Management Risk Policy
The following sample outlines a set of policies and procedures for structuring risk management
activities such that risks are identified, assessed, managed, monitored and reported in a uniform
manner.
Prepared By: ______________
Approved By: ______________
Revision Date: ______________
Effective Date: ______________
PURPOSE:
Through the risk management framework the company aims to structure risk management
activities such that risks are identified, assessed, managed, monitored and reported in a uniform
manner.
SCOPE:
To ensure effective risk management, all divisions within the company will implement and
maintain the risk management framework.
POLICY:
The company recognizes risks are associated with achieving our value-based objectives.
Managing these risks forms an essential part of our business. The aim of risk management within
this company is to provide reasonable assurance that we understand the risks associated with
achieving our business objectives and that we are responding appropriately to these risks at all
levels within our organization. This is achieved by ensuring that at all times:
Risks are properly identified, assessed, managed and reported;
Risk ownership is taken and communicated;
Resources are effectively and efficiently allocated to manage risks;
Risks that could significantly affect our employees, the company, our suppliers or our clients
are suitably managed;
The company is compliant with regulatory and legal requirements.
PROCEDURES:
Risk Management Framework
Essential elements of the risk management framework are:
This Risk Management Policy;
A uniform risk management process;
A common risk terminology/language;
Clear responsibilities and accountabilities for risk management;
A management review of risk exposure and a risk reporting process;
Provision of annual assurance including the Letter of Representation; and
Common tools and methodologies to support the risk management process.
Risk Management Responsibilities
The management of risks is an integral of part everyday business and management practice. This
policy does not change managements inherent responsibil ity to manage risks but formalizes it. It
is the responsibility of all management to:
1
Source: www.knowledgeleader.com
Identify potential business risks;
Assess these risks;
Create awareness of these risks;
Correctly respond to and manage these risks;
Proactively balance risk, reward and controls;
Monitor the risks;
Report annually on these risks and the risk profile.
Risk Management Levels
The company approach to risk management is founded on managing risks at three levels within
the organization:
Business Unit: the day-to-day management activities provide reasonable assurance that the
main tactical and operational risks arising from business operations are identified, assessed,
managed and monitored.
Division: providing reasonable assurance that:
o strategic risks are identified, assessed, managed and monitored;
o the division complies to corporate risk management standards;
o decision-making and responsiveness to internal and external risks improve by means
of structured risk management.
Corporate: support functions at corporate head office (e.g. Finance, Treasury, Legal, HR,
Quality, Security and CHO) provide expert support to our businesses in managing risks
addressing specialist risk areas within their field of expertise.
Risk Tolerances
In order to achieve its business objectives, the company recognizes that it will take on certain
business risks. The company aims to take business risks in an informed and proactive manner,
such that the level of risk is aligned with the potential business rewards. Management will
regularly review risk exposures against current business-risk level tolerances. The company is
risk averse with respect to risks that could:
Negatively affect the safety of our employees;
Negatively affect our reputation or brand;
Lead to breaches of laws and regulations; or
Endanger the future existence of the company.
2
Source: www.knowledgeleader.com