TestMu AI Enterprise Risk Management Framework

1. Overview

TestMu is an AI-native quality engineering company. The risks identified span strategy, operations and technology, finance, information security and privacy, Responsible AI, legal and regulatory compliance, third parties and business continuity, and they are interdependent.

This Enterprise Risk Management (ERM) Framework establishes how TestMu identifies, assesses, treats, monitors and reports those risks as one integrated discipline. It integrates the domain methodologies into a single lifecycle, a common assessment language, a defined risk appetite and clear ownership from Executive Leadership to individual control operators.

The Framework is aligned with ISO 31000:2018 (Risk management Guidelines), the COSO Enterprise Risk Management: Integrating with Strategy and Performance framework (2017) and the IIA Three Lines Model (2020). It incorporates and does not replace the domain-specific risk methodologies already operating within TestMu's management systems.

2. Purpose

The purpose of this Framework is to:

• Establish a consistent, company-wide approach to managing risk that supports the achievement of TestMu's strategic objectives and protects customers, employees, investors and other stakeholders.
• Define the governance structure, roles, responsibilities and authorities for risk management, from Executive Leadership to business functions.
• Set out TestMu's risk appetite and the tolerance within which management is expected to operate.
• Provide a common taxonomy, assessment methodology and a single Enterprise Risk Profile so that risks of different kinds can be compared, prioritized and reported on one basis.
• Integrate enterprise risk management with strategic planning, product development, supplier management, information security, privacy, Responsible AI, compliance and environmental, social and governance considerations.
• Enable independent assurance that risk is being managed as described, through internal audit, management review and external assessment.

3. Scope

This Framework applies to LambdaTest Inc. d/b/a TestMu, to all business functions (Engineering, Product, DevOps, IT, Customer Success, Sales, Marketing, Finance, Legal, Human Resources, the facilities function and Governance, Risk & Compliance), and to all locations in which TestMu operates. It covers each category of enterprise risk defined in Section 7, whether the risk arises from TestMu's own activities, from third parties acting on its behalf, or from the external environment.

The Framework applies to decisions at every level: strategic planning and budgeting, entry into new markets or product lines, the design and release of AI systems and features, the onboarding of suppliers and sub-processors, material changes to infrastructure, and the day-to-day operation of controls.

4. Risk Management Principles

Risk management at TestMu is guided by the principles the Company has adopted. Risk management is:

• Integrated into strategy, planning, product development and operations rather than run as a separate compliance activity.
• Structured and comprehensive, with one lifecycle, one taxonomy, one assessment scale and one Enterprise Risk Profile across all categories.
• Owned, with a named owner for each risk in scope and an operator for each control.
• Proportionate, directing leadership attention and funded treatment to the most significant risks.
• Evidence-based, with assessments grounded in incidents, audit findings, metrics, threat intelligence and stakeholder input.
• Transparent, so that Executive Leadership sees the enterprise risk position as it is, including the risks that have been accepted and why.
• Dynamic, reviewed on a fixed cadence and whenever the internal or external environment changes.
• Continually improving, feeding lessons from incidents, near misses, audits and customer assessments back into assessments, controls and this Framework.

5. Governance and Accountability

5.1 Governance Structure

Enterprise risk is governed through the same structure that governs the Company, as described in the Corporate Governance Charter. The Board of Directors provides strategic oversight and counsel to Executive Leadership; executive authority and accountability for the Company's governance rest with the Chief Executive Officer. Executive Leadership holds ultimate accountability; the Information Security & Compliance Steering Committee (ISCSC) provides oversight; the Governance, Risk & Compliance (GRC) function coordinates; and business functions own and treat the risks that arise in their areas. Independent assurance is provided by internal audit and by external auditors and certification bodies. For artificial-intelligence risk, the ISCSC (acting as the AI Governance Committee) exercises the AI Governance Committee's functions, supported by the AI Risk Officer.

Treatment plans for Critical risks are approved by Executive Leadership; for High risks by the ISCSC; for Moderate and Low risks by the risk owner's functional head with Governance, Risk & Compliance concurrence. Residual risk is accepted by the risk owner for Low and Moderate risks, by the ISCSC for High risks and by Executive Leadership for Critical risks.

5.2 Three Lines of Accountability

TestMu operates a three-lines model, consistent with the IIA Three Lines Model (2020). The first line: business functions and their risk owners that operate controls and manages risk in daily work. The second line: GRC, the Information Security Officer, the Data Protection Officer, the AI Risk Officer, Legal and, for financial risk, Finance that sets policy and methodology, monitors and challenges. The third line: internal audit, supported by independent external auditors and certification bodies providing assurance that the first two lines are effective. Second-line functions do not audit their own work, and third-line functions do not own controls.

6. Risk Appetite and Tolerance

Risk appetite is the amount and type of risk TestMu is willing to accept to meet its objectives. Executive Leadership sets risk appetite, reviews it each year or after major strategy changes, and defines a statement for each risk category. Risk tolerance is the measurable limit, expressed on the assessment scale in Section 9, within which management may operate without escalation; it is set so that the same acceptance rule applies across the enterprise and the management systems.

Where a risk assessment shows that the residual rating of a risk exceeds the tolerance for its category, the risk must be treated to bring it within tolerance or formally accepted at the authority level set out in Section 9.3. Operating outside tolerance without acceptance is a reportable non-conformity. Mandatory legal, regulatory, contractual and certification requirements are not subject to appetite: they are met regardless of the assessed rating of the risk.

7. Risk Taxonomy

All enterprise risks are classified into nine risk management categories. The taxonomy ensures that risks of different kinds are identified systematically, assigned to the right second-line function and domain methodology, and reported on a common basis. A risk is classified by its primary cause even if it has consequences across several categories; the additional consequences are recorded in the assessment. Information security, privacy and artificial-intelligence risks are governed day to day by a management system that is certified (ISO/IEC 27001, 27017, 27701) or aligned (ISO/IEC 42001, certification in progress), and the definitions below follow the scope of that system's documentation.

7.1 Categories and Second-Line Ownership

8. The Risk Management Lifecycle

Risks are managed through a continuous five-stage lifecycle, at enterprise level and within the management systems and the supplier risk-management process. Assessment is performed at three connected levels (organizational, functional or process, and system or use-case) and an organization-level assessment does not replace the assessment of an individual system or processing activity.

9. Risk Assessment and Treatment

9.1 Assessment

Likelihood and impact are each assessed on the Company's assessment scale using the criteria shared with the information security, privacy and AI management systems. Impact is assessed across financial, customer and service, legal and regulatory, reputational and people dimensions, and the highest applicable dimension determines the assessment. Risks are rated Low, Moderate, High or Critical from the combination of impact and likelihood on the Company's assessment scale. The rating determines the response the risk requires: risks within TestMu's acceptance criteria are monitored; risks above them require a treatment plan and approval at a level that rises with the rating. Acceptance criteria and treatment thresholds are defined in the Company's management-system manuals. Domain assessments carry into the Enterprise Risk Profile at the same rating, so a High or Critical risk in the information security, privacy or AI risk records is a High or Critical risk at enterprise level. An AI system subject to an open hard-stop condition is treated as Critical regardless of its assessed value until the condition is resolved.

9.2 Inherent and Residual Risk

Each risk is assessed twice. The inherent assessment assumes no controls are in place and shows the exposure TestMu would carry if its controls failed. The residual assessment takes account of existing controls and their evidenced effectiveness and is the basis for prioritization, reporting and acceptance decisions.

9.3 Treatment and Acceptance

Four treatment options are available: apply controls to reduce likelihood, impact or both; avoid the activity giving rise to the risk; transfer or share the risk through insurance, contractual allocation or outsourcing, recognizing that accountability for TestMu's own obligations cannot be transferred; or accept the risk with documented justification. Treatment plans for Critical risks are approved by Executive Leadership; for High risks by the ISCSC; for Moderate and Low risks by the risk owner's functional head with Governance, Risk & Compliance concurrence. Residual risk is accepted by the risk owner for Low and Moderate risks, by the ISCSC for High risks and by Executive Leadership for Critical risks. Each acceptance carries conditions, monitoring and a review date. Acceptance of a risk that affects customer data, personal data, certified controls or the behavior of an AI system in production additionally requires the concurrence of the Information Security Officer, Data Protection Officer or AI Risk Officer, and acceptance of artificial-intelligence risk by the ISCSC is exercised in its AI governance capacity. Mandatory legal, regulatory, contractual, certification or organizational requirements and defined hard-stop conditions cannot be overridden through internal risk acceptance.

10. The Enterprise Risk Profile

GRC maintains the Enterprise Risk Profile as the single consolidated view of enterprise risk. It draws together the information security, privacy, AI and third-party risk records maintained under the respective management systems, which remain the authoritative record for their domains. Each risk in the profile has an owner, an inherent and residual assessment, the controls relied on, a treatment plan where required and any acceptance decision. The profile is reviewed in full by GRC and the risk owners at least annually, and the Enterprise Risk Profile is reviewed by the ISCSC quarterly.

11. Monitoring and Reporting

High and Critical risks are monitored through key risk indicators where practicable, consolidated by GRC and reviewed by the ISCSC. The Enterprise Risk Profile, top risks, treatment progress, exceptions and emerging risks are reported to the ISCSC each quarter and to Executive Leadership through Executive Leadership's quarterly review; the AI Risk Officer reports the AI risk records, AI incidents and hard-stop conditions to the ISCSC on the same cycle. Any newly identified Critical risk, any risk moving outside tolerance, any hard-stop condition and any incident of major or severe impact is escalated immediately.

12. Integration with Business Processes

Enterprise risk management is embedded in the processes through which TestMu already makes decisions, so that risk assessment is a condition of proceeding rather than an afterthought. Risk assessment is required for:

• strategic planning and budgeting;
• material product and infrastructure changes;
• the design, release and material change of AI systems, which follow the AI lifecycle and the AI risk and impact assessment defined under the AI management system; the AI Risk Officer recommends and the ISCSC approves the release, restriction or withdrawal of an AI system, with residual risk accepted at the authority level set out in Section 9.3;
• supplier onboarding and periodic reassessment;
• business impact analysis and continuity planning;
• changes in law and regulation, for which compliance obligations are tracked by Legal and GRC;
• environmental, social and governance risks identified through the Company's governance and responsible-business processes; and
• every significant incident, which triggers a review of the related risk entries.

13. Emerging Risk and Horizon Scanning

GRC, with Legal and the second-line leads, maintains a horizon-scanning process to identify emerging risks before they crystallize. Sources include regulatory trackers for AI, privacy and security law across the jurisdictions in which TestMu operates and sells; threat intelligence and vulnerability feeds; industry and standards bodies; customer assessment trends; and internal signals such as near misses and audit observations. Emerging risks are recorded in the Enterprise Risk Profile with a provisional assessment, reviewed quarterly by the ISCSC and converted to managed risks with owners and treatment plans when their likelihood or impact becomes material.

14. Competence, Awareness and Culture

Effective risk management depends on people understanding the risks in their work and feeling able to raise them. All employees receive risk awareness as part of mandatory onboarding and annual training, alongside information security, privacy, Code of Business Conduct & Ethics and Responsible AI training. Risk owners and departmental representatives receive role-based training on this Framework, the assessment methodology and the Enterprise Risk Profile. Second-line leads maintain professional competence in their domains. Concerns about risk, including risks that management has not recognized, may be raised through line management, GRC or the confidential channels set out in the Whistleblower Policy. TestMu prohibits retaliation of any kind against any person who, in good faith, raises a concern, reports a suspected breach or assists an investigation, whether or not the concern is substantiated. Retaliation is itself a breach of the Code of Business Conduct & Ethics and is subject to disciplinary action following investigation. Knowingly making a false report is also a breach.

15. Assurance and Continual Improvement

The design and operation of this Framework are subject to assurance on a fixed calendar. Internal audit evaluates the Framework and the operation of key controls at least annually and reports to the ISCSC. Management review, conducted at least annually by Executive Leadership, considers the performance of the Framework, the risk appetite, the Enterprise Risk Profile, audit results, incidents, key risk indicator trends, changes in the internal and external context and opportunities for improvement. Independent certification bodies and auditors assess the domain risk methodologies as part of the ISO/IEC 27001, 27017 and 27701 certification cycle, the SOC 2 Type II examination and the ISO/IEC 42001 implementation. Non-conformities and improvement opportunities from any of these sources are recorded, root-caused, assigned to owners and tracked to closure by GRC.

16. Framework Maintenance

This Framework is owned by the Governance, Risk & Compliance function, reviewed at least annually and on any material change in TestMu's strategy, structure, operations, regulatory environment or technology, and reviewed by the ISCSC and approved by the Chief Executive Officer on behalf of Executive Leadership.