Bringing corporate governance principles to life

The leading roles of the corporate governance and risk management fraternities in South Africa were yet again demonstrated, by the recent award of the IRMSA Risk Influencer of the Year 2017 to the King Committee on Corporate Governance at the Institute of Directors Southern Africa. Not only do we lead in our respective disciplines, but the award further demonstrates the benefit we gain from working closely together to align risk management practices with the desired corporate governance outcomes in King IV. Given that risk management principles are strongly embedded throughout King IV, it is imperative for risk managers in all sectors to evaluate how we bring these principles to life when we execute our risk management processes. As a starting point, we must understand what the end users of the risk management process want to achieve and whether we, as risk managers, satisfy those requirements in a user friendly and transparent manner. It is helpful to ask ourselves whether the risk management processes that we deliver enable our executives to provide our directors with the information they require to fulfil their risk governance duties. This goes for all entities (as King IV makes clear in the sector supplements). According to King IV, directors have to achieve the following: Directors should steer our organisation and set strategic direction: Do we, as risk managers, engage on our organisation’s strategy, purpose, mandate, vision and mission? Do we understand the inherent risks in each of these? If not, why are we not included in strategy discussions? What do we do to earn our seat at the table? If we do engage on strategy, do we facilitate the discussion to set a risk-adjusted strategy? Do we help our organisation understand the risks that may prevent us from achieving our strategy? More importantly, do we help our organisation understand the risks if we do achieve our strategy, ie the unintended consequences of success? Do we guide our colleagues in risk workshops to align their risks to the organisation’s strategic objectives at strategic, tactical, operational and process levels in a meaningful way? Do we evaluate the risk mitigation strategies we develop for alignment to the King IV outcomes of: ethical culture good performance internal controls And do we formally report to the board on this? If they do not align, what does it say of our risk management capabilities and our organisational culture? Our directors should approve our organisation’s policy and planning: Is our risk management policy aligned to what our organisation wants to achieve? Can we relate each activity we do to the policy, or are we following a compliance-based approach? Do we understand the negative return on investment in risk management if we only comply? Have we considered our risk-bearing capacity, risk tolerance and risk appetite levels in terms of the triple context within which our organisation operates? This means: have we thought about these levels in terms of our impact on the economy, society and the environment? Have we considered our risk-bearing capacity, risk tolerance and risk appetite levels in context of the capitals we use to execute our business, ie financial, manufactured, intellectual, human, social and relationship, and natural capital? How much do we use, how much do we destroy, how much do we give back and how much do we have left after our business outputs have been delivered? Do we understand how far we are from bankruptcy in all of the capitals, not only financial capital? Our directors should effectively oversee and monitor our organisation: Do we have a risk universe that informs our organisation where our risks may come from? Have we clearly defined key risk indicators and risk appetite metrics that are aligned to our strategy, our top risks and our risk universe? Have we applied SMART (specific, measurable, actionable, realistic, timeous) principles to our risk metrics? If we have a separate risk impact criteria table, does this talk to our risk appetite levels and metrics? How do we make sure that information from all levels is transparently fed through to the governing body? How much of what should be reported gets lost as reports are escalated through our organisation? Can we have the difficult discussions to ensure honest and transparent reporting? Have we built a strong relationship with our internal audit colleagues to ensure we have a robust combined assurance process that provides our directors with reliable information on the adequacy and effectiveness of our risk management process? Our directors should ensure accountability in the effective running of our organisation: Do we, as risk managers, have a clear understanding of the extent to which risk management is included in our governing body’s charter and the sub-committees’ terms of reference? Do we make sure our reporting intelligently addresses those elements? Does the governing body approve the inclusion of risk management in the performance contract of our CEO (or similar accountable individual)? Do we have clearly defined roles and responsibilities for risk management? Do we, as risk managers, understand what this is and how we support delivery thereon by risk and control owners? Do we engage with our organisation’s governance structures to build risk management decision-making elements into our organisation’s delegation of authority? Do we have a risk escalation protocol that guides all our colleagues on how to communicate and manage risks in a uniform fashion? Once we are on a journey where we know why we do what we do, who we deliver to and how we facilitate the process where our organisation manages its risks, we should make sure that we remain true to the level of risk management maturity that is appropriate for our organisation. We should track our risk culture and risk management maturity continuously and aligned with our strategy and our risk universe, to ensure we remain relevant in the aim to enable our directors to govern our organisation’s risks in accordance with their fiduciary duties. Contributed by Christelle Marais, practice leader, strategic risk consulting at Marsh Africa Marsh Risk Consulting

Bringing corporate governance principles to life

Want to read this article?

Read Next

Munich Re reorganises P&C underwriting in Asia Pacific, Middle East & Africa

Climate change to cause ‘massive economic damage’

Somali piracy attacks resurge in 2024, warns IMB

EU and US co-lead effort to tackle critical raw material supply chain risk

South Africa to see continuing property and motor rate increases

Munich Re reorganises P&C underwriting in Asia Pacific, Middle East & Africa

Climate change to cause ‘massive economic damage’

Somali piracy attacks resurge in 2024, warns IMB

EU and US co-lead effort to tackle critical raw material supply chain risk

South Africa to see continuing property and motor rate increases

Want to read this article?

Read Next

Munich Re reorganises P&C underwriting in Asia Pacific, Middle East & Africa

Climate change to cause ‘massive economic damage’

Somali piracy attacks resurge in 2024, warns IMB

EU and US co-lead effort to tackle critical raw material supply chain risk

South Africa to see continuing property and motor rate increases

Related Articles