Click to edit Master title styleCFO Networking Evening: Risk ManagementThe Institute of Chartered Accountants of Australia

Alan Bardwell

ASX Group

17 August 2011

Coverage

• Corporate Governance Council: recognise and manage risk

• Interaction of risk and finance• Aligning risks to corporate value

Corporate Governance Councilhttp://www.asx.com.au/governance/corporate-governance.htm

• Listed entity focus• ASX chaired, members include

– The Institute of Chartered Accountants in Australia– CPA Australia Ltd– Group of 100– National Institute of Accountants

• Guidance recommendations• Best practice principles• “if not why not”

Principle 7- Recognise and Manage Risk

 Recommendation 7.1: Companies should establish policies for the oversight and management of material business risks and disclose a summary of those policies.

Recommendation 7.2: The board should require management to design and implement the risk management and internal control system to manage the company's material business risks and report to it on whether those risks are being managed effectively. The board should disclose that management has reported to it as to the effectiveness of the company's management of its material business risks.

Recommendation 7.3: The board should disclose whether it has received assurance from the chief executive officer (or equivalent) and the chief financial officer (or equivalent) that the declaration provided in accordance with section 295A of the Corporations Act is founded on a sound system of risk management and internal control and that the system is operating effectively in all material respects in relation to financial reporting risks.

Recommendation 7.4: Companies should provide the information indicated in the Guide to reporting on Principle 7.

Financial ReturnFinancial Scenarios

BudgetsFinancial and

Management Reporting

P/L Capital

Liquidity Market value

Risk AppetiteRisk ScenarioRisk tolerancesRisk reporting

DataSystemsCulture

Legislation/RegulationGovernance

Risk Finance

Interaction of Risk and Finance

Alignment of risks to corporate value

Risk is the effect of uncertainty on objectives and so risk appetite is the amount of risk, i.e. uncertainty, an organisation is willing to accept in pursuit of corporate value.

In defining the appropriate level of risk appetite, it is important to distinguish the two groups of risks with reference to their impact on corporate value:

1. Strategic forward-looking risks - which impact the certainty of future cash flows and are primarily mitigated by either taking opportunities or response actions; and

2. Financial/ Legal and Regulatory/ Operational type risks - which impact the certainty of current cash and capital levels and are predominantly mitigated by implementing controls.

RISK CHARACTERISTIC

VALUE OPTIMISATION RISKSStrategic

VALUE PRESERVATION RISKSFinancial, Operational, Legal/Regulatory

Nature • Often uncertain distant timing• Potentially high velocity when crystallise • Large unclear impact• Limited ability to manage occurrence

• Well defined• High and low velocity levels• Clear impact• Strong ability to manage occurrence

Source & Identification

• Often arise from global and/or national trends and events (e.g. geopolitical, economic, market structure, competition, regulatory, technology, social, environment)

• Arise from on-going business activity (e.g. change management, payment processing, information security, counterparty risk, financial reporting)

Link to Other Risks • Have future implications for other risk categories as they crystallise – financial risks, operational risk, and legal/regulatory

• Often high level of interconnectedness with other value preservation risks

Equity Impact • Impact is predominantly to future cash flows

=> Market Value of Equity (MVE)

• Impact is predominantly to current earnings, capital and/or liquidity

=> Book Value of Equity (BVE)

Risk Appetite Factors

• Risk appetite decision is mostly a function of the extent to which impact can be optimised (i.e. opportunity maximised or threat minimised). The ability to reduce likelihood is limited to resources applied to risk identification and analysis undertaken.

=> Impact Given Event (IGE) Focus

• Risk appetite decision is usually a risk/reward trade off between the cost of additional likelihood reduction controls versus level of additional risk mitigation gained. Impact (LOE) concerns are addressed by reducing the likelihood of occurrence by applying financial resources. Operational limits may also be implemented to place a boundary on impact levels.

=> Likelihood of Event (LOE) Focus