51 / 248
49
BLUE LABEL INTEGRATED ANNUAL REPORT 2015
GOVERNANCE OF RISK
STRUCTURE
The Board accepts its responsibility for the
governance of risk, which includes the total process
of risk management and the forming of its opinion
on the effectiveness of the process. The Board forms
its opinion on the process of risk management
based on the recommendations of the ARCC and
is satisfied with the effectiveness of the risk
management process. The ARCC is responsible for
ensuring that the Group has implemented an
effective policy and plan for risk management and
that the risk disclosures are comprehensive, timely
and relevant. The Board and Committees’
responsibilities are documented in the Blue Label
Enterprise Risk Management Framework Policy.
Management is accountable to the Board for
designing, implementing and monitoring the
process of risk management. The IRCC, established
by management, supports the enterprise-wide risk
approach by identifying, evaluating and measuring
Group-wide risks and compliance in all functional
areas of the Group, as well as maintaining adequate
internal controls. The IRCC reports to the ARCC
bi-annually.
PROCESS
Group-wide strategic risk assessments are conducted
bi-annually. These assessments are facilitated by
internal audit which plays an important role in
evaluating the risk management process and
guiding management to continuing improvement.
Internal audit does not take any direct responsibility
for making risk management decisions or managing
the risk management function. The outcome of the
risk assessments is integral in developing a plan for
internal audit engagements for the forthcoming
year. The risk assessments conducted involve risk
identification and prioritisation at subsidiary and
holding company level, followed by interviews with
Senior Management at subsidiary level and key
members of Executive Management to confirm risks,
their descriptions and prioritisation. Each risk is
evaluated in terms of potential impact, likelihood
of occurrence and the perceived effectiveness of
controls in place to manage the risks according to
set criteria. The Group’s material risks are listed on
pages 13 to 16.
A risk appetite and tolerance framework has been
developed in line with the principles of King III and
the framework was presented to the ARCC for
consideration and has been approved/noted by the
Board. In terms of the framework, priority risks will
be considered in terms of risk appetite, which is
defined as how much risk the Group is prepared to
take in pursuit of its objectives. The Group has
identified its strategic risks and acknowledges that
its appetite to accept risk varies across these risks.
The ARCC has elected to set risk tolerances in
respect of each of the prioritised risks. This
framework is refined during each reporting period.
TECHNOLOGY GOVERNANCE
The Board is responsible for the Group’s technology
governance risk and compliance. The Board has
delegated its responsibility for the implementation
of IT governance to management. Management has
developed an IT governance framework which has
been adopted and the Information Security Officer is