Security Risk Assessment & Management Policy

2. Introduction

Mahavir Bullion & Refinery Private Limited (MBRPL) recognises that refining and bullion operations involve high-value precious metals, sensitive information, controlled areas, specialised processes and movements of material. The Company therefore maintains a structured approach to identifying, assessing, treating and monitoring security risks.

RJC COP 2024 COP 13.1 requires members to assess security risks and establish measures protecting workers, visitors and relevant business partners against theft, damage or substitution of products on premises and during events, exhibitions and shipments. COP 13.2 requires security personnel to respect human rights and dignity and use force only when strictly necessary and proportionate to the threat.

3. Purpose

• Protect employees, visitors, contractors, security personnel, premises, equipment, precious metals and confidential information.
• Identify security vulnerabilities and assess likelihood and potential impact.
• Prevent and detect theft, diversion, tampering, substitution, unauthorised access and collusion.
• Maintain secure and traceable movement of precious metals from receipt through processing, storage and dispatch.
• Establish clear responsibilities for assessment, controls, incident response and corrective action.
• Provide evidence of an effective security management system for RJC COP 2024.

4. Scope

This Policy applies to all employees, security personnel, supervisors, contractors, job workers, cleaners, logistics personnel, visitors and relevant business partners, as applicable.

It covers refinery and melting areas; aqua regia and chemical-processing areas; fire assay/laboratory areas; precious-metal storage and vaults; receiving, weighing and dispatch; chemical storage; administrative/control rooms; and internal/external movement of dore, scrap, samples and bullion.

7. Security Risk Assessment Framework

RJC guidance states that risk assessments should identify significant impacts and risks and that controls and treatment plans should be prioritized according to significance.

1. Identify assets, people, processes, locations, activities and information requiring protection.
2. Identify threats and vulnerabilities through site inspections, incident history, employee inputs, CCTV/blind-spot review, access-point review and process observations.
3. Assess likelihood and impact, including financial, operational, safety, human-rights and reputational consequences.
4. Assess existing controls and residual vulnerability.
5. Assign a risk rating and define owner, mitigation action, target date and monitoring method.
6. Review at least annually and after significant incidents, material operational changes, new threats, major security weaknesses or audit findings.

10. Physical Security Controls

• Perimeter and entry/exit controls appropriate to site risk.
• Controlled access to restricted/high-risk areas.
• Visitor identification, authorisation and escort/restriction as applicable.
• CCTV coverage of critical areas and restricted access to recordings.
• Periodic review of CCTV functionality, blind spots and retention.
• Security deployment and patrols based on assessed risk.
• Vault/precious-metal storage controls, authorised access, dual-control/maker-checker and entry/removal logs where applicable.
• Key, access-card, biometric and credential management with prompt withdrawal after role change/separation.

11. Internal Movement and Precious-Metal Security

• Precious-metal movement shall be authorised and traceable.
• Weighment, transfer, sample movement and dispatch shall use appropriate maker-checker controls.
• Unique batch/lot identification shall be maintained where applicable.
• High-risk movement shall be monitored through appropriate physical/CCTV controls.
• Inventory reconciliation and investigation of unexplained discrepancies shall be performed.
• Spillage, recovery and unusual-loss records shall be maintained and escalated.

12. Security During Raw-Material Receipt

• Receipt through approved entry and receiving arrangements.
• Check material against relevant delivery and transaction documentation.
• Perform and record weight/package/seal checks where applicable.
• Escalate suspicious, damaged, tampered or inconsistent consignments before normal processing.

13. Security During Refining and Processing

• Restricted access to refining, melting, assay and other high-risk areas.
• Compliance with PPE and site security requirements.
• Controlled and traceable samples/intermediate materials.
• Spillage, recovery and material-loss controls.
• No unauthorised removal of material, tools or records.

14. Finished-Goods Dispatch Security

• Use approved transporters/service providers.
• Verify vehicle, driver and dispatch documentation before release.
• Use secure/tamper-evident packaging and identification where applicable.
• Protect dispatch schedules and shipment information on a need-to-know basis.
• Use route/tracking controls where required by risk assessment or contract.
• Maintain dispatch and handover records sufficient for traceability.

15. Security Personnel and Human Rights

Security personnel shall respect human rights and dignity. Force shall only be used where strictly necessary and proportionate to the threat, consistent with RJC COP 13.2.
Security risk assessments shall consider risks to disadvantaged and vulnerable groups and the potential impact of security measures on them. RJC guidance specifically highlights protection of vulnerable groups and children in security-related interactions.

• Provide appropriate training on conduct, human rights, escalation and use-of-force requirements.
• Include expected conduct, reporting and site rules in security-provider contracts where appropriate.
• Prohibit harassment, intimidation, discrimination, retaliation and abusive conduct.
• Investigate alleged security misconduct through applicable grievance and disciplinary processes.

16. Information Security Controls

• Sensitive stock, assay, dispatch and security information shall be need-to-know.
• Use role-based access to sensitive systems.
• Manage authentication controls under IT requirements.
• Restrict CCTV/security-system data to authorised personnel.
• Unauthorised copying, disclosure or removal of sensitive information is prohibited.

17. External Parties, Contractors and Security Providers

• Inform relevant external parties of site security rules.
• Verify identity and authorisation before entry where applicable.
• Require cooperation with security checks and monitoring.
• Include security expectations in contracts/service arrangements where appropriate.
• Repeated or serious non-compliance may result in restricted access or contractual action.

18. Security Incident Reporting and Response

7. Protect people and secure affected areas/material where safe.
8. Notify the Security Manager/designated responsible person immediately.
9. Record the incident in the Security Incident Register.
10. Preserve relevant evidence and records.
11. Investigate proportionately and document findings.
12. Assign corrective/preventive actions and owners.
13. Escalate significant incidents to management and authorities where legally or operationally required.
14. Verify completion and effectiveness of corrective actions.

19. Security Training and Awareness

• Security induction for relevant employees, contractors and security personnel.
• Training on access control, visitor management, suspicious-activity reporting and precious-metal security.
• Role-specific human-rights-respecting training for security personnel.
• Refresher training at planned intervals and after significant incidents or material changes.
• Maintain training records showing topic, date, participants and trainer/organiser.

20. Security Risk Register – Minimum Requirements

The Security Risk Register shall, at minimum, capture:

21. Monitoring, Assurance and Management Review

• Periodic inspection of security controls and restricted areas.
• Review of access-control, visitor, key, CCTV and incident records.
• Review of incidents, near misses, discrepancies and trends.
• Verify corrective actions are completed and effective.
• Management review of significant risks and residual risk.
• Internal/independent security assessments where required.
• Use audit findings and incident lessons to strengthen controls.

22. Records and Retention

• Security risk assessments and risk registers
• CCTV/system inspection records
• Visitor and access-control logs
• Key/access-card registers
• Vault access records
• Receiving and dispatch security records
• Security incident/investigation reports
• Security training records
• Security-provider due diligence/contracts
• Corrective-action and management-review records

23. Grievance, Reporting and Non-Retaliation

Employees, contractors and other affected persons may raise security-related concerns through the Company's grievance, whistleblowing or other approved reporting channels. Retaliation against a person who raises a concern in good faith or participates in an investigation is prohibited.

24. Policy Review and Continuous Improvement

This Policy shall be reviewed at least annually and sooner following a major security incident, significant operational change, new threat, change in applicable law or RJC requirement, material audit finding, security-system change or other significant risk development.

The Company shall use incidents, near misses, risk assessments, audit findings, employee feedback and management review to improve security controls.

25. Related Controlled Documents

• AML/CFT Policy – RJC COP 2024
• Supply Chain Policy – RJC COP 2024
• Risk Mitigation Plan – RJC COP 2024
• Anti-Bribery & Anti-Corruption Policy – RJC COP 2024
• Human Rights Policy – RJC COP 2024
• Grievance Redressal Policy – RJC COP 2024
• Emergency Evacuation Plan – RJC COP 2024
• Health & Safety Risk Assessment Policy – RJC COP 2024
• Applicable security SOPs, registers and work instructions