1. Risk Management and the Treasury Function
Mark Silins
Vienna
May 2017

2. Risk Management
Modernisation of the treasury function necessitates modernisation of corporate governance too
Do we have a clear modern view of the Treasury’s objectives?
Are your resources, human and otherwise, appropriately allocated to achieve your objectives?
Have you reviewed business processes to assess risks?
Is risk management integrated into the culture and thinking of your organisation?
Many countries have invested heavily in ICT but are you realising the benefits of this investment?
Do you full understand the opportunities that modernisation present?

3. Process for Managing Risk (ISO31000)

4. Typical Treasury Functions in PEMPAL Countries
Appropriation Control
Payment Processing and Revenue (Collection) Recording and Reporting
Oversight of Bank Accounts and Basic Cash Management
Assets and Liability Management
Financial Reporting
Accounting and Internal Control Policies
In-year budget execution reporting

5. Risk Identification – Typical Areas of Risk in Treasury
Traditional
compliance with legislative requirements and appropriations
fraud and corruption
A Broader More
Modern Context
service delivery and stakeholder
reputation 
people and culture 
finance  
health and safety 
business continuity 
security 

6. Risk Assessment- Determining Priorities

7. Examples of Risk Management Issues (1)
Strategic Risks – Fragmentation of systems and processes – need to ensure the strategic position of the Treasury systems is not fragmented, particularly through a poor understanding of stakeholder needs
Business continuity and disaster recovery plans – not just our systems but also the systems we depend on which are external, for example the bank payment system
System Risks - Have we had independent assessment regarding the control framework? Issuance of certification for the Treasury system
Physical Security
Control activities outside of Treasury - why are any steps to do with process controls recorded outside of Treasury? Do these manual controls around provide additional assurance? What is being checked and what risks are mitigated? If the controls are not in the system are they redundant?

8. Other Risk Management Issues (2)
Do we properly understand stakeholder requirements and expectations
Who is watching over ICT and other highly technical areas? – management assurance – independent checks, KPIs
Are our policies and procedures well structured, accessible and comprehensive? Test them with the least knowledgeable clients
How well trained are Treasury staff and budget entity officials? Is there an opportunity to transform role of the regional offices – requires a shift from compliance to a client focus
Can we develop new monitoring tools for management – enhance the role of Internal audit and develop KPIs for areas of risk
What about a more systematic review of payments using ICT analytical tools including exception reporting?
Risks around cash management – currency, forecasting, investment

9. Treasury Risk Management – International Examples
Certification of system based controls (ISO) – provides assurance that payments coming from these systems are correct
Australia
Georgia
Business Continuity Plans (incorporating Disaster Recovery)
Threshold
In Dominica Treasury checks payments above $1000 – line ministries approve payments below that amount
In Australia payments under $1000 were subject to less checks than those above $1000
Repetitive payments - opportunity to recover overpayments for salaries, pensions, utilities from future payments means that there is a lower risk for government
System Based checks
Mexico – Treasury samples a small number of transactions. Also targets high value or unusual transactions
Singapore – centralisation of payment function for large service providers to government eg utilities
Cash buffers (and access to short term borrowing)