1. Pivotal roles that the CRO and CAE play in Local Government Service Delivery IMFO Conference, Port Elizabeth Presenter: Beerson Baboojee | 27 October 2011

2. Contents Purpose of RM in service delivery What does RM actually do What happens when there’s a failure of RM Role of the CRO Role of the AE Closing 2

3. Purpose of Risk Management in Service Delivery First - to protect what we have (defensive strategy) Second - when we are happy that we are doing enough to protect our resources we should the think of how we grow it (innovation) Good risk management is essential in both Investment in risk management must help government to improve “Unless better government and improved services result from reform, why should change be undertaken?” Frieder Naschold (Public sector management guru) 3

4. What does RM actually do Helps identify hazards early so that adequate mitigation against potential risk can be put in place By subjecting management decisions to appropriate rigour and analysis, there is a greater level of comfort that the right decisions will be made, because: –Decisions exceeding acceptable level of risk will be abandoned, and alternative less risky ways of achieving the same outcome will be explored. –For the decisions that are taken, mitigations for the remaining risk will be put in place alongside the implementation of the decision. 4

5. What does RM actually do Interrogating the embedded risk within existing processes and systems forces a re-think which leads to innovation, i.e. creation of better processes and systems. Developing a risk profile forces a deeper understanding of vulnerabilities, both within and external to the municipality and allows the municipality to fix internal problems and put in place measures to insulate it from external shocks By mitigating risks and the loss of resources that go with it the limited resources can be directed to service delivery Applying RM in service delivery allows early detection and correction of problems 5

6. What happens when there’s a failure of RM Goals and targets are not met Goals and targets are met – but fail the value for money test Fiscal and governance crises emerge Distressed municipalities become a liability to the community In the bigger picture: –Distressed municipalities become a liability to the state –The state service delivery apparatus is weakened and its ability to deliver economic and social development is compromised 6

7. Municipal Service Delivery Protests 7

8. Failure of RM in a nutshell The full extent of risk management failure becomes known only when municipalities become distressed “…when these things happen and you have to deal with the resultant difficult situation, points to the fact that something was not working. It says that there wasn’t a complete and total ownership of the risk management process that goes with it.” Lesetja Kganyago, Director-General: National Treasury 8

9. Role of the CRO 1. Compliance champion Developing RM Framework Developing tools Advocating & monitoring compliance with the RM Framework 2. Modelling expert Focus on risk aggregation and measurement Develop an aggregate view of municipal wide risks (categories, concentration, correlation) 9

10. Role of the CRO 3. Strategic Controller This role depends on the existence of the aggregate view Involved in integration of risk and performance measurement Uses key risk indicators widely to detect possible variations in performance targets 10

11. Aggregate view of risks

12. Role of the CRO 4. Strategic advisor Involved in the development of the IDP Command executive level visibility and influence – because of their strong grasp of the municipality, its operating environment and high level technical expertise Brings judgement into high level decisions, challenge the assumptions on which business plans are based Mobilise their own experience with other expert views from within and outside the municipality to understand the risk profile, emerging risks, etc. to influence the key decision makers This role requires the CRO to build a track record and credibility Can happen only where governance is strong 12

13. Role of the CRO The Public Sector Risk Management Frameworks articulates the function of the CRO “The primary responsibility of the Chief Risk Officer is to bring to bear his/her specialist expertise to assist the Institution to embed risk management and leverage its benefits to enhance performance.” The Framework provides extensive guidance on various functional responsibilities, including that of the CRO, Audit Committee, Risk Committee etc. So what does this say about our current expectations? 13

14. Role of the CAE Audit at the right time (not when its too late for change) Avoid becoming a mechanical and superficial without any real tangible benefit (audit what is important) Strike the right balance between assurance, consulting and performance audit guided by the realities on the ground Don’t be afraid to also reporting on ‘excessive controls” – where processes are unnecessarily burdensome and do little to increase efficiencies Scrutinise the RM process intensively because of its feeder role into IA 14

15. Closing There are signs that a renewed “accountability sensitive” environment is beginning to emerge in the public service CRO’s and CAE’s need to seize the opportunity to appropriately position their respective disciplines within this paradigm – make a compelling value proposition Risks must be managed better as adverse outcomes that could be avoided are consuming much needed resources and destroying value Quality RM & IA translate into better development outcomes These functions need top level (and concrete) support to make a valuable contribution – and they must be given it 15

16. THANK YOU!