Governance, Risk and Compliance Management (RSK4802)
Identify the reasons for managing risk:
Mainly: Risk and return are interrelated, any reduction in risk profile of an organization following
a deliberate risk management programme will result in a more efficient risk-return trade off.
Risk manager must apply the following criteria when considering specific proposals and also
forms part of why risk management must be done:
Make sure steps taken in the risk management doesn’t exceed the return, links to risk-
return trade off. (Return of benefit must outweigh expenditure incurred to reduce the risk). A risk
to return calculation must be made, importantly, emphasis is on the long term risk to return trade
off efficiency.
Risk aversion-People are risk averse and this drives them to make decisions to take steps to
reduce risk even if it isn’t cost-beneficial(they’ll spend a portion of their money to safeguard the
remaining), this aspect must be kept in mind because it cost money to for instance buy
insurance in order to transfer risk.
Policy based decisions – risk management can become obsolete or less effective just
because it was implemented for other reason than actual risk management, hence decisions
that reduce risk may not be motivated by risk management concerns at all. Risk manager
should support, manage and encourage risk management implementation strategies for proper
integration into the company
Authoritative reasons – These are orders from top management, legislation or code of
practice’s.
Functional Management
Functions of Management:
Planning-determine goals and mission and work towards it with a plan and/or methodology
Organising - Organisational design must be correct, resources must be allocated to the
appropriate departments/roles. This means a framework must be established that clearly shows
where resources fit in, success in achieving goals lies in directing the resources towards the
achievement of a common goal, the better they are organized and directed-the more successful
the organization will be.
Leading-Directing and motivating the resources in the company, collaborating with superiors
and subordinates, to achieve the goals.
Controlling-means managers must constantly make sure the organization is performing and
taking actions that conform to the plans to achieve the predetermined plans, and take into
account factors that might oblige them to revise their goals and plans.
Levels of management:
Strategic level-Top management who holds responsibility and authority over the management
process and design, being more focused on long term goals, leading and controlling the
organization.
Operations Management-Provides goals and services and is focused of activities that move
the organization towards its goals. Two level breakdown of operations management:
Middle management-focused on the implementation of top management formulated
strategies, performing medium and short term planning by means of departmental heads
and controlling middle managers own departments.
, Lower management-focuses on day to day activities, primarily to implement the plans
of middle management and to accomplish day to day objectives
Definition of risk management
-Is a managerial function aimed at protecting the organization and its people, assets and profits
against the physical and financial consequences of risk. It involves planning, coordinating and
directing the risk-control and the risk-financing activities in the organization.
Risk management in an organization must be comprehensive, inclusive and proactive
Comprehensive-integrated approach to risk management necessary that requires considering
its strategy, the processes, and its people.
Inclusive-it must involve all levels of the organization, top-, middle- and lower management
Proactive-risks must be anticipated in advance and catered for via risk control and financing
arrangements.
Risk management model (sien handbook, begin op bladsy 14 tot bladsy 19)
Study unit 2:
Risk is an unwanted event, which may or may not occur.
Risk is the cause of an unwanted event that may or may not occur.
Risk is the probability of an unwanted event, which may or may not occur.
Risk is the statistical expectation value of unwanted events, which may or may not occur.
Risk is the fact that a decision is made under conditions of known probabilities.
Elements of risk:
Outcomes – which can be positive or negative, monetary and non-monetary
Events- outcomes can usually be tied to a place and time, which is the event.
However, a positive or profitable event might not be able to be quantified i.e. a
good idea from a scientist in a factory that leads to better profits in the future
Sources – also called the peril, the cause of the outcome can be traced to a
specific source.
Environmental factors – the peril is dependent on the environment i.e. two
factories, one wood, one steel. One would have greater risk of fire due to it being
a wood factory
Basic risk classification – examine the more popular ways in which risk have been
classified:
Pure risk classification – A risk that can only have a possibility of loss
Speculative risk classification – A risk that can have a profit or loss
Insurable and non-insurable risk classifications- theoretically all pure risks are
insurable, but a risk can be pure and be non-insurable: A building collapsing is
insurable but not if its due to i.e. war
Fundamental risk classification – Are risks that affect large quantities of
society(many losses that can be traced to one origin). Fundamental are regarded
as non-insurable i.e. war
Particular risk classification – Is a risk that is more personal with losses to a
particular thing, it’s ‘discreet’ i.e. a fire damage to a building
, Systematic risk – Is a market related risk and goes along with the finance theory
& industry(things that make i.e. share values rise or drop)
Systemic risk – risk of the system collapsing
Managerial risk classification – are those classifications made in practice to enable
particular risk to be managed:
Inherent risk classification – risk that impact the operating profit of a business
and the earnings of the ordinary shareholder, two types of inherent risk namely
systematic(also called market risk) and unsystematic(also called specific risk).
o Specific risk is broken down further:
Sales variability –measured by standard deviation of sales over
time, its caused by market factors that affect demand for the
product
Operating leverage – is dependent on the production function,
operating cost volatility is dependent on proportion of fixed costs
to total costs. Fixed costs add to volatility by not declining when
sales go down but also not going up when sales go up
Resource risks – risks that relate to the production/output of a
resource of some kind, causing changes to profit which then
affects shareholders
Profit margin and turnover –
Incidental risk classification – risk that arise naturally from the activities of a
business, but are incidental because they do not form part of the main business
of the organization, yet needed to ensure continuation of the business, main sub-
category is
o Financial risk – are risks involved in transactions in financial assets and
those that may result from fluctuating financial claims, therefore
businesses need to risk manage financial assets also.
o Financial risk classification further breakdown
Interest rate risk – self explanatory
Liquidity risk – risk that operations cannot be funded and/or
financial commitments cannot be met. It originates from size of
assets and liability (the funding need) and the disproportion in
their sizes.
Investment(capital) risk – risk that investments might be
adversely affected due to losses
Credit risk-it is the risk that a party will default to the contract
Currency risk – also called foreign exchange risk, and is the risk
that accompanies exchange rates
Operational risk – risks of a non-speculative nature (pure risk) and can
traditionally be insured.
, Risk and uncertainty
Uncertainty has two elements: whether the event will occur…and… if it does, what will be the
outcome
Study unit 3 and 4 not for assessment purposes
Study unit 5 – 7 pending
Topic 2-compliance
Study unit 1
a) Formulate the reasons for establishing an independent compliance function in an
organisation.
An organisation should establish an independent compliance function as part of its risk
management framework in order to ensure that the organisation continuously and effectively
manages the various compliance risks that apply to the organisation and the industry in which it
operates and is relied upon to assist the top management and management of the organisation
in complying with the ever increasing regulatory requirements.
b) Analyse the reasons why organisations should comply with the law. List your findings.
c) Evaluate the role of each of the key role players in compliance. List your findings.
Top management (including the board of directors)
Top management is appointed by and accountable to its shareholders to lead, control, and
monitor the business of the organisation and to provide effective corporate governance, with the
specific responsibility to oversee compliance with regulatory requirements.
Audit/compliance/risk committees
These sub-committees of the board should be established to oversee compliance matters.
These committees play an important role in the whole compliance system as they monitor
compliance at the highest level. The head of compliance typically has a reporting line to these
committees.
Executive management committee
The executive management committee (EXCO) is appointed by the board to oversee and
manage the business within an acceptable risk profile and to achieve sustainable profits. Its
Identify the reasons for managing risk:
Mainly: Risk and return are interrelated, any reduction in risk profile of an organization following
a deliberate risk management programme will result in a more efficient risk-return trade off.
Risk manager must apply the following criteria when considering specific proposals and also
forms part of why risk management must be done:
Make sure steps taken in the risk management doesn’t exceed the return, links to risk-
return trade off. (Return of benefit must outweigh expenditure incurred to reduce the risk). A risk
to return calculation must be made, importantly, emphasis is on the long term risk to return trade
off efficiency.
Risk aversion-People are risk averse and this drives them to make decisions to take steps to
reduce risk even if it isn’t cost-beneficial(they’ll spend a portion of their money to safeguard the
remaining), this aspect must be kept in mind because it cost money to for instance buy
insurance in order to transfer risk.
Policy based decisions – risk management can become obsolete or less effective just
because it was implemented for other reason than actual risk management, hence decisions
that reduce risk may not be motivated by risk management concerns at all. Risk manager
should support, manage and encourage risk management implementation strategies for proper
integration into the company
Authoritative reasons – These are orders from top management, legislation or code of
practice’s.
Functional Management
Functions of Management:
Planning-determine goals and mission and work towards it with a plan and/or methodology
Organising - Organisational design must be correct, resources must be allocated to the
appropriate departments/roles. This means a framework must be established that clearly shows
where resources fit in, success in achieving goals lies in directing the resources towards the
achievement of a common goal, the better they are organized and directed-the more successful
the organization will be.
Leading-Directing and motivating the resources in the company, collaborating with superiors
and subordinates, to achieve the goals.
Controlling-means managers must constantly make sure the organization is performing and
taking actions that conform to the plans to achieve the predetermined plans, and take into
account factors that might oblige them to revise their goals and plans.
Levels of management:
Strategic level-Top management who holds responsibility and authority over the management
process and design, being more focused on long term goals, leading and controlling the
organization.
Operations Management-Provides goals and services and is focused of activities that move
the organization towards its goals. Two level breakdown of operations management:
Middle management-focused on the implementation of top management formulated
strategies, performing medium and short term planning by means of departmental heads
and controlling middle managers own departments.
, Lower management-focuses on day to day activities, primarily to implement the plans
of middle management and to accomplish day to day objectives
Definition of risk management
-Is a managerial function aimed at protecting the organization and its people, assets and profits
against the physical and financial consequences of risk. It involves planning, coordinating and
directing the risk-control and the risk-financing activities in the organization.
Risk management in an organization must be comprehensive, inclusive and proactive
Comprehensive-integrated approach to risk management necessary that requires considering
its strategy, the processes, and its people.
Inclusive-it must involve all levels of the organization, top-, middle- and lower management
Proactive-risks must be anticipated in advance and catered for via risk control and financing
arrangements.
Risk management model (sien handbook, begin op bladsy 14 tot bladsy 19)
Study unit 2:
Risk is an unwanted event, which may or may not occur.
Risk is the cause of an unwanted event that may or may not occur.
Risk is the probability of an unwanted event, which may or may not occur.
Risk is the statistical expectation value of unwanted events, which may or may not occur.
Risk is the fact that a decision is made under conditions of known probabilities.
Elements of risk:
Outcomes – which can be positive or negative, monetary and non-monetary
Events- outcomes can usually be tied to a place and time, which is the event.
However, a positive or profitable event might not be able to be quantified i.e. a
good idea from a scientist in a factory that leads to better profits in the future
Sources – also called the peril, the cause of the outcome can be traced to a
specific source.
Environmental factors – the peril is dependent on the environment i.e. two
factories, one wood, one steel. One would have greater risk of fire due to it being
a wood factory
Basic risk classification – examine the more popular ways in which risk have been
classified:
Pure risk classification – A risk that can only have a possibility of loss
Speculative risk classification – A risk that can have a profit or loss
Insurable and non-insurable risk classifications- theoretically all pure risks are
insurable, but a risk can be pure and be non-insurable: A building collapsing is
insurable but not if its due to i.e. war
Fundamental risk classification – Are risks that affect large quantities of
society(many losses that can be traced to one origin). Fundamental are regarded
as non-insurable i.e. war
Particular risk classification – Is a risk that is more personal with losses to a
particular thing, it’s ‘discreet’ i.e. a fire damage to a building
, Systematic risk – Is a market related risk and goes along with the finance theory
& industry(things that make i.e. share values rise or drop)
Systemic risk – risk of the system collapsing
Managerial risk classification – are those classifications made in practice to enable
particular risk to be managed:
Inherent risk classification – risk that impact the operating profit of a business
and the earnings of the ordinary shareholder, two types of inherent risk namely
systematic(also called market risk) and unsystematic(also called specific risk).
o Specific risk is broken down further:
Sales variability –measured by standard deviation of sales over
time, its caused by market factors that affect demand for the
product
Operating leverage – is dependent on the production function,
operating cost volatility is dependent on proportion of fixed costs
to total costs. Fixed costs add to volatility by not declining when
sales go down but also not going up when sales go up
Resource risks – risks that relate to the production/output of a
resource of some kind, causing changes to profit which then
affects shareholders
Profit margin and turnover –
Incidental risk classification – risk that arise naturally from the activities of a
business, but are incidental because they do not form part of the main business
of the organization, yet needed to ensure continuation of the business, main sub-
category is
o Financial risk – are risks involved in transactions in financial assets and
those that may result from fluctuating financial claims, therefore
businesses need to risk manage financial assets also.
o Financial risk classification further breakdown
Interest rate risk – self explanatory
Liquidity risk – risk that operations cannot be funded and/or
financial commitments cannot be met. It originates from size of
assets and liability (the funding need) and the disproportion in
their sizes.
Investment(capital) risk – risk that investments might be
adversely affected due to losses
Credit risk-it is the risk that a party will default to the contract
Currency risk – also called foreign exchange risk, and is the risk
that accompanies exchange rates
Operational risk – risks of a non-speculative nature (pure risk) and can
traditionally be insured.
, Risk and uncertainty
Uncertainty has two elements: whether the event will occur…and… if it does, what will be the
outcome
Study unit 3 and 4 not for assessment purposes
Study unit 5 – 7 pending
Topic 2-compliance
Study unit 1
a) Formulate the reasons for establishing an independent compliance function in an
organisation.
An organisation should establish an independent compliance function as part of its risk
management framework in order to ensure that the organisation continuously and effectively
manages the various compliance risks that apply to the organisation and the industry in which it
operates and is relied upon to assist the top management and management of the organisation
in complying with the ever increasing regulatory requirements.
b) Analyse the reasons why organisations should comply with the law. List your findings.
c) Evaluate the role of each of the key role players in compliance. List your findings.
Top management (including the board of directors)
Top management is appointed by and accountable to its shareholders to lead, control, and
monitor the business of the organisation and to provide effective corporate governance, with the
specific responsibility to oversee compliance with regulatory requirements.
Audit/compliance/risk committees
These sub-committees of the board should be established to oversee compliance matters.
These committees play an important role in the whole compliance system as they monitor
compliance at the highest level. The head of compliance typically has a reporting line to these
committees.
Executive management committee
The executive management committee (EXCO) is appointed by the board to oversee and
manage the business within an acceptable risk profile and to achieve sustainable profits. Its
