Risk Management is an integrated process that encompasses the identification, assessment and ranking of risk facing an organization and the practical efforts expended in mitigating and controlling them. The management of risk is at the heart of corporate governance as the sustainability and continuity of a company depends largely on its ability to measure, monitor and mitigate various dimensions of risk. The responsibility to effectively manage risk in a manner that ensures business continuity rests squarely on the Board of Directors and derives primarily from Directors’ fiduciary duties as enshrined in Section 279 of the Companies and Allied Matters Act (CAMA).
Directors are saddled with the responsibility of not only ensuring the continued existence of the companies they direct, but also for the profitability, asset protection and enhancement ,in the overall interest of all stakeholders. In the wake of recent corporate failures, regulators have become increasingly focused on the role of the Board and its oversight function in the area of risk management. Section 29 of the SEC Code of Corporate Governance places the responsibility of risk management on the Board and expects it to undertake (at least annually), a thorough risk assessment, covering all aspects of the company’s business. The Board is enjoined to “form its own opinion on the effectiveness of the risk management process”. It should establish a risk management framework that defines the company’s risk policy, risk appetite and risk limits.
Furthermore, the CBN Code of Corporate Governance requires that the risk management framework shall specify the tgovernance architecture, policies, procedures and processes for the identification, measurement, monitoring and control of the risk inherent in the operations of a Bank. Both Codes require the establishment of a Risk Management Committee.
Acting through the Risk Management Committee, comprising of individuals with requisite skill and experience, the Board has the following responsibilities:
– Review and approve the company’s risk management policies;
– Review the adequacy and effectiveness of risk management and controls;
– Review the company’s compliance level with applicable laws and regulatory requirements which may impact the company’s risk profile;
– Periodic review of changes in the economic and business environment, including emerging trends and other factors relevant to the company’s risk profile;
-Review and approve risk management procedures and controls in respect of new products and services.
However, whilst it is the responsibility of the Board to put in place a sound risk management framework as well as provide oversight for its implementation, Management is accountable to the Board for implementing and monitoring the process of risk management and integrating it into the day-today activities of the company.
The Board and the Risk Management Committee should work with Management to promote and actively cultivate a corporate culture and environment that understands and implements enterprise-wide risk management. Comprehensive risk management should not be viewed as a “specialized function”, but instead should be treated as an integral component that affects how the company measures and rewards its success. In setting the appropriate “tone at the top,” transparency, consistency and communication are key. The Board’s vision for the company, including its commitment to risk oversight, ethics and intolerance of compliance failures, should be communicated effectively throughout the organization.