Professional Documents
Culture Documents
ZA RiskCommitteeResourceGuideOnline2014 22052014
ZA RiskCommitteeResourceGuideOnline2014 22052014
ZA RiskCommitteeResourceGuideOnline2014 22052014
Resource Guide
For related information and guidance, visit the Deloitte Centre for
Corporate Governance website at:
www.deloitte.co.za
Contents
Introduction:
Section 1:
Section 2:
Section 3:
Section 4:
Section 5:
Conculsion:
Appendix A:
Appendix B:
Appendix C:
Appendix D:
Contacts............................................................................................. 93
Risk Committee Resource Guide
Introduction
Risk committees
become reality
Risk Committee Resource Guide
1
The Dodd-Frank Wall Street Reform and Consumer Protection Act is a federal statute in the United States signed into law by President
Barack Obama on July 21, 2010. It promotes the financial stability of the United States by improving accountability and transparency in
the financial system, ending too big to fail, protecting the American taxpayer by ending bailouts, protecting consumers from abusive
financial services practices, and other purposes.
Oversight
Common Risk
Infrastructure
People Process Technology
Section 1
Considerations
in forming a
risk committee
Risk Committee Resource Guide
10
11
12
13
14
Section 2
Risk committee
charter and
composition
Risk Committee Resource Guide
15
16
17
18
19
20
Notes:
21
Section 3
Fulfilling
risk-oversight
responsibilities
22
23
24
Responsibilities
Broadly, the responsibilities of a risk committee
may include the following:
Oversee the risk management
infrastructure: The full board may oversee the
organisations risk management infrastructure
(see sidebar below), or this oversight
responsibility can be delegated to the risk
committee, rather than to the audit committee
(the committee that historically has had
primary responsibility for overseeing the risk
management infrastructure). The JSE Listing
Requirements permit the board of a listed
company to delegate this responsibility to a risk
committee, rather than to the audit committee
where the responsibility is delegated to a
combined audit and risk committee, listed
companies must ensure that in these instances
the membership of the combined committee
meets the more stringent independence criteria
of the audit committee as set out in King III
(see comments above).
Address risk and strategy simultaneously:
Address risk management and governance
when strategies for growth and value
creation are being created and management
decisions are being made. The purpose of this
responsibility is typically not to promote risk
avoidance, but the opposite - to promote risktaking for reward in the context of sound risk
governance.
25
26
27
28
29
30
31
Risk-oversight disclosures
King III requires the board to disclose in the companys Integrated Report how it has satisfied itself
that risk assessments, responses and interventions are effective. In order to provide a comprehensive
report to shareholders and other stakeholders, Deloitte has developed a list of points which boards,
risk committees, and senior management can use to help determine what may be appropriate and
useful to disclose:
Whether the full board is responsible for risk
Whether the company has a separate risk committee
Whether the risk committee or the audit committee is the primary committee responsible for risk
Whether other board committees are involved in risk oversight
Whether the remuneration committee is responsible for overseeing risk in remuneration plans
Whether the CEO is responsible for risk management or how the CEO is involved in risk
Whether the company has a CRO
The boards involvement with regard to the companys risk appetite
How the board is involved with regard to corporate culture
Whether risk oversight and management are aligned with the companys strategy
Whether the company has a risk committee at the management level
Whether the company separately addresses reputational risk
Whether any undue, unexpected or unusual risks were taken in the pursuit of reward as well as any
material losses and the causes of the losses. This disclosure should be made with due regard to the
companys commercially privileged information. In disclosing the material losses, the board should
endeavour to quantify and disclose the impact that these losses have on the company and the
responses and interventions implemented by the board and management to prevent recurrence of
the losses.
32
33
34
Notes:
35
Section 4
36
Risk intelligent
enterprise
Risk Committee Resource Guide
37
38
Collectively, these areas of focus reflect the view that risktaking for reward and growth is as important as risk mitigation
to protect existing assets. By treating risk as intrinsic to the
conduct of business, Risk Intelligent governance elevates risk
management from an exercise in risk avoidance to an essential
consideration in every decision, activity, and initiative.
39
40
41
42
43
44
Establish accountability. The risk committee should establish and reinforce executive accountability
for risk management. One way to do this is to expect full disclosure by management of the risks
associated with each aspect of the strategy. Give management on-going feedback about your
satisfaction with their level of disclosure and the quality of risk-reward analyses. A formal evaluation
process for specific executives, led by the chair of the risk committee may be considered.
45
46
One important management responsibility is to continually monitor the companys risk exposures,
evaluate actual risk exposure levels against the stated risk appetite, and adjust risk tolerances and
policies as necessary to align actual risk exposure with the desired risk exposure as defined by the risk
appetite. By having management report on this process to the risk committee, members can gain
insight into whether there may be opportunities for further risk-for-reward strategies or, conversely, if
the organisation is overly stretched in its risk levels.
Actions to consider in helping to define the risk appetite:
Distinguish between risk appetite and risk tolerance. Many business unit leaders and some
senior executives fail to distinguish between risk appetite and risk tolerance. As a result, many
organisations either set arbitrary risk tolerances that do not track back to an overall risk appetite, or
wrongly assume that a general statement of risk appetite gives decision-makers enough operational
guidance to stay within its parameters. The risk committee can help the organisation steer clear of
these traps by assisting management in developing a cogent approach to defining the risk appetite,
specifying risk tolerances, and communicating them across the enterprise.
Serve as a sounding board. The committee should be available as a resource for helping senior
executives understand and reconcile various views of risk within the organisation. One way to do
this is to ascertain how management balances and aggregates the business units risks as well as
how management sets various risk tolerances, particularly in relatively risky businesses or markets.
47
48
Clarify accountability at the board and management levels. Complete, on-going disclosure
of major risk exposures by the CEO to the committee and the board is fundamental to a Risk
Intelligent governance process. We suggest that that committee works with the CEO to verify
that responsibility for specific risks and related activities has been assigned to specific members of
the management team. In doing this, its important for the committee and the CEO to maintain a
constructive, collaborative relationship but that need not stop the risk committee from discussing
difficult issues with management and questioning practices when doubts arise.
Risk
Intelligence
Program
Methodology
Its important for the risk committee and the CEO to maintain a
constructive, collaborative relationship.
Risk Committee Resource Guide
49
50
Notes:
51
Include risk as a topic in the annual board self-assessment. The boards annual self-assessment
process provides a broad view into how the full board feels that it is performing in its overall
governing body role. Including questions in the assessment form focused specifically on risk
governance effectiveness can be a valuable guide to measuring the committee and the individual
members effectiveness in providing Risk Intelligent governance. The nominations committee may
wish to consider reviewing the assessment form to verify that it includes such language.
Ask for feedback from senior executives on how well you and your
fellow board members have played your risk oversight role.
53
54
Section 5
On-going
education
and periodic
evaluation
Risk Committee Resource Guide
55
56
57
Conclusion
Ever vigilant,
continually
improving
58
59
60
61
62
Appendix
A
Risk Committee Resource Guide
63
This sample risk committee charter is based on leading practices observed by Deloitte in the analysis
of a variety of materials.
It is important to note that the Risk Committee Resource Guide practices are drawn from Deloitte
experiences and our understanding of practices currently being used.
Deloitte does not accept any responsibility for any errors this publication may contain, whether caused
by negligence or otherwise, or for any losses, however caused, sustained by any person that relies
on it. The information presented can and will change; we are under no obligation to update such
information. Deloitte makes no representations as to the sufficiency of these tools for your purposes,
and, by providing them, we are not rendering accounting, business, financial, investment, legal, tax,
or other professional advice or services. These tools should not be viewed as a substitute for such
professional advice or services, nor should they be used as a basis for any decision that may affect
your business. Before making any decision or taking any action that may affect your business, you
should consult a qualified professional adviser.
Deloitte does not assume any obligations as a result of your access to or use of these tools.
This template is designed for South African public companies; exceptions to the requirements noted
below may apply for certain issuers, including investment companies, small-business issuers, and
foreign private issuers. All companies should consult with legal counsel regarding the applicability and
implementation of the various requirements identified. Further, this template should be tailored on a
company-by-company basis to meet the needs and specific situations for each company utilising the
tool.
64
65
66
67
The risk management policy should set the tone for risk management in the company and should
indicate how risk management will support the companys strategy. The risk management policy
should include the companys definitions of risk and risk management, the risk management
objectives, the risk approach and philosophy, as well as the various responsibilities and ownership for
risk management within the company.
The committee should review the risk management plan at least once a year.
Define risk review activities regarding the decisions (e.g. acquisitions), initiatives (e.g. new products),
and transactions and exposures (e.g. by amount) and prioritise them prior to being sent to the
boards attention
Review and confirm that all responsibilities outlined in the charter have been carried out
Monitor all enterprise risks; in doing so, the committee recognises the responsibilities delegated to
other committees by the board and understands that the other committees may emphasise specific
risk monitoring through their respective activities
Conduct an annual performance assessment relative to the risk committees purpose, duties, and
responsibilities; consider a mix of self- and peer- evaluation, supplemented by evaluations facilitated
by external experts
Oversee the risk program/interactions with management
Review and approve the risk management infrastructure and the critical risk management policies
adopted by the organisation
Periodically review and evaluate the companys policies and practices with respect to risk assessment
and risk management and annually present to the full board a report summarising the committees
review of the companys methods for identifying, managing, and reporting risks and risk
management deficiencies
Continually, as well as at specific intervals, monitor risks and risk management capabilities within the
organisation, including communication about escalating risk and crisis preparedness and recovery
plans
Continually obtain reasonable assurance from management that all known and emerging risks have
been identified and mitigated or managed
Communicate formally and informally with the executive team and risk management regarding risk
governance and oversight
68
Discuss with the CEO and management the companys major risk exposures and review the steps
management has taken to monitor and control such exposures, including the companys risk
assessment and risk management policies
Review and assess the effectiveness of the companys enterprise-wide risk assessment processes and
recommend improvements, where appropriate; review and address, as appropriate, managements
corrective actions for deficiencies that arise with respect to the effectiveness of such programs
Monitor governance rating agencies and their assessments of the companys risk and proxy advisory
services policies, and make recommendations as appropriate to the board
In coordination with the audit committee, understand how the companys internal audit work plan
is aligned with the risks that have been identified and with risk governance (and risk management)
information needs
Reporting
Understand and approve managements definition of the risk-related reports that the committee
could receive regarding the full range of risks the organisation faces, as well as their form and
frequency
Respond to reports from management so that management understands the importance placed on
such reports by the committee and how the committee views their content
Read and provide input to the board and audit committee regarding risk disclosures in financial
statements and other public statements regarding risk
Keep risk on both the full boards and managements agenda on a regular basis
Coordinate (via meetings or overlap of membership), along with the full board, relations and
communications with regard to risk among the various committees, particularly between the audit
and risk committees
Disclose in the companys Integrated Report how it has satisfied itself that risk assessments,
responses and interventions are effective
69
Charter review
Review the charter at least annually and update it as needed to respond to new risk-oversight needs
and any changes in regulatory or other requirements
Review and approve the management-level risk committee charter, if applicable
Perform any other activities consistent with this charter, the companys bylaws, and governing laws
that the board or risk committee determines are necessary or appropriate
Submit the charter to the full board for approval
70
Notes:
71
72
Appendix
73
74
Meeting month
December
November
October
September
August
July
June
May
April
March
February
Suggested
frequency
January
Action/Responsibility
Comments
Enterprise Responsibility
Help to set the tone and develop a culture of the enterprise vis--vis risk,
and promote open discussion regarding risk, integrate risk management
into the organisations goals and compensation structure, and create a
corporate culture such that people at all levels manage risks rather than
reflexively avoid or heedlessly take them.
Continuously
Annually
Continuously
Annually and
as needed
Continuously
Annually and
as needed
Annually
Annually
75
76
Annually and
as needed
Continuously
Continuously
Continuously
Continuously
Annually and
as needed
Annually and
as needed
Annually
Ensure that the companys CRO (if applicable) has sufficient stature,
authority, and seniority within the organisation and is independent
from individual business units within the organisation
Annually and
as needed
Each board
meeting
Reporting
Annually and
as needed
Annually and
as needed
Read and provide input to the board and audit committee regarding
risk disclosures in financial statements, proxy statements, and other
public statements regarding risk
Annually
Continuously
Continuously
77
Charter review
78
Annually and
as needed
Annually
Perform any other activities consistent with the charter, the companys
bylaws, and governing laws that the board or risk committee
determines are necessary or appropriate
Continuously
Annually
Notes:
79
Appendix
80
81
82
The following questionnaire is based on our knowledge and understanding of emerging and leading
practices and is designed to assist in the self-assessment of a risk committees performance. It is not
intended to be all inclusive and, if used, should be modified to accommodate a companys specific
circumstances.
When completing the performance evaluation, consider the following process:
Select a coordinator and establish a timeline for the process
In addition to risk committee members completing the form as a self-evaluation, ask individuals
who interact with the risk committee members to provide feedback
Ask each risk committee member to complete an evaluation by selecting the appropriate rating that
most closely reflects the risk committees performance related to each practice
Consolidate the results of such inquiry and evaluation into a summarised document for discussion
and review by the committee
Sample evaluation questionnaire
For each of the following statements, select a number between 1 and 5, with 1 indicating that
you strongly disagree and 5 indicating that you strongly agree with the statement. Select 0 if the
statement is not applicable or you do not have enough knowledge or information to rank the
organisations risk committee on a particular statement.
83
Strongly disagree
Strongly agree
Insufficient knowledge
84
Strongly agree
Strongly disagree
Insufficient knowledge
Financial exposures
Business continuity
Company reputation
Management override
Fraud control
85
Strongly disagree
10. The risk committee sets clear expectations and provides feedback to the
full board concerning the competency of the organisations CRO and the
risk management team.
11. The risk committee has input into the succession planning process for
the CRO.
12. The agenda and related information (e.g., prior meeting minutes,
reports) are circulated in advance of meetings to allow risk committee
members sufficient time to study and understand the information.
Strongly agree
Insufficient knowledge
2. The risk committee discusses the companys risk appetite and specific
risk tolerance levels in conjunction with strategic objectives, as presented
by management, at least annually.
86
Insufficient knowledge
Strongly disagree
13. Written materials provided to risk committee members are relevant and
at the right level to provide the information the committee needs to
make decisions.
14. Meetings are held with enough frequency to fulfil the risk committees
duties at least quarterly, which should include periodic visits to company
locations with key members of management.
15. Regularly, risk committee meetings include separate private sessions with
business-unit leaders, the CRO or equivalent, and the internal auditor.
17. The risk committee meets periodically with the committee(s) responsible
for reviewing the companys disclosure procedures (typically the audit
committee) in order to discuss respective risk-related disclosures.
18. The risk committee coordinates with other board committees (e.g.,
audit committee) to avoid gaps or redundancy in overseeing individual
risks.
19. The risk committee respects the line between oversight and
management of risks within the organisation.
22. The company provides the risk committee with sufficient funding to fulfil
its objectives and engage external parties for matters requiring external
expertise.
Strongly agree
Monitoring activities
Communication activities
23. The risk committee communicates regularly with regulators and others
on risk management-related matters.
87
88
Appendix
D
Risk Committee Resource Guide
89
Board
structure
knowledge
management
Failure to
understand
and exercise
fiduciary duties
Ineffective/
insufficient
independent
committees
Poor
communication
from
management
Inadequate
knowledge
of board
responsibilities
Inadequate
understanding
of the
organisations
business
Limited
exposure to
management
outside of the
CEO and CFO
Lack of board
cohesiveness
and leadership
Compensation/
performance
incentives/
alignment
Corporate
Responsibility
&
Sustainability
(CR&S)
Lack of
appropriate
tone at the
top set by
leadership
Inadequate
disclosure of
compensation
process and
philosophies
Failure to
meet social
responsibility
obligations
Weak
structure/
composition of
the board
Ineffective
communication
between and
among the
board and
management
Board conflict
of interest
or lack of
independence
Inappropriate
decisionmaking and
delegation of
authorities
Poor
cooperation
and
organisational
alignment
Inadequate
attention to
strategy and
execution
90
Misalignment
of performance
metrics with
long-term
strategy
Executive
compensation
inconsistent
with
stakeholder
expectations
Undue
emphasis on
the short-term
results
Misalignment
of incentives
and rewards
Lack of
involvement
from
appropriate
levels of
management
Inadequate
oversight over
CR&S activities
Lack of
adequate
disclosure of
CR&S activities
Reputation/
Risk-oversight
stakeholder
relations
Inadequate
board oversight
of risk
management
activities
Failure to
understand
trends
related to the
organisations
workforce,
creditors,
customers,
and other
stakeholders
Inadequate
structure to
allow for an
enterprise risk
management
process
Failure to
adequately
consider and/
or respond to
shareholders
proposals
Poor
corporate
brand
perception
Ethical
culture/
financial
integrity
tone at the
top
Crisis
CEO
succession
management
Inability to
understand
and meet
shareholder
expectations
Real or
perceived
influence
of majority
shareholders
Transparency
and
Cursory
reviews of
financial
statements
and related
disclosures
Failure to
challenge
management
assumptions
Inadequate or
inappropriate
risk appetite
and tolerances
Inadequate
oversight
of internal
and external
auditors
Lack of Risk
Intelligent
decisionmaking
Inadequate
of unqualified
finance
organisation
Inadequate
risk-related
public
disclosure
Lack of
financial
expertise on
the audit
committee
Inadequate
utilisation of an
appropriate risk
framework
Lack of risk
management
expertise
on the risk
committee (or
board)
Failure to
foster an
ethical culture
Inappropriate
performance
incentives
Failure
to monitor
and control
unauthorised
activities
Failure
to protect
whistleblowers
planning
Lack of
planning for
management
during crisis
Lack of
discussion or
formal plan for
CEO succession
No
formal crisis
management
plan exists
Inadequate
focus placed
on recruitment,
development
and
deployment
of quality
leadership
Lack of
definition of
roles during
crisis
Representative questions that the board might ask in managing board-level risks
Managing known risk areas
Is there a common
understanding of risk and
opportunity?
Is there a common
language to bridge risk
and business silos? Is it
ingrained into the risk
framework?
How much can be gained
by properly managing
this risk? How much is
it costing us (or will it
cost us) to manage this
risk? What is the cost of
inaction?
What are the different
ways in which value can
be created or destroyed?
Does our risk
management or mitigation
strategy introduce any
additional risks?
Can we detect
significant changes in the
environment (including
regulatory changes)
that affect our business
model and its underlying
assumptions?
What might be the
unintended consequences
of our decisions? Can we
detect them?
Does the enterprise have
common triggers to alert
leadership to strategic
changes?
Does bad news travel fast
or have there been delays
in escalating negative
issues?
How do we monitor for
potential new business
activity, new transaction
types, and new customers
and counterparties?
91
92
Contacts
Dr Johan Erasmus
Nina le Riche
93
94
Deloitte refers to one or more of Deloitte Touche Tohmatsu Limited, a UK private company limited by
guarantee, and its network of member firms, each of which is a legally separate and independent entity.
Please see www.deloitte.com/about for a detailed description of the legal structure of Deloitte Touche
Tohmatsu Limited and its member firms.
Deloitte provides audit, tax, consulting and financial advisory services to public and private clients spanning
multiple industries. With a globally connected network of member firms in more than 150 countries, Deloitte
brings world-class capabilities and high-quality service to clients, delivering the insights they need to address
their most complex business challenges. The more than 200 000 professionals of Deloitte are committed to
becoming the standard of excellence.
This communication contains general information only, and none of Deloitte Touche Tohmatsu Limited,
its member firms, or their related entities (collectively, the Deloitte Network) is, by means of this
communication, rendering professional advice or services. No entity in the Deloitte Network shall be
responsible for any loss whatsoever sustained by any person who relies on this communication.
2014 Deloitte & Touche. All rights reserved. Member of Deloitte Touche Tohmatsu Limited
Designed and produced by Creative Services at Deloitte, Johannesburg. (807472/ryd)