Risk Management – Guide - Department of Environment ...

1 Environmental AffairsDepartment:REPUBLIC OF SOUTH AFRICA environmental affairsRisk Management Guide 2 CONTENTSFOREWORD ..4 INTRODUCTION ..5 Purpose ..5 Structure ..6 GUIDEBOOK: WHAT IS RISK Management ?INTRODUCTION ..8 DEFINITION ..8 OVERVIEW ..9 Why do we need risk Management ? ..10 Corporate governance ..10 Planning and organisation ..11 Continuous risk assessment ..11 Evolution of risk Management ..12 Internal audit plans ..12 Cultural adjustment ..13 CONCLUSION ..13 GUIDEBOOK: RISK IDENTIFICATIONINTRODUCTION.

2 14 THE RISK IDENTIFICATION PROCESS ..14 Understand what to consider ..15 Gather information to identify risks ..16 Apply risk identification tools ..17 Document/ record risks identified ..18 Risk identification examples ..20 Document the risk identification process ..22 The outputs of risk identification ..22 GUIDEBOOK: CONTROL ACTIVITIESINTRODUCTION ..23 OUPUTS ..23 CONTROL TYPES AND CONTROL TIMING ..23 Management controls ..233 Administrative controls ..24 Accounting controls ..24 Information technology controls.

3 24 CONSIDERATIONS FOR IMPROVING CONTROLS ..25 ASSURANCE ON CONTROL ACTIVITIES ..26 GUIDEBOOK: RISK ASSESSMENTINTRODUCTION ..26 THE APPROACH ..27 Identify and evaluate control effectiveness ..28 Determine the risk impact and likelihood ..29 Determine the overall risk rating ..30 Document the risk assessment process ..30 The outputs of the risk assessment process ..31 GUIDEBOOK: RISK RATINGIMPACT ..32 LIKELIHOOD ..33 RISK EXPOSURE ..34 GUIDEBOOK: RISK RESPONSE STRATEGYINTRODUCTION ..35 DEVELOPING A RISK RESPONSE STRATEGY.

4 35 Identify and select appropriate risk response option ..36 Assign risk ownership ..38 GLOSSARY ..3941. FOREWORDThe concept of risk Management is not new to the public service,in that the basic principles of service delivery ( batho pele , 1997) clearly articulate the need for prudent risk Management to underpin the achievement of Government s objectives. The DEA Enterprise Risk Management Handbook forms the basis of our efforts to improve the risk Management capability of the DEAin support of achieving a risk intelligent need to enhance our capability to identify, manage and monitor those risks at a strategic, operational and process level that may impact (positively and negatively) on the DEA achiev-ing its mandate and strategic intent.

5 Further, it is important for all of us to understand that the respon-sibility for risk Management vests at all levels of Management and is not limited to only the accounting officer, the Enterprise Risk Management Directorate and Internal , the decision-making processes of the DEA must at all times consider both risk and reward whilst meeting the needs and expectations of our stakeholders and handbook provides a structured and uniform approach for achieving the Alf WillisDirector General (ACTING)Date: 19/06/201351.

6 PurposeThe DEA Enterprise Risk Management Guide represents the source of reference and guidance for Management and staff on the governance, implementation and execution of risk Management within the organisation. The Guide s purpose is to create a structured and consistent ap-proach to risk Management , aligning strategy, processes, people, technology and information systems for the purpose of evaluating and managing the uncertainties that the DEA faces due to the nature of the business, the change in Environment , legislation and control from the premise that risk is an unavoidable consequence of any organisation s activities.

7 The aim of the Guide is to provide the overall direction within which Management and employees can operate in order to embed a strong risk Management culture throughout the Guide outlines the DEA s beliefs about risk and how it chooses to manage risk and reflects the value that the DEA seeks. The Guide details the commitments the DEA has made to Enterprise Risk Management (ERM) and the approach to be followed in implementing ERM and managing risks . This Guide provides the foundation for creating a culture of risk Management in the or-ganisation that is embedded in all its operational Guide further serves as a base to set objectives regarding the level of ERM performance and responsibility that the DEA shall strive to achieve, and against which all ERM activities and opera-tions shall be a practical level.

8 The Guide also serves to ensure that the re-sults and intelligence provided from the risk Management pro-6cesses serve to inform decision-making and priority setting at all levels of the , the Guide acknowledges the Public Sector Risk Management Framework and endeavours to align to the princi-ples of risk Management recommended within the public StructureThis Guide is comprised of the following:1. DEA Enterprise Risk Management (ERM) Framework (Graphical representation)2. Guidebooks:a) What is risk managementb) Risk identificationc) Control activitiesd) Risk assessmente) Risk rating f) Risk response strategyg) Glossary of risk Management terminology 7 DEA ENTERPRISE RISK Management FRAMEWORKF igure 1: DEA Enterprise Risk Management (ERM) FrameworkEnterprise Risk Management (ERM) FrameworkDEA Strategy1.

9 DEA Enterprise Risk Management2. Legal Mandate4. Structures & Respons- ibilities6. ERM Process7. ERM Inform- ation System9. ERM Methodologies (Tools & Techniques)PFMAS 38 (1) (a) (i)S45 Treasury RegulationsSections , (a)OversightFraud Prevention Committe (FPC), Risk Management Committee (RMC), Audit Committee (AC), Parliamentary Committees National TreasuryAssuranceInternal Audit Auditor GeneralRoles and Responsibilities (incl. reporting lines) Establish the contents Identify event(s) (inclusive of contributing factors & consequences) Communicate positive event to the Strategy function Conduct risk assessment Develop action plans Execute plans Monitor, review & reprt on risk mitigation8.

10 ERM ReprtingInformation Database(s)CSARoot Cause AnalysisKRI sScenario PlanningRisk Assess-ment3. Policy5. Coaching & Training Risk Registers Programme/ unit RM Reports Audit Committee Fraud Prevention Committee Annual Report DisclosureRisk Analysis MatrixEnterprise Risk Management PolicyFraud Risk Management Policy10. Internal Controls11. Monitoring & Reviews8 GUIDEBOOK: WHAT IS RISK Management ?1. INTRODUCTIONThe term risk Management is currently being utilised very liberally within institutions. For example, safety, security, disaster manage-ment, business continuity, insurance and internal audit are often referred to as risk Management .