Customers

SASB reference: IF-EU-000.A; GRI reference: EU3

CLP Power is the sole electricity provider for Kowloon, the New Territories and most of the outlying islands in Hong Kong. It serves close to 2.8 million customers and approximately 80% of Hong Kong’s households. Total electricity sold in 2023 was 35,392GWh.

Despite its status as a mature market, Hong Kong continues to experience growing demand for electricity. This is largely being driven by territory-wide development and infrastructure projects, as well as new local railway infrastructure projects. Hong Kong is also being targeted as a prime location for energy-intensive data centres, so there is a need to ensure highly reliable power supplies are available to support the development of the data centre industry.

EnergyAustralia operates as a retail energy provider, selling electricity and gas to customers in New South Wales, Victoria, South Australia, the Australian Capital Territory and Queensland (electricity only). It is among approximately 30 retailers active in the key markets of New South Wales and Victoria. Commercial accounts declined the most, however, this was largely due to a reclassification of several counterparties into mass market figures. This did not affect profitability with the Commercial and Industrial team posting a record contribution.

GRI reference: EU10

Goals and targets

CLP calculates the availability factor for its generation assets in terms of the amount of time that the asset is able to produce full load equivalent electricity over a period, divided by the amount of time in that period. Typical values range from 70% to 90%. CLP aims to maintain an availability range of 90% and above for its newer assets.

Targets for each asset are set annually and are included in the business plan. Performance is reported on a weekly basis to senior management. Any significant variances in performance are analysed and appropriate corrective action taken.

Strategies and procedures

While CLP has generation businesses across the Asia-Pacific region, Hong Kong is the only location where its business is vertically integrated, so that it provides generation, transmission and distribution of power as well as retail services. CLP Power is regulated by the Hong Kong SAR Government under the Scheme of Control (SoC) Agreement, which requires the Company to provide a sufficient and reliable electricity supply at a reasonable price and in an environmentally responsible manner.

In Hong Kong, CLP Power employs various measures to maintain high supply availability and high reliability. These include:

• Regularly upgrading its generation and network facilities to meet increasing electricity demand;
• Maintaining sufficient generating capacity to meet forecast demand as well as to cope with both planned and unforeseen outages;
• Developing an additional and economically viable gas supply option that strengthens energy security by providing access to competitive gas supplies from global markets using Floating Storage and Regasification Unit (FSRU) technology;

• Adopting advanced technology (such as smart grid technology) and implementing demand-side management measures to reduce growth in demand and optimise the utilisation of existing assets;
• Moving to condition-based maintenance by monitoring and timely assessing the condition of critical power supply equipment in order to formulate effective preventive maintenance plans. At the same time, CLP also makes reference to international standards and industry good practices to continuously ehance its asset performance;
• Expanding the use of instruments for conducting online monitoring of critical power supply equipment so as to analyse the health status of power supply equipment and to customise appropriate maintenance plans;
• Actively exploring various innovative technologies that could assist CLP's routine inspection and maintenance work, such as robots, aerial cameras, and big data to optimise resources and enhance work efficiency;
• Developing a well-trained and competent workforce for operating and maintaining the system.

In addition to recruiting professionals from the market, CLP also trains young engineering talents through systematic training schemes. In particular, CLP has established the CLP Power Academy since 2017 to collaborate with overseas and local tertiary institutions to train electrical and mechanical engineering professionals for building a healthy succussion pipeline for the power industry.

To guarantee the availability and dependability of its power supply, CLP is working to strengthen its technological capabilities and enhance organisational development across the Group. Departments collaborate to design for an integrated management framework by sharing insights gained from regional experiences. This procedure is lowering the Group's overall operations risk and contributing to improved portfolio management.

A number of innovative projects to promote availability and reliability are currently being pursued in the areas of robotics, asset health, video analytics, energy storage, building information modelling and automation. These projects have been initiated by third parties and CLP's own engineers, who develop innovations based on their own operational experience. 

Transmission network

To keep pace with the territorial development of Hong Kong, CLP conducts an annual review of future transmission network developments. This involves studying the latest system maximum demand forecast, as well as reviewing area load growth, infrastructure development and generation development, and planning accordingly.

Annual maintenance and improvement programmes have been developed for major transmission assets based on an analysis of current conditions along with the performance of the assets, levels of investment, and risk.

The power supply network is highly vulnerable to damage from extreme climate events, which could potentially cause service disruptions. In response, CLP is continuing to introduce a range of measures to improve the reliability of its power supply network.

In India, Apraava Energy carries out regular predictive and corrective maintenance of its transmission assets. This includes pre-emptive check-ups and assessments on operational clearances, to ensure that its assets are well structured and maintained with proper setup, hardware and security. Frequent site patrols are carried out when conducting assessments for landscape and assets, and the assessment results are used to identify defects and develop plans for shutdowns if needed.

Apraava Energy utilises a mobile application for the real-time tracking of site patrols, which has shortened the response time needed for making rectifications. The site patrol team uses thermographic cameras to help locate defects through heat mapping.

Plans are in place to use drones for site patrols, though ground teams will be retained at strategic locations to ensure a speedy response to any damage to critical assets.

SASB reference: IF-EU-240a.3, IF-EU-240a.4, IF-EU-550a.2, IF-EU-000.C; GRI reference: 203-1, EU4, EU12, EU26, EU27, EU28, EU29, EU30

CLP’s transmission and distribution network in Hong Kong serves approximately 80% of the city’s overall population. At the end of 2023, CLP Power had approximately 16,920 km of circuits at medium or higher voltage. In addition, there were 241 primary and 15,539 secondary substations operating in Hong Kong. As of 2023, the average network loss for the past five years was 3.44%, slightly lower than the five-year average of 3.51% reported in 2022.

CLP uses a set of universally recognised supply reliability performance indicators from the Institute of Electrical and Electronics Engineers standard (IEEE 1366-2012) to monitor its system performance. It reports CLP’s performance against these indicators annually to the Hong Kong Government.

In India, Apraava Energy achieved 100% availability for its Satpura Transco Private Limited asset and 99.86% availability for its Kohima-Mariani Transmission Limited asset for transmission of electricity to customers in 2023.

Comparison of reliability levels between cities

Monitoring and follow-up

CLP’s customised Group Operations Information System (GOIS) is used to compile operational data on adherence to the Generator Operational Performance Data Standard. It features built-in data collection, a data compilation and approval sequence, and a dashboard and reporting functions. Relevant staff at the asset, regional and Group levels are responsible for upholding the standard.

Continuous improvement

CLP is constantly looking for ways to improve the operational efficiency of its assets so that they remain compliant with the increasingly stringent regulations on emissions and fuel efficiency in certain jurisdictions. In addition, improvement opportunities continue to arise from innovation and optimisation, particularly through the leveraging of data analytics.

SASB Reference: IF-EU-000.D; GRI reference: 301-1, 302-1, 302-3, 302-4, 302-5, 303-5, 305-1, 305-2, EU11

CLP reports the annual operating performance of those of its generation assets that fall within the reporting scope. The asset performance metrics include availability, generation sent out, thermal efficiency, and energy intensity.

Strategy and procedures

Drawing on its long expertise in the power industry, CLP is implementing various initiatives to encourage residential and business customers and the community at large to use energy more efficiently and contribute to environmental protection. CLP is actively promoting energy conservation:

• Equipping customers with cutting-edge tools and technical assistance;
• Facilitating customers to unlock greater energy efficiency potential;
• Offering customers valuable energy insights and practical tips for energy conservation ; and
• Educating the public through awareness campaigns and informative programmes

Goals and targets

The CLP Power Customer Service Quality Policy includes a commitment to support customers in using CLP products and services more efficiently and effectively.

In Hong Kong, CLP Power has worked closely with the Hong Kong SAR Government on the Development Plan, which covers the second five-year period under the current Scheme of Control (SoC) Agreement. The Plan includes:

1. Performance targets: Under the current SoC Agreement, targets have been set (e.g. energy saved annually, number of buildings or customers supported, etc.) in order to drive the performance of the CLP Eco Building Fund, the CLP Electrical Equipment Upgrade Scheme and energy audits.
2. Peak Demand Management: This enables commercial and industrial customers to help lower the overall system demand, reducing the need for investment in new generation units in the long term. The programme leverages artificial intelligence (AI), developed in partnership with Autogrid, to help lower demand. The target is to achieve a reduction of up to 60MW from the demand peak.
3. A new five-year energy-saving target: CLP Power must achieve energy savings of at least 4% on the basis of average annual sales within a five-year period in order to earn incentives under the SoC Agreement. Further incentives will be earned if energy savings reach 5%.

A greater number of CLP Power customers have enrolled in the Feed-in Tariff (FiT) Scheme, which encourages the development of renewable energy in Hong Kong. By the end of 2023, 376MW of renewable energy capacity was approved under the Scheme, amounting to the annual electricity usage of 89,700 residential customers.

In addition to its SoC Agreement obligations, CLP has harnessed its innovation abilities and digital capability to develop a range of customer-facing solutions and energy services.

GRI reference: 2-6, 302-5

CLP’s Group Ventures & Research functions integrate the venture investing, ecosystem activities as well as research capabilities into a single team. This enables a more systematic and synergistic process of formulating strategic focus and long-term vision, extracting strategic knowledge and value, and facilitating the cross-pollination of strategic insights across the CLP Group.

For its venture investing activities, CLP seeks opportunities that will enhance its core business and offer long term growth possibilities.

CLP has a global open innovation platform that sources solutions to relieve pain points, achieve operational excellence, build new capabilities, and develop business potential. CLP actively participates in accelerator programmes such as Free Electrons and the Phoenix scouting programme, working with start-ups in China and around the world to explore new business models and pilot and deliver cutting-edge technologies and solutions. These efforts have also helped CLP develop a suite of end-to-end products and services along the electric utilities value chain, summarised in the tables below. The Group has over 354 full time innovation positions and has spent over HK$ 170 million in innovation projects this year.

CLP’s research work starts with identifying emerging ideas and technologies that could critically impact the business in the long term. Its research activities leverage partnerships with international associations, research institutes and universities. 

GRI reference: 418-1

In Hong Kong, the Personal Data (Privacy) Ordinance (PDPO) governs the protection of the personal data of individuals. The Data Protection Principles in the PDPO outline CLP Power’s obligations as a data user. They relate to the collection, accuracy, retention, use and security of personal data, as well as individuals’ rights to access and correct their personal customer data.

Under the Privacy Act 1988 (Privacy Act), EnergyAustralia has obligations to ensure the appropriate collection, use, disclosure and security as well as access to individual’s own personal information. There are also mandatory data breach reporting obligations in relation to Notifiable Data Breaches. EnergyAustralia is required to report data breaches if there is unauthorised access to, unauthorised disclosure of, or loss of personal information that EnergyAustralia holds, and if this is likely to result in serious harm to one or more individuals, and if EnergyAustralia has been unable to prevent the likely risk of serious harm with remedial action. Notifications must be made to the Office of the Australian Information Commissioner (OAIC) and to the affected customers with a description of the data breach, the kinds of information involved and recommendations for customers in response to the data breach.

On September 2023, the Australian Government expressed support for significant reforms to the Privacy Act, which are likely to include: Mandatory Privacy impact assessments for high risk activities, a Statutory Tort / direct right of action for serious invasions of privacy under the Privacy Act, establishment of litigation funds for the OAIC, maximum reporting timeframes for data breaches being reduced to 72 hours, and requirements for privacy policies to include references to where automatic decision-making has been used to decline/approve access to essential services such as utilities. A draft Bill is expected in 2024 which will likely contain additional detail, such as the compliance timeframes expected from entities such as EnergyAustralia.

In May 2018, the Australian Government announced that energy data would be included in the Consumer Data Right (CDR). The sharing of product data in the energy sector commenced on 1 October 2022 and consumer data sharing commenced on 15 November 2022. It gives customers the right to share certain transaction, usage and product data relating to their electricity accounts with EnergyAustralia with authorised parties under the CDR regime who are then able to compare what other electricity offers may better suit the customer’s needs. EnergyAustralia was granted an exemption by the Australian Competition and Consumer Commission (ACCC) from the original commencement date in November 2022, requiring EnergyAustralia to commence CDR data sharing by 15 May 2023.

By 15 May 2023, EnergyAustralia successfully went live as a CDR ‘data holder’, meaning EnergyAustralia is now able to share information required under the CDR regime for most of its eligible residential, small business, and large business customers. EnergyAustralia continues to refine its CDR data sharing platform as it receives feedback and enquiries from customers or other CDR participants. 

Strategy and procedures

The CLP Privacy Principles set out the Company’s commitment and approach to protecting personal data. CLP has a designated Corporate Data Protection Officer who oversees the governance of personal data management of business operations in Hong Kong. Their contact details can be found on CLP’s CLP Privacy Policy Statement.

The Group preserves the confidentiality of the personal data provided to it in accordance with the CLP Privacy Policy Statement, which was updated with effect from 1 November 2018. The CLP Privacy Policy Statement demonstrates the Company’s approach to protecting personal data and is applicable to everyone across its entire Hong Kong operations who handles personal data. All employees who have to handle or process personal data of any individual for business operations in Hong Kong must follow CLP procedures, practices and local regulations in relation to personal data privacy.

These procedures are outlined in the CLP Personal Data Protection Compliance Manual which sets out CLP’s data protection compliance framework, including its governance structure and the roles and responsibilities of different functions and personnel within the governance structure. All business units with operations in Hong Kong must implement and abide by this manual which also provides guidance on the protection and use of personal data. Adherence to policies and procedures regarding privacy and data protection are further embedded in CLP's Code of Conductand the compliance management procedures of the Code. 

Under the Code of Conduct CLP commits to compliance with all laws and regulations and to abiding by the Company's policies and procedures which includes data privacy laws and the CLP Data Protection Compliance Manual. The Code of Conduct stipulates that anyone found violating the Code will be subject to disciplinary action. CLP’s internal audit function appraises compliance with policies and procedures and evaluation of the effectiveness of the overall controls in accordance with their audit cycles and assessment scope. In addition, suppliers are informed of and expected to comply with data privacy laws as outlined in CLP’s Supplier Code of Conduct.

Monitoring and follow-up

CLP monitors and documents any complaints related to breaches of customer privacy and the loss of customer data. In addition to the CLP Personal Data Protection Compliance Manual, there is a written guideline used by the Customer Success and Experience Business Unit for handling customer data incidents. The guideline includes information about the classification and assessment of the scope and severity of data incidents, reporting roles and responsibilities, and an incident response strategy and checklist. The Corporate Data Protection Officer also retains a record of data incidents and follow-up actions.

EnergyAustralia has developed and maintains a Data Breach Response Plan which is implemented by a Data Breach Response Team. The plan outlines the strategy for assessing, managing, containing and reporting data breaches within required timeframes, and outlines relevant roles and responsibilities. The plan is activated whenever a potential data breach is identified.

Training and awareness

CLP further protects customer information through a focus on preventing unauthorised disclosures to malicious attackers or impersonators. This involves carrying out specific awareness activities in the year such as communications and quality assurance assessment, and providing coaching and additional training for frontline staff. Company-wide communications, employee training and briefing sessions with leadership are also conducted to ensure all staff understand current privacy and data management obligations. A Data Breach Response Plan has been formulated and a Data Breach Response Team established to ensure the business has the capability and the procedures in place to respond swiftly to any such incidents.

A compulsory e-learning programme on data protection is given to all new employees and is periodically mandated to be given to all employees to refresh their knowledge. CLP also runs frequent tailored data protection awareness programmes, which include regular briefings, case sharing, quizzes and refresher activities, for employees who have regular interaction with protected data (such as members of the Legal Review Committee). Industry threats are continuously reviewed with a view to strengthening controls over the management and monitoring of networks, systems and mobile devices, data loss, and suspicious cyber activities. CLP also regularly emphasises the need for potential privacy incidents to be reported in a timely manner.

At EnergyAustralia, briefing sessions on customer privacy include leadership, enterprise-wide communications and employee training to ensure all staff are up to date with current privacy and data management policies and practices. Privacy training is a compulsory requirement for all new employees, and subsequent refresher training is provided to all employees annually.

GRI reference: 418-1

CLP Power was awarded the Privacy-Friendly Awards 2023 Outstanding Gold Certificate by the Office of the Privacy Commissioner for Personal Data (PCPD) in Hong Kong, in recognition of its commitment to and efforts in protecting the personal data privacy of its customers and stakeholders.

GRI reference: 417-1

Strategy and procedures

CLP customers can access information about its products and services quickly and efficiently through communication channels such as an email welcome pack sent to new customers, the CLP Power websites and the CLP Mobile App, as well as the EnergyAustralia websites and Mobile Apps. CLP also engages with its residential, commercial and industrial customers through satisfaction surveys, online service portals, site visits to its assets, account manager support, and through its Customer Service Centres and Customer Interaction Centre.  

CLP strives to respond effectively to customer needs and preferences. All escalated cases will be studied thoroughly to ensure issues raised by customers are appropriately resolved.

EnergyAustralia averages one to two million conversations with customers every year, either over the phone or via digital service channels. In 2023, EnergyAustralia handled more than 1.5 millions calls. It also engages with more than 100,000 individuals, businesses and stakeholders annually through formal research to help shape its business decisions, products and services.

Monitoring and follow-up

In Hong Kong, an external market research consultant conducts an annual telephone survey to measure customer satisfaction. The customer satisfaction score considers overall satisfaction towards CLP, and includes a relative rating comparing CLP to an ideal utility in Hong Kong. The score is benchmarked against the public utilities in the energy sector and other public service organisations.

EnergyAustralia counts the number of calls and complaints it receives, and measures customer satisfaction through its Strategic Net Promoter Score (SNPS). Customer satisfaction is measured monthly via an online NPS survey sent to a representative group of customers. The Transactional Net Promoter Score (TNPS) is also used to track customer satisfaction in relation to specific customer interactions, providing more direct feedback to frontline staff.

GRI reference: 417-3, 418-1

Australia

Complaints received by EnergyAustralia

The total complaint volumes received in 2023 increased by 25% from the 2022 figure. Following the challenges experienced during the second half of 2022 across the industry, this year continued to experience the impacts of increased cost of living pressures driven by the market uncertainties arising from the energy crisis and market sustainability that resulted in unprecedented call volumes impacting EnergyAustralia's service levels. This resulted in customers reaching out to the Ombudsman directly and bypassing EnergyAustralia’s opportunity to resolve the complaints internally. 

The mid-year market-wide price increase activity coupled with heavy media coverage of increases across the industry at large further triggered complaints to both the Ombudsman and internally to EnergyAustralia. The nature of the complaints highlights the cost-of-living crisis, with energy affordability as a key driver. 

EnergyAustralia noted a year-on-year increase in total complaint volumes. Actions are underway to restore stability in complaints performance, and the fourth quarter of 2023 showed a declining trend in complaint volumes. This was the result of bolstering EnergyAustralia's resources to resolve complaints and to meet growing demand from customers seeking hardship assistance, coupled with initiatives already in place to reduce the incoming volume of complaints.

Despite these challenges, EnergyAustralia continued to go above and beyond to successfully address and resolve customer concerns through timely engagement and effective conversations with its customers preventing further escalations. 

This has been reflected in EnergyAustralia’s TNPS which is at a 5 year high of 30.

Strategies and procedures

CLP’s security strategy is guided by the CLP Risk Management Framework, with oversight from the Board. The Group Security Policy, last updated in 2021, lays out the overall approach taken to minimise risk to people, including employees, contractors, customers and the public, and to manage other business risks to acceptable levels. In 2023, all cyber security-related standards have been updated to take into account technological advances, changing legislation and emerging standards of good practice.

The policy addresses the following areas:

• Integrated and centralised organisation and governance: Security is an integrated department within CLP Digital. It covers all relevant lines of security activity within the Company, and operates independently of the IT and operational technology governing organisations.
• Policies, standards and guidelines: Provides a suite of documents guiding the management and monitoring of risks in line with recognised industry standards.
• Understanding the threats: Ensures decisions related to the application of security measures are appropriately informed and, wherever possible, intelligence driven.
• Communications and awareness: Aims to continuously enhance the security awareness and knowledge of employees and contractors to encourage security-positive behaviour.
• Technical domain: Ensures that robust operational detection and response tools are developed, applied and maintained.
• Liaison: Aims to maintain constructive and trusted relationships with external stakeholders (such as national cyber security agencies and industry bodies) to ensure speedy and effective cooperation if the need arises.

The strategy includes cyber security and physical security measures to protect five separate but co-dependent lines of activity:

• Information: The confidentiality, integrity and availability of data stored in both hard and electronic formats;
• Operational Technology (OT): Hardware and software that detects, monitors or controls physical devices (such as turbines) at CLP assets;
• Information Technology (IT): The IT used to store, retrieve, transmit and manipulate data or information;
• Personnel: Staff employed by CLP, both at the workplace and travelling for business; and
• Brand: CLP’s image, identity and associated reputation.

CLP security measures are robust and scalable. They provide comprehensive, layered and flexible protection.

CLP's approach to security

Operational responsibilities

The Group Security team was established in 2020 to ensure that CLP’s cyber and physical security capabilities and efforts complement each other. The team gives CLP in-house capabilities across the full range of security skillsets. Following internal restructuring in 2022, the Group Security team was integrated into Group Digital in a strategic move to support CLP’s transition. Group Security is now separate from Group Operations but maintains close working relations with its various departments in particular HSE and the Project Management Office. Regular reports are provided by Group Digital to the Board’s Audit & Risk Committee (ARC), providing assurance that adequate risk management is in place and being followed and that appropriate remedial action is being taken where needed.

GRI reference: 410-1

Strategies and procedures

Physical security encompasses physical measures to safeguard people, prevent unauthorised access to equipment, facilities, material and documents, and safeguard these items against security incidents. It covers physical barriers (e.g. fences), security lighting, physical access controls and surveillance systems.

A comprehensive body of documents has been developed to assist all regions and regional assets in establishing or revising their security management documentation. These documents are aligned with international standards for security, and lay out best practices from across the Group.

• The CLP Physical Security Standard lays down the minimum standard of physical security measures expected at every asset owned or operated by CLP, regardless of location or role.
• The CLP Physical Security Guideline provides practical guidance on the security requirements expected of all business units, in line with the Group Security Policy and Physical Security Standard. For instance, it includes guidelines on how to identify potential areas of weakness, develop appropriate security countermeasures, and prepare a security response plan.
• The CLP Security Vulnerability Assessment Guideline is the flagship document that lays down the process for evaluating the security status of any CLP site. Applied in close collaboration with the operator, it provides a comprehensive security “health check” using a risk-based approach that covers threats and areas of weakness, and offers solutions.
• CLP’s Security Due Diligence for Project Design and Construction or Site Acquisition has been developed to support projects in the early stages of acquisition or construction. All projects and acquisitions undergo this process, regardless of size.

• The CLP Business Travel Risk Management Plan minimises the security, medical and health risks faced by employees engaged in business travel. On behalf of the Group, the Security team in CLP Digital leads on business travel security in close cooperation with Group HR and Group Finance.

Training and awareness

CLP security staff must always comply with CLP’s Code of Conduct. They receive related training on an annual basis. In addition to training on national regulations and site-specific requirements, contract security staff receive induction training on CLP policies relating to a harassment-free workplace, minimum wage guidelines and measures preventing discrimination in the workplace. They must complete this induction training before being granted access to their assigned workplace sites.

2023 has seen the removal of all COVID-19 related control measures and the reestablishment of business travel across CLP's operational footprint. This has meant considerable effort has been made to ensure that all staff either supporting or engaged in business travel were properly briefed about the support they can obtain from the company.

• Operational Technology is the hardware and software that detects, monitors or controls physical devices (such as turbines) belonging to CLP.
• Information Technology is the technology used to store, retrieve, transmit and manipulate data or information.

CLP's management of cyber security is documented in 20 standards which align with the NIST Cyber Security Framework and provide guidelines for selecting and specifying security controls for informations systems and processes to reduce the risk of cyber threats and attacks. These all sit under a unified Group Security policy document. Due to differing regulatory requirements mandated in other jurisdictions, some Regions/ Businesses Units have developed their own documents which align with their local jurisdiction but respect the baseline laid down by Group Security's 20 standards.

Training and awareness

Employee and associates of the Group represent important cyber defence assets. They need relevant knowledge to raise their awareness and maintain their vigilance.

Continual efforts are made through training and education to raise cyber security awareness among employees and encourage them to practise good “cyber hygiene”. Security awareness activities at the employee level include simulated phishing emails, internal broadcast campaigns, briefings, videos and the introduction of ‘Cyber Champions’, a communication campaign, all designed to promote good cyber practice across departments and functions.

Monitoring and follow-up

CLP continually monitors its IT systems and networks and stays alert to potential threats to its OT systems. Advances in cyber security technologies have helped improve the Group's ability to detect cyber security breaches. If suspicious activity is discovered in the IT or OT network environments, immediate action is taken to investigate it and, if necessary, isolate the threat and initiate recovery action. Employees are reminded regularly to report suspicious cyber activity directly to CLP Group Security via several channels. Suspicious emails can be automatically reported with the click of a button.

As one of CLP’s top-tier risks, cyber security is regularly assessed and reports made to senior management through the risk management process. Further regulatory changes are anticipated. Although recruiting individuals with the relevant cyber security skillsets can be difficult, CLP is looking to further enhance its capacity in the areas of process, people and technology and to recruit the expertise required to spearhead these efforts.

Strategies and procedures

CLP maintains robust and regularly tested emergency response and crisis management procedures. As the first line of defence, when an incident arises the Incident Management Process (shown below) is activated.

CLP Incident Management Process

Crisis Management Plan

CLP’s Group Crisis Management Plan ensures high levels of preparedness in responding to and recovering from emergency situations, and helps minimise disruption to customers. The Plan is continually reviewed and enhanced to ensure it remains in line with operational changes and the broader operating context. It provides a strong platform for the effective handling of a crisis at the Group level. The plan:

• Outlines crisis management organisation, roles, responsibilities, procedures and processes;
• Specifies the tools needed to ensure the collective response is well planned, well executed and fully integrated across the organisation;
• Describes the relationship and interface between the handling of regional- and Group-level crises; and
• Details the processes that govern internal and external communications during emergencies and crises, ensuring that those responsible for managing a crisis have the necessary information to carry out their responsibilities and that key stakeholders are informed.

The Group-level plan is supported at regional level by Regional Crisis Management Plans which mirror the Group document but are tailored for each region. In addition, detailed emergency response plans have been developed for each asset. These plans are designed to be used by first responders and asset managers.

CLP’s Crisis Management & Emergency Response Structure is outlined in the diagram below.

CLP Crisis Management & Emergency Response Structure

Training and awareness

As specified in both Group and regional publications, emergency response drills are conducted at least annually at all Group sites, with smaller scale drills taking place more often. Group and Regional Crisis Management Plans are reviewed at least every three years. Regional crisis management exercises are conducted annually as part of the internal peer review process.

From a crisis management perspective, the emphasis of the Company has been on maintaining and enhancing capability. Initiatives continued in the year include:

• Considerable work has been conducted to develop a replacement to the now aged Crisis Communications Billboard (CCB). An interim solution has been developed and is being rolled out in the first and second quarter of 2024 to ensure that there is a seamless transition from one platform to another;

• Reviewing and improving notification and communication tools; and
• At Group level, conducting crisis management communication drills and administrative drills to ensure that the equipment and procedures are functional and fully understood by the operators.