1. RISK MANAGEMENT IN THE PUBLIC SECTOR CONVERGING MULTIPLE STAKEHOLDER’S EXPECTATIONS Organised by National Treasury Presented by WELEKAZI DUKUZA CEREBRO CONSULTING 359 Rivonia Boulevard, Rivonia Centre Rivonia wdukuza@cerebroconsulting.co.za 011- 803 0142 tel 084 557 3641 cell 011-803 0138 fax

2. SPEAKERS INTRODUCTION  Admitted Attorney  Founder and MD of CEREBRO CONSULTING, a consulting company specializing on Forensic investigations, compliance and governance, training and development with SETA accreditation on various aspects including project management, new venture creation and customer care.  Been in the industry for over 11 years  Previously a manager at PricewaterhouseCoopers and worked with parastatals for a limited period.  Non Executive director at various private sector and municipal entities  Audit Committee member at various municipalities and government department  Chairperson for Risk management committee WELEKAZI DUKUZAPROFESSIONAL INVOLVEMENT

3. WHAT IS RISK MANAGEMENT ?  Risk – “ an event that has a potentially negative impact and the possibility that such an event will occur and adversely affect an entity’s assets, activities and operations, image & credibility”  Risk Management- “ continuous process of assessing risk, reducing the potential that an adverse event will occur by putting systems in place to deal with any event that might or does occur”  Characteristics : unavoidable, present in our daily lives, and within any organization private and public and has uncertain and mostly unfavourable outcomes.

4. CURRENT RISK MANAGEMENT WITHIN THE PUBLIC SECTOR  Currently RM is viewed as complex and high level  Not a priority for public sector institutions  Overshadowed by strategic objectives and is isolated from the overall organizational strategy  Not performance based (should be included in each managers performance management and evaluation)  Not properly communicated with achievable goals  Not regularly monitored hence high incidents of fraud and corruption  Always associated with certain individuals within the organization whereas it affects all employees  Insufficient support provided at executive level  Lack of qualified risk management drivers within the organizations and limited training provided OVERALL VIEWMANAGEMENT

5. GAPS IN THE RISK MANAGEMENT PROCESSES POLICY  Cut and paste exercise and does not address the unique organisational expectations regarding the management of risk  Institutionally focused and lack public risk focus  Often not approved and not prioritized  In some instances no reviewal process for amendments to address the needs of the organization  Lack of communication to employees (MAKE LOUD NOISE)

6. GAPS IN THE RISK MANAGEMENT PROCESSES cont. STRATEGY AND IMPLEMENTATION PLAN  Not customized to address specific requirements of the organization  Lack of combined effort (assurance and management at all levels)  Not easy to be understood by targeted group  Always drafted for compliance and not implemented

7. EFFECTIVE REPORTING & SOLUTIONS  Reward risk identification and don't penalise  Record proactive management approach rather than reactive approach  Develop action plans and assign responsibilities  Manage the biggest risks first and gain quick wins for motivation  Encourage business units to include risk management as an item in their regular meetings  Communicate the identifiable risks to the Audit Committee and RMC regularly and possible risk response plan  Report on short term and long term strategy and understand that risk management is ongoing  Risk management report being a standing item on all Audit Committee meetings  Incorporate risk management in audit performance plan

8. RMC EXPECTATIONS FROM CRO  Ensure the Risk Management Charter is approved by the Accounting Officer and communicated to new members  RMC Key performance indicators are developed for the approval of the accounting officer  Drafting the institutions risk management framework in consultation with management and communicated to all stakeholders and monitor its implementation (i.e. policy, strategy, implementation plan, risk appetite, risk identification, assessment methodology, response plan)  Training all stakeholders in their risk management function and continuous reporting on risk management related info.  Participate with IA, External Auditors and management in developing the combined assurance plan.

9. RMC EXPECTATIONS FROM CRO cont.  Arrange regular risk management committee meetings and ensuring that management understand their roles in risk management within their sections and taking full accountability  Competent to drive risk management within the organization  Conduct periodical meetings with the Accounting Officer to provide recommendations and risk mitigating factors that needs immediate intervention to avoid being reactive and not proactive.

10. THANK YOU QUESTIONS