Risk management approach in new risk trends – Risk Advisory and Root Cause Analysis M Khumalo

Changing Risk Management Value Proposition To protect and enhance institutional value by mitigating against threats to organizational performance whilst leveraging on opportunities. Traditional value add – minimizing wastages, proactively identifying threats to institutional performance, ensuring compliance and avoiding penalties and fees. Modern and current trends – enhancing institutional performance through robust strategy formulation, proactive management of downturns in performance and optimizing opportunities. (Enterprise) RM plays an even deeper role in serving as a linkage to different strategic points within the organization. RM also plays a critical role in enhancing stakeholder value – stakeholders more interested in how the organizations goes about implementing its strategy. Further linkages to other disciplines such as governance, compliance, ethics and integrity management. Changing Risk Management Value Proposition

Risk Assurance failure – Lessons for new risk approaches Lack of risk governance Poor engagement by various assurance providers Management overriding control environment Blurred lines of defense model Changing business environment Dealing with symptoms vs. root cause

Weaknesses in risk management across different levels of assurance Slow or non-response in addressing poor controls – mitigation strategies not implemented > 3 years Overriding of controls Poor accountability Legal vs. Risk Assurance Risk Management Removed from business operations (by design and ability) Risks not aligned to critical business processes compliance function – Compliance risk management? Internal Audit Limited value to management Limited advisory services External Assurance Providers Removed from operations Reactive Focus on audit vs risk Diminished Influence Weaknesses in risk management across different levels of assurance

Collective responsibility and accountability – Combined Assurance vs Collective responsibility and accountability – Combined Assurance vs. Integrated Assurance Champion for Combined Assurance Greater management responsibility for risk management Internal Audit and Risk Management reporting protocol Skillset for Risk Committee Closer linkages between MPAC, Internal Audit, Risk Management and Audit Committee Advisory services vs. Policing? Root Cause Analysis (RCA) Shift of paradigm

Risk Management and Influence on Strategy Understanding key strategic inputs of the organization – wider focus beyond the normal finances, human resources – appreciation of the environment: right strategy for the right people at the right time. Institutional performance is a function of various organizational processes - Optimizing key institutional processes should be part of the organizational strategy formulation programme – risk management is a key influencer in this. Defining the performance measures and reporting means is as important – can have the right strategy but measure incorrectly – measure the right things right Defined outcomes and impact measures – many organizations measure process and output Risk Management and Influence on Strategy

Root Cause Analysis in Risk Management – RIMS Model External Causes People/Internal Personnel Causes Process/Operational Causes Relationship Causes Systems/Physical Causes Root Cause Analysis in Risk Management – RIMS Model

Measuring Risk at various source – Reiterative Process Ripple effect of risk Appetite and Tolerance determined at each level Key Risk Indicators to measure risk at source Risk Management Monitoring to compliance performance monitoring (individual and organizational) Measuring Risk at various source – Reiterative Process

Thank you