive Leadership Team

Review and Update Process:

Quarterly Reviews: Risk management effectiveness and policy relevance assessment
Annual Reviews: Comprehensive policy review with stakeholder feedback integration
Change-Driven Updates: Policy updates based on business changes and risk evolution
Regulatory Updates: Policy updates based on regulatory changes and compliance requirements

Document History

Version	Date	Description	Written by	Approved by
1.0.0	6/13/25		Dominick Pham	Adam Boender

_private/qwestly-docs/Policies/Risk Management Policy.md