PUBLIC SECTOR RISK MANAGEMENT FORUM CRO PRESENTATION 25

PUBLIC SECTOR RISK MANAGEMENT FORUM CRO PRESENTATION 25 FEBRUARY 2016

Table of Contents 1. Background 2. Expectations vs Reality: 2. 1 Management 2. 2 Risk Management Committee (RMC) 3. Possible causes 4. Solutions 5. Wrap-up 2

BACKGROUND • Risk Management’s existence in the public sector is mandated by Public Finance Management Act “PFMA”, Act 1 of 1999; Treasury Regulations, Public Sector Risk Management Framework (2010); Chapter 4 of the King III Report • The underlying key word in this statement is “existence”. • The question therefore becomes, what was happening in the control environment of various Sectors prior to the legislation and policy on Public Sector Risk Management (existence)? 3

CONTINUES • The answer is very simple: being able to realize the need to put systems in place and operationalize the Organization, hence developing efficient control environment is “Risk Management”. • It’s been 17 years on record, but still taking baby steps. There is an expectation set, that Chief Risk Officers must assist the institution to reach risk management maturity level 6. • Chief Risk Officers must do this through enforced collaborations with Management, Risk Management Committee and other stakeholders (such as Internal & Ext Audits) 4

EXPECTATIONS VS REALITY CRO EXPECTATIONS OF MANAGEMENT: 1. Accountability/ownership/ Membership of RMC 2. Collaboration with CRO to develop Risk Management Framework 3. Risk management incorporation in Business Unit’s governance processes 4. Cooperative relationship with RM Unit (Capacity of RM Unit) 5. Key risks presentation to RMC & AC 5

EXP AND REALITY- CONTINUES REALITY OUT OF THE EXPECTATIONS: 1. Delegated to Lower Level 2. It should be done by CRO as an expert 3. Risk put as last item on Agenda, due to time constraints item is never given attention 4. RM Unit perceived compliance force, therefore no time allocation 5. Not available for that responsibility, therefore, CRO fills the gap 6

KEY QUESTIONS BY MANAGEMENT • Do we have an approved risk management framework including risk plan? • Have we participated in a risk assessment process? • How do we develop a risk based strategic plan? • How do we demonstrate and incorporate risk management in our strategy? • How often have we discussed the same risk related issue the various management and governance meeting without taking steps to resolve? 7

EXPECTATIONS VS REALITY CRO EXPECTATIONS OF RISK MANAGEMENT COMM: 1. External independent members relevant skills, competencies and attributes 2. Enforce culture of RM through oversight/ regular report to Accounting Officer 3. Strong relationship with CRO to afford ongoing advise on various activities 4. Seamless flow of information between RMC and AC. AC member sitting on RMC for easy flow of information 5. Relationship with Audit Committee to share information 6. RMC oversight and advice on Risk Activities (OPERATIONAL RMC) 8

RMC-CONTINUES REALITY OUT OF EXPECTATIONS : 1. It takes long to abreast members on mandate and operations, which affects effectiveness/reputation 2. Difficulty in enforcing management accountability due to internal factors 3. Non availability outside chargeable hours 4. Sometimes ineffective as objective is not achieved (serve on multiple RMCs) 5. Conflicting roles and AC Chairperson’s expectations of RMC Chair 6. RMC independent members sometimes becomes operational 9

POSSIBLE CAUSES IN GAPS ID MANAGEMENT • Management’s lack of understanding of their RM roles and responsibilities • Lack of clear departmental strategic position on risk management • Misalignment between strategic planning management (reporting on plans vs risks) and risk • Lack of consequence for non performance 10

PREV SLIDE-CONTINUES RISK MANAGEMENT COMMITTEE • RMC not clearly defined by PFMA. Remuneration of members • Appointment process of independent RMC may be influenced due to prev/current relationships with administrators/political standing • Orientation simply not sufficient for new independent members • Difficulty in enforcing the RM culture when there are internal issues • Lack of commitment from Management on RMC scheduled activities 11

SUGGESTED SOLUTIONS MANAGEMENT • Commitment to RM training including e-learning • Alignment of APP with RM and PMDS for SMS • RM to become standing Agenda Item of BMC (Management committee) • Active participation in RMC • Appointment of dedicated risk coordinators • Become a Risk Champion 12

SUGG SOLUTIONS-CONTINUES RISK MANAGEMENT COMMITTEE • Normal recruitment and selection processes should be followed • Induction of RMC members should be undertaken prior to its first meeting. Individual member commitment to acquire further information from other mediums (reading extra material provided) • Formalized RMC evaluation processes to determine effectiveness of Committee • Committee to support RM and enforce alignment with strategy • Regularize one-on-one interactions with Accounting Officer • Clearly defined roles of RMC and AC to avoid conflicts and encourage collaboration 13