AUB : Updated Audit & Risk Management Committee Charter

4th July 2017

The Manager

Company Announcements Australian Securities Exchange Level 6, Exchange Centre,

20 Bridge Street

Sydney, NSW 2000

FOR RELEASE TO THE MARKET

Dear Sir / Madam,

Re: Audit & Risk Management Committee Charter

Please find attached the Company's updated Audit & Risk Management Committee Charter which is to replace the existing Charter with effect from today.

Yours faithfully,

Justin Coss Company Secretary

For further information, contact Justin Coss Tel: (02) 9935 2224

justinc@aubgroup.com.au

AUDIT & RISK MANAGEMENT COMMITTEE CHARTER

Effective 4th July 2017

1. ESTABLISHMENT

   This Charter governs the roles, responsibilities, composition and membership of the Audit and Risk Management Committee (Committee) of AUB Group (Company).

   The conduct of the Committee is also governed, where applicable, by the constitution of the Company (Constitution).

2. PURPOSE Audit

   The purpose of the Committee is to assist the board of Directors of the Company (Board) in fulfilling its statutory, corporate governance and oversight responsibilities by:

   • monitoring and reviewing:

     • the integrity of the Company's internal financial reporting and external financial statements;

     • the effectiveness of internal financial controls;

     • the independence, objectivity and performance of external auditors; and

     • the policies on risk oversight and management; and

   • making recommendations to the Board in relation to the appointment of external auditors and approving the remuneration and terms of their engagement.

     Ultimate responsibility for the integrity of the Company's financial reporting rests with the Board.

     Risk management

     The purpose of the Committee is to also assist the Board in fulfilling its responsibilities relating to the risk management and compliance practices of the Company.

     Ultimate responsibility for risk oversight and risk management rests with the Board.

3. MEMBERSHIP Members

   To the extent practicable given the size and composition of the Board from time to time, the Committee should have at least three (3) members, all of whom must be non-executive Directors and a majority of whom must be independent Directors. The members of the Committee will be appointed and removed by the Board.

   Expertise

   Each member of the Committee must be able to read and understand financial statements.

   To the extent practicable given the size and composition of the Board from time to time, the Committee must include:

   • at least one (1) member who has financial expertise, that is, a qualified accountant or other professional with experience of financial and accounting matters;

   • all members are financially literate, that is, are able to read and understand financial statements; and

   • some members who have an understanding of the industry in which the Company operates.

     Members of the Committee must have an appropriate level of understanding of the principles of corporate governance, including knowledge of the Australian Securities Exchange (ASX) Corporate Governance Principles and Recommendations (Recommendations).

     Chair and Secretary

     To the extent practicable given the size and composition of the Board from time to time, the Board will appoint an independent chairperson to the Committee (Chair). The Chair must not be the chairperson of the Board.

     The Company secretary will act as secretary of the Committee (Secretary) unless determined otherwise by the Board.

4. MEETINGS Frequency

   The Committee will meet as frequently as required in order to undertake its role effectively but must, at a minimum, meet four (4) times a year.

   The Secretary must call a meeting of the Committee if requested to do so by any member of the Committee.

   Agenda and notice

   The Secretary will be responsible, in conjunction with the Chair, for drawing up the agenda (supported by any necessary explanatory documentation) and circulating it to Committee members prior to each meeting. The Secretary must notify members of the Committee of the date, time and location of Committee meetings as far in advance as possible.

   Quorum

   A quorum for Committee meetings will be at least two (2) members, save that to the extent there is an independent director on the Committee one (1) of the members constituting the quorum must be an independent director.

   Minutes

   The Secretary is responsible for taking minutes of each meeting and distributing them to Committee members as soon as practicable after the close of the meeting.

   The minutes should ordinarily be included in the papers for the next full Board meeting after each Committee meeting.

   Attendance

   The Committee may invite any person to attend part or all of any meeting of the Committee as it considers appropriate. Voting at Committee meetings is restricted to Committee members. Any member of the Board may attend a meeting of the Committee as an invitee on their request.

   The external auditor will be invited to attend all Committee meetings to review the audit plan, discuss audit results and consider the implications of external audit findings.

5. POWERS Access

   The Committee has unrestricted access to management, external auditors and all Company records for the purpose of carrying out its responsibilities under this Charter.

   The Committee will meet with external auditors, in the absence of management, as often as required, but not less than once a year.

   Investigations

   The Committee has the power to interview management and, without management present, to:

   • conduct any investigations;

   • seek explanations and additional information;

   • engage any independent experts; and

   • interview any external auditors.

     The Committee has the power to engage any independent experts that it considers necessary or appropriate to help it fulfil its duties. Costs associated with these investigations will be borne by the Company.

6. RESPONSIBILITIES Risk oversight and management policies

   The Committee is responsible for providing the Board with advice and recommendations regarding the ongoing development of risk oversight and management policies that set out the roles and respective accountabilities of the Board, the Committee and management.

   The policies should cover the areas of oversight, risk profile, risk management, compliance and control and assessment of adequacy and effectiveness.

   Risk management and internal control environment

   The Committee shall consider and use its reasonable endeavours to:

   • maintain an up-to-date understanding of areas where the Company is, or may be, exposed to risk and compliance issues and check that management is effectively managing those issues, such as:

     • non-compliance with laws, regulations, standards and best practice guidelines including industrial relation, occupational health and safety, environmental and trade practice laws;

     • important judgements and accounting estimates;

     • litigation and claims;

     • fraud, theft or other breakdown of the entity's internal controls; and

     • relevant business risks not dealt with by other Board committees;

   • receive reports concerning material and actual incidents within the risk areas above and ensuring that macro risks are reported to the Board at least annually;

   • review the adequacy and effectiveness of the Company's policies and procedures which relate to risk management and compliance and reviewing the completeness and accuracy of the Company's principal corporate governance practices as required by ASX Listing Rules;

   • review material documents and reports prepared for lodgement with regulators, assessing their impact on the Company and making recommendations to the Board on their approval or amendment;

   • make recommendations to the Board on the appropriate risk and risk management reporting requirements;

   • meet periodically with senior key officers of the Company, external auditors and compliance staff to understand the Company's risk management and internal compliance and control system;

   • provide advice to the Board on relevant corporate level performance indicators and targets for risk management and compliance activities;

   • undertake an annual review of risk management policy and underlying strategies and procedures to check its continued application and relevance;

   • examine and evaluating the effectiveness of the internal control system with management and external auditors;

   • if considered necessary by the Committee, establish a periodic and independent review of the implementation and effectiveness of the risk management policy to provide objective feedback to the Board as to its effectiveness;

   • receive and consider reports on risk management and compliance programs and performance against policy and strategic targets;

   • review the adequacy of the Company's insurance coverage, having regard to the Company's business and the insurable risks associated with its business; and

   • examine any matters referred to it by the Board.

     External auditors

     The responsibilities of the Committee include:

   • providing a link between the external auditors and the Board;

   • reviewing and making recommendations on the performance and independence of the external auditors;

   • reviewing procedures for the selection and appointment of external auditors;

   • reviewing and providing recommendations on the rotation of external audit engagement partners;

   • recommending the appointment, remuneration and terms of engagement of the external auditors;

   • making recommendations to the Board on the removal of the external auditor;

   • agreeing the terms of engagement of the external auditor before the start of each audit;

   • reviewing the external auditor's fee and being satisfied that an effective, comprehensive and complete audit can be conducted for the external auditor's set fee;

   • reviewing and making recommendations on the scope and adequacy of the external audit, and any additional procedures with the external auditor, for Board approval;

   • reviewing all representation letters signed by management and ensuring all information provided is complete and appropriate;

   • reviewing and providing oversight of audit reports prepared and issued by the external auditors;

   • monitoring and examining management's response to the external auditor's findings and recommendations;

   • using reasonable endeavours to ensure that no management or other restrictions are placed on the external auditors; and

   • reviewing and making recommendations on any proposal for the external auditor to provide non-audit services and whether it might compromise the independence of the external auditor.

     Review of financial reports

     Duties of the Committee include:

   • making recommendation to the Board as to whether the Company's financial statements reflect the understanding of the members of the Committee of, and otherwise provide a true and fair view of, the financial position and performance of the Company;

   • requiring the CEO and the CFO to make signed and written declarations that, in their opinion (formed on the basis of a sound system of risk management and internal control which is operating effectively):

     • the financial records for the financial year have been correctly maintained;

     • the financial statements and notes for the financial year comply with the relevant accounting standards;

     • the financial statements and notes for the financial year give a fair and true view of the financial position and performance of the Company; and

     • any other matters in relation to the financial statements that are materially relevant;

   • reviewing financial statements for adherence to accounting standards and policies and the requirements of the ASX Listing Rules and the Corporations Act 2001 (Cth) (including continuous disclosure requirements);

   • assessing significant estimates and judgments in financial reports by examining the processes used to derive material estimates and judgments and seeking verification of those estimates from external auditors;

   • assessing information from external auditors that affects the quality of financial reports;

   • reviewing accounting policies adopted by the Company and any changes made to them;

   • asking the external auditor for an independent judgment about the appropriateness of the accounting policies adopted and the clarity of financial disclosure practices used by the Company;

   • reviewing management processes supporting compliance with laws, regulations and other requirements relating to the preparation of accounts and external reporting by the Company of financial and non-financial information;

   • discussing any significant matters arising from the audit, management judgments and accounting estimates with management and external auditors if appropriate; and

   • reviewing, and where necessary, challenging, the actions, choices and judgment of management in relation to all financial reports.

     Related party transactions

     The Committee is responsible for reviewing and monitoring the propriety of related party transactions.

7. REPORTING Reporting to the Board

   The Committee must report to the Board, at the first Board meeting subsequent to each Committee meeting, regarding the proceedings of each Committee meeting, the outcomes of the Committee's reviews and recommendations and any other relevant issues.

   The report must also contain, at a minimum, all matters relevant to the Committee's role and responsibilities, including:

   • an assessment of whether external reporting is in line with the information and knowledge of the Committee and whether it is adequate for the needs of the Company's shareholders;

   • an assessment of the internal management processes which support external reporting;

   • procedures for the selection and appointment of the external auditor and for the rotation of external audit engagement partners;

   • assessment of the performance and independence of the external auditors and, where the external auditors provide non-audit services, whether the independence of the external auditors has been maintained; and

   • the results of the Committee's review of risk management and internal compliance and control systems.

     Annual Report

     The Committee must provide the Board with advice and recommendations regarding the appropriate material and disclosures to be included in the Corporate Governance Statement and Operating and Financial Review of the Company's annual report which relate to the Company's audit and risk management policies and practices.

     The following information must be included in the Corporate Governance Statement or references to where the information can be found must be included in the Annual Report:

   • the names and qualifications of those appointed to the Committee and their attendance at meetings of the Committee;

   • the number of meetings of the Committee;

   • an explanation of any departures from the Recommendations;

   • whether the Board has received a report from management as to the effectiveness of the Company's management of its material business risks; and

   • whether the Board has received written assurances from the CEO and the CFO that:

     • the financial reports submitted to the Board present a true and fair view of the Company's financial condition and operational results; and

     • the Company's risk management and internal compliance and control system is operating efficiently and effectively.

       The Operating and Financial Review in the Company's Annual Report should include a discussion of environmental and other sustainability risks where those risks could affect the entity's achievement of its financial performance or outcomes disclosed, taking into account the nature and business of the entity and its business strategy (and otherwise comply with ASIC Regulatory Guide 247).

8. COMMITTEE'S PERFORMANCE EVALUATION

   The Committee will review its performance from time to time and whenever there are major changes to the management of the Company.

   The performance evaluation will have regard to the extent to which the Company has met its responsibilities in terms of this Charter.

9. REVIEW OF THE CHARTER

   This Charter shall be reviewed annually and revised by the Board as required.

10. PUBLIC AVAILABILITY OF MATERIALS

This Charter and a list of the members of the Committee with their relevant qualifications and experience shall be made publicly available on the Company's website.