Upstream Governance Management Playbook 1st Edition 2026
Contents Section 1: Introduction to Upstream Governance Management Playbook……… 05 Section 2: Upstream Business & OPU Relationship …………..........………………....… 09 Section 3: Decision - Making Philosophy…………………………….………………………… 12 Section 4: Reporting ……………………………………....………………………….……………… 21 Section 5: Three Line of Defense ………………………………….…………………..………… 24 Section 6: Governance Document Management ………………………………..………… 28 Section 7: Governance Document Adoption ……………………………………..…………. 35 Section 8: Assurance …………………….……………………………………………………..……… 44 Section 9: Roles and Responsibilities……………………………………………………..……… 50
Section 1 Upstream Governance Management Playbook
Upstream Governance Management Playbook serves as a quick - reference guide to governance requirements, enabling consistent understanding and application across the Upstream PETRONAS Governance Universe (PGU). Anchored to the PETRONAS Governance Management Framework (PGMF), it sets out a practical and consistent approach to implementing governance across the Upstream PETRONAS Governance Universe (PGU) . Purpose
This Playbook applies to all OPUs within the Upstream PETRONAS Governance Universe (PGU) and covers the governance relationship, approaches and governance document management requirements. Applying This Playbook • Navigate Use the modular sections to identify governance requirements and implementation guidance. • Customise Apply the guidance in accordance with Upstream business context while remaining aligned with the PETRONAS Governance Management Framework (PGMF). • Integrate Apply this playbook in conjunction with applicable governance documents in myGovernance Scope
Section 2 Upstream Business & OPU Relationship
Upstream PETRONAS Governance Universe (PGU) Direct subsidiaries of PETRONAS or Key OPU with >50 % ownership Direct associates of PETRONAS or Key OPU with ≤ 50 % ownership, where PETRONAS or Key OPU has operational control through contractual arrangements . 1 2 Inclusion Criteria Associates or subsidiaries operated by third parties (e.g ., via JVA or operating agreements) Inactive OPU (e.g . dormant, in liquidation, liquidated, winding up or dissolution) 1 2 Exclusion Criteria OPU not incorporated under company law or equivalent act (e.g ., company limited by guarantee or trust funds) 3 The Upstream PETRONAS Governance Universe (PGU) is the consolidated list of OPUs meeting the inclusion criteria and serves as the reference for PETRONAS governance applicability. The PGU inclusion and exclusion criteria are as follows:
Upstream PGU classification Description Key OPU (Manned) Other OPU (Unmanned) A fully manned and operational* OPU that independently manages its business activities An unmanned OPU established for a specific business purpose (e.g. financing, acquisition, investment, holding company, etc ) and/or no operational* activities Required to adopt and implement Level 1 Policies , Level 1 Directives and Level 2 Enterprise Document (ED), including PETRONAS Line of Sight (LOS) and reporting requirements Required to adopt and implement Level 1 Policies & Level 1 Directives ED, including PETRONAS Line of Sight (LOS) and reporting requirements, Level 2 EDs are not applicable at Other OPU level. Upstream PGU OPU Classification OPUs within the PGU are classified based on their operational, business activities and governance responsibilities, which determine the applicable governance and adoption requirements . Operational Activities – Day - to - day business activities undertaken including the management of assets, projects, resources and business operations.
Section 3 Decision - Making Philosophy
The decision - making philosophy for Upstream OPUs ensures that all decisions are aligned with PETRONAS Group strategy , support financial sustainability and safeguard the Group’s reputation . All OPUs under Upstream PGU shall have their own Limits of Authority (LOA), governed under PETRONAS Group LOA Framework . Within each OPU, the Boards and CEOs are the highest legal authorities, with the Board holding ultimate authority over CEO . PETRONAS provides enterprise steer through appropriate Line of Sight (LOS) to ensure alignment of Upstream decisions with Group priorities and risk appetite . LOS provides direction and guidance with appropriate visibility and consultation to protect Group’s financial health, reputation and sustainability commitments . ENTERPRISE STEER THROUGH LOS DECISIONS UNDER LOA AUTHORITY AT THE OPU LEVEL Decisions are made in accordance with the Limits of Authority (LOA) at each OPU . LOA defines who may commit resources, approve actions, or enter obligations, within approved thresholds and risk appetite, ensuring timely, accountable and disciplined decision - making .
Line of Sight (LOS) and Limits of Authority (LOA) Line of Sight (LOS) Limits of Authority (LOA) Purpose • Ensure alignment of material Upstream decisions with PETRONAS Group priorities and risk appetite. • Provide appropriate visibility and consultation to protect Group financial health, reputation and sustainability commitments. Definition • A requirement for consultation and visibility prior to the approval of material decisions at the respective Upstream OPU. • Provides direction and guidance while decisions are implemented under LOA Purpose • Enable timely and accountable decision - making . • Maintain disciplined governance over material decisions through clearly defined authority limits. Definition • Defines approved decision - making authority and thresholds , specifying who may commit resources, approve actions, or enter obligations. • Ensures decisions are exercised within approved risk appetite, with clear accountability and governance discipline. How LOS and LOA Work Together LOS Determines when consultation and visibility are required for material decisions LOA Determines who has the authority to approve and make those decisions
Principles of Line of Sight (LOS) The following principles define Upstream Line of Sight (LOS) and provide guidance on oversight, accountability and operationalization. Area of Sight1 Areas that require consultation as outlined in PETRONAS Reserved Matters and also Upstream Directives. 8 PETRONAS Line of Sight Areas Upstream Directives 1 5 3 6 7 8 Strategic Equity or Asset Acquisition / Investment / Divestment Capital Project Sanction Significant / New: Business Model / Agreement / Alliance / Partnerships / Long -Term Commitment Establishment of Company ( Incorporation & Appointment of Directorships ) Stakeholder Relations / Donations / Sponsorships (certain threshold) Media Releases Initial Public Offering (IPO) / delisting External Borrowings 2 4
Level of Sight2 The decision - making structure below illustrate the Line of Sight tiers from OPU level through to the PETRONAS Board
Nature of Sight3 The consultation shall be properly documented and kept for reference purposes. • Consultation prior to approval at respective OPUs. • Adherence to the relevant governance documents , including any required consultation with the Corporate Governance Providers (CGP). Accountability & Operationalisation4 LOS Consulting Parties Documentation of Consultation PETRONAS Board Minutes of Meeting President Memo; or Minutes of meeting (direct syndication / ELT / others committee. EVP / SVP / VP / SGM / GM Memo; or Minutes of meeting (direct syndication / LT / others committee) • Accountability remains at OPU Board & Management over the decisions approved. • Decisions shall be carried out diligently with necessary inputs and supported in proper review and recommendation process, including Risk Assessment in Decision - Making, where required. • The original consulting parties shall be consulted for any variations, extension, renewal, suspension or termination.
Upstream Decision - Making Approach Pre - Decision (Consultation via LOS) Decision Execution (Approval via LOA) ✓ Consultation is mandatory before decision approval . ✓ LOS involves seeking advice and steer from PETRONAS Board, President, Management, or SMEs . ✓ Documentation of all consultations (MOM or memo) is required for reference . ✓ Decisions are approved according to the LOA of the OPU . ✓ Accountability remains with the OPU Board and Management . ✓ Any variations, extensions, renewals, suspensions, or terminations must be consulted with the original parties .
Section 4 : Reporting
All OPUs under Upstream PETRONAS Governance Universe (PGU) are required to provide structured reporting to PETRONAS on areas impacting license to operate, critical decisions at enterprise level and/or Risk Appetite .
Activities related to mergers, acquisitions or divestments report to M&A Corporate Strategy (CS) and Upstream S&C . For mergers, acquisitions or divestments executed by OPUs not performed by the centre , submit reports to M&A CS for consolidation . Financial, operational, HSE, integrity, sustainability and asset performance, report to SGM CMD and EVP Upstream and may be submitted through Upstream Dashboard for a complete enterprise view Major HSSE incidents and threats (e.g., fatalities, major fires, or major LOPC) report to Upstream HSE. Any non - compliance with Critical Legal Areas (CLA) or ongoing litigation, report to Group Legal. High impact to People, Environment, Assets & Reputation Strategic direction impacting enterprise level Key business performance affecting license to operate All OPUs under PETRONAS Governance Universe (PGU) are required to report to PETRONAS on the following critical areas:
Section 5 Three Line of Defense
2 6 Internal Audit Provide reasonable assurance to Board on effectiveness of governance, risk management and internal controls Provide oversight to Management on adequacy and effectiveness of internal controls Business/OPU* Empowered and accountable for design, implementation and monitoring of internal controls *Includes COE that perform function & services for OPU Third Line of Defense Second Line of Defense TLD SLD FLD First Line of Defense Three Lines of Three Lines of Defence is a governance responsibilities and accountabilities for controls. It promotes a balanced approach Corporate Governance Provider (CGP)
ASSURANCE Conduct audit program & report GOVERNANCE Governing documents & advisory COMPLIANCE Monitoring on performance & reporting ASSURANCE Assurance programs & reporting GOVERNANCE Establish effective internal control COMPLIANCE Execute required control activities ASSURANCE Fit- for - purpose self - assessments Focus on strategic & critical risk areas Full adoption of L1 & L2 Enterprise Document (ED) Fit- for- purpose adoption for non - Enterprise Document is empowered to the respective OPU Full - Scale CGP conduct assurance programs based on high impact to Financial, People, Asset & Reputation Establish effective internal controls through adopted/adapted L2 Governance Documents Implement governance requirement and execute internal control during day - to- day activities Business/OPUs to determine adequate self - assessment on critical areas Strengthening compliance oversight through monitoring performance, conformance and reporting to relevant authorities Perform monitoring and reporting on performance and conformance and take action for gap closure. Defense model that establishes clear roles, effective risk management and internal to governance, compliance and assurance
Section 6 Governance Document Management
The Three Lines of Defense defines clear governance requirements, accountabilities and decision - making authorities . To support consistent implementation and oversight, governance documents are structured according to defined ownership, approval authorities and classification criteria . This section outlines the Governance Document Structure and the criteria for determining whether a document is classified as an Enterprise Document (ED) or Non - ED . Development of Upstream L1 and L2 governance documents requires consultation with UPRA Governance to ensure alignment with governance requirements, appropriate classification and approval requirements.
CRITERIA FOR GOVERNANCE DOCUMENT PETRONAS Enterprise Document (ED) 1. Requirement by law & regulation to establish a Level 1 document (Policy or Directive); and/or 2. PETRONAS’ stance & position that fortifies PETRONAS influence, reputation and business sustainability; and 3. Level 2 document that contains critical key governance requirement or control to manage Enterprise - wide risks ; and 4. Universal control that applicable across PETRONAS Group.
GOVERNANCE DOCUMENT STRUCTURE Level 1 Level 2 Level 3 Policy, Directive Framework, Standard, Guideline Manual, Procedure, Work Instruction, Checklist, Template ‘Tone from the top’ ‘What shall/should/may be done’ ‘How, who, where & when’ Development of Upstream L1 and L2 governance documents requires consultation with UPRA Governance to ensure alignment with governance requirements, appropriate classification and approval requirements.
Sets enterprise - wide or Business specific commitments , principles and direction • Enterprise L1 document develop by Corporate Governance Provider (CGP) and a pproved by PETRONAS Board. • Business L1 document developed by OPU and a pproved by OPU Board. Provide governance concepts, philosophy, principles and key requirements or controls aligned with recognised standards and best practices. • Enterprise L2 document developed by CGP for enterprise - wide use and approved by CGP Head. • Upstream L2 document developed by Upstream Division or Department SMEs to address specific governance requirements. Approval is based on its governance scope : ➢ Division Head (VP/SGM): Documents governing activities across a division and/or Upstream Business. ➢ Department Head (SGM/GM) or Technical Authority: Documents governing activities within a department or technical discipline. Level 1 Level 2 Level 3 Definition, Ownership And Approver Provide detailed processes and guidance to enable implementation of governance requirement. • Detail OPU - specific processes and operational practices to support business execution and requirements. • Owned by OPUs and approved by Department Head (GM level and above) or the relevant Technical Authority.
Section 7 Governance Document Adoption
L1 Policy • Applicability : ➢ Enterprise L1 Policy (ED ): To be adopted by all applicable OPUs within the Upstream PETRONAS Governance Universe (PGU). ➢ Business - specific L1 Policy : Established by an Upstream OPU to address applicable regulatory or statutory requirements. • Adoption Approach : Formal acceptance of the intent and requirements of the Enterprise L1 Policy at the OPU level. • OPU Adoption Approval Authority : OPU Board. Adoption of Level 1 : Policy and Directive Adoption applies to L 1 and L 2 Enterprise Documents (ED) designated for applicable Upstream OPUs within Upstream PETRONAS Governance Universe (PGU) . Voluntary adoption may apply for other L 2 Non - ED . L1 Directive • Applicability : To be adopted by all applicable OPUs within the Upstream PETRONAS Governance Universe (PGU). • Adoption Approach : Embed the Directive's requirements into business strategies, governance documents, business processes and operating practices. • OPU Adoption Approval Authority : OPU Board.
Adoption and Implementation Process Flow for L1 ED Enterprise Documents ( ED ) are adopted and implemented through a structured, stepwise process, summarised as follows : ED Dissemination & Awareness 1 Corporate Governance Provider (CGP) / OPU SME Notifies OPU governance focal and deploys the L1 ED / L1 Business specific in the governance system. Conducts upskilling and briefing sessions to explain intent, scope and key requirements. OPU Governance Focal Communicates and cascades deployment notifications to relevant OPU stakeholders (OPU SME etc.).
ED Assessment 2 OPU SMEs / OPU Governance Focal Assess applicability of ED to OPU operations . Establish OPU - specific L1 Policy . For Directives, embed requirements or develop L1 Directive, if required . Any substantive changes require agreement from document owners . Identify gaps and provide clarification, guidance and recommendations to support adoption and operationalisation . Approval and Implementation 3 & 4 OPU Board Approve ED adoption . OPU Governance Focal Drives adoption activities and implementation timelines for governance requirements . Collaborate with OPU SME to draft and prepare Board papers for L1 Policy and Directive . Upload and update the approved documents and/or Board Minutes of Meeting (MOM) in my GOVERNANCE .
L2 ED • Applicability : To be adopted by all Key OPUs within the Upstream PETRONAS Governance Universe (PGU). • Adoption Approach : Implement applicable "SHALL" requirements identified as key controls through existing governance documents, business processes, and operating practices. • OPU Adoption Approval Authority : OPU CEO. Adoption of Level 2 : Framework, Standard, Guideline L2 Non - ED • Applicability : ➢ OPU is empowered to adopt or establish own governance document (minimum international standards or equivalent) that fit their business operating models. ➢ Where implementation by OPUs is required, the respective Upstream SMEs shall lead the communication and adoption of the L2 Non - ED. • Adoption Approach : Implement applicable “SHALL” requirements identify as key controls in the document through existing processes. • OPU Adoption Approval Authority : OPU CEO.
Adoption and Implementation Process Flow for L2 ED Enterprise Documents (ED) are adopted and implemented through the following structured process ED Dissemination & Awareness 1 Corporate Governance Provider (CGP) / Business SME Notifies OPU governance focal and deploys the ED in the governance system. Conducts upskilling and briefing sessions to explain intent, scope and key requirements . OPU Governance Focal Communicates and cascades ED deployment notifications to relevant OPU stakeholders (OPU SME etc.)
ED Assessment 2 OPU SMEs / OPU Governance Focal Assess applicability of ED to OPU operations . Identify gaps and provide clarification, guidance and recommendations to support adoption and operationalisation . Approval & Implementation3 OPU CEO Approve adoption of ED through my GOVERNANCE Communicate on the approved document
my GOVERNANCE A digital governance management platform for PETRONAS Group my GOVERNANCE Digital System User Interface All adoption of L1 Policy, L1 Directive, L2 ED to be conducted and completed through my GOVERNANCE
Screenshot of Document Adoption page Screenshot of Document View page
Section 8 Assurance
The Three Lines of Defence provides a structured approach to governance, compliance and assurance by defining clear roles, ownership, accountabilities and oversight responsibilities . In PETRONAS Upstream, assurance has evolved beyond compliance monitoring towards a risk - based approach focusing on strategic, critical and high - risk areas . Lines of Assurance Third Line Assurance (TLA) Independent assurance on governance, risk and control effectiveness, performed by Group Internal Audit (GIA) for Board Second Line Assurance (SLA) Risk- based oversight and challenge on critical risk areas conducted by Full Scale CGP, in collaboration with BU Upstream and OPUs. First Line Assurance (FLA) Self - assurance on internal control adequacy and effectiveness, conducted by Business & OPU for internal operational management Third Line of Defense Second Line of Defense TLD SLD FLD First Line of Defense
WHAT PrinciplesThird Line Assurance (TLA) How Assurance is Performed • Business operations are effective & efficient, • Management reporting is reliable & timely • Applicable policies, procedures, laws & regulations are complied • Independence in providing reasonable assurance to OPU Board. • Risk - based focus on strategic, critical and high - risk areas. Internal Audit (i.e. GIA ) WHO • Plan and execute audit engagements and assurance reviews. • Evaluate control effectiveness through testing and sampling. • Validate processes and practices through interviews and walkthroughs. • Identify improvement opportunities through root cause analysis. Reporting • Reports to Audit Committee Provide independent assurance on effectiveness of internal controls to support sound governance, risk management and compliance :
Principles How Assurance is Performed Provide assurance that governance, risk management and internal controls are adequate and consistently applied, particularly in critical and high - impact risk areas • Risk - based assurance focused on critical and high - impact risk areas. • Conducted by Full Scale CGP to provide independent oversight and assessment. • Integrated assurance planning endorsed by Internal Audit Management Committee (IAMC). Full scale Corporate Governance Provider (CGP) WHO • Independent validation of key controls • Risk - based and triggered reviews to assess governance implementation and emerging risks • Governance Implementation reviews Reporting • Reports to Management WHAT Second Line Assurance (SLA) 1. Group Health, Safety and Environment 2. Group Technology & Commercialisation 3. Group Project Engineering 4. Group Procurement 5. Group Security
WHAT Principles First Line of Assurance (FLA) How Assurance is Performed Ensure controls are working effectively in day - to - day operations • Business ownership and accountability reside with Business/OPU through self - governance. • Risk - based assurance is determined by BU/OPU management direction and business priorities. • Value - focused assurance to assess effectiveness and drive continuous improvement. • Business units • OPUs • Process owners • Operational management, • Coordinated by assurance focal at regional/ entities. WHO • Continuous monitoring (e.g. KPIs, dashboards) • Management oversight and reviews • Risk - based self - assessment based on BU/OPU management direction • Targeted validation of key control against operational & business ED • Upstream - specific Functional and Management System Checklists are the recommended primary reference for planning and conducting the FLA. Reporting • Primarily for internal operational management
Section 9 Roles and responsibilities
Role / Party Key Responsibilities OPU Approving Authority (OPU AA) 1. OPU Board approve adoption of L1 Policy and L1 Directive through Board meeting or Circulation & Resolution (CR) 2. OPU CEO approve adoption of L2 Enterprise Documents (ED) and L2 Non ED through myGovernance OPU Subject Matter Experts (SME) 1. Assess and interpret ED requirements (L1 ED, L2 ED, Non ED) and embed into OPU business strategy and operations. 2. Collaborate with OPU Governance Focal to prepare Board papers for approval for L1 ED adoption and support during Board sessions. 3. Adopt ED and L2 Non - ED requirements. Establish OPU - specific L1 Directive where required (e.g., name changes), any changes to the intent require document owner agreement. 4. Operationalise ED and Non - ED requirements through existing processes or development of L3 documents, where required. Demarcation of Responsibilities for Adoption
Demarcation of Responsibilities for ED Adoption Role / Party Key Responsibilities OPU Governance Focal 1. Communicate and cascade ED deployment notifications to OPU stakeholders. 2. Drive ED adoption and coordinate execution with OPU SMEs and CGP SMEs, including Board Secretariat for L1 ED adoption 3. Prepare Board papers for L1 adoption , in collaboration with OPU SMEs for content and support. 4. Plan adoption activities and manage the Board paper process for L1 ED, including Circular Resolution (CR) submissions. 5. Facilitate approval of ED in myGovernance . 6. Maintain adoption record, including upload approved documents/Board MOM and status updates in myGovernance . CGP SME 1. Provide technical and functional guidance to ensure correct interpretation and implementation of EDs within OPUs. 2. Review and provide concurrence on any OPU - proposed changes to L1 Directive wording, ensuring alignment with the original intent. UPRA - Governance 1. Provide oversight, guidance and escalation support to ensure effective ED adoption across Upstream 2. Drive overall communication and adoption of PGMF and EDs across Upstream OPUs through respective OPU Governance focal 3. Track ED adoption progress and compliance across OPUs. 4. Provide support function on myGovernance system
- END -