Risk report - Risk management process

The Group strives to manage risk effectively to protect the Company’s assets, primarily management, brand and reputation, to ensure that business objectives are achieved and stakeholder value is increased.

The Chief Executive Officer and the Board are responsible and accountable for the risk management process and are assisted by the Board Risk Committee. The Board Risk Committee operates under official terms of reference referred to on page 78 of this report.

The Board Risk Committee reports to the Board and evaluates any risks which it deems necessary for discussion and evaluation by all directors. The day-to-day responsibility for identifying, evaluating and managing risks resides with management.

The risk management approach considers:

• The nature and extent of the risks facing the Group;
• The extent and categories of risk which it regards as acceptable for the Group to bear;
• The likelihood of the risks concerned materialising;
• The Group’s ability to reduce the incidence and impact on the business of risks that do materialise; and
• The costs of risk mitigation procedures relative to the benefit obtained.

The Board Risk Committee formalises and standardises this process by guiding management and assessing their effectiveness on risk management. Management information and metrics to objectively assess exposure to key risks are clearly defined and actual performance against these targets is appropriately monitored.

The Group has a Group Risk Management division which is involved in the implementation and monitoring of risk management processes in the day-to-day activities of the Group. This division ensures that risks are properly controlled and consistent with agreed risk appetite, and endeavours to ensure that relevant risk management policies are properly compiled and implemented in each business unit. These policies and procedures include the financing of residual risks as well as self-insurance.

The Board is satisfied that the Group’s risk funding strategy and existing cover are adequate and appropriate in relation to the exposures identified. In addition, the Board has considered the effectiveness and efficiency of the risk management process and found it to be adequate, a determination that has been corroborated by appropriate compliance reports. Furthermore, in the event of a disastrous incident, there is a documented and tested major incident management plan and a disaster recovery programme that will allow for the continuity of critical business processes.

The Board is confident that:

• The risk management system in place is appropriate for the Group’s model and strategy;
• The risk appetite inherent in the business model is appropriate;
• An appropriate risk culture has been imbedded in the Group’s strategy; and
• The risk management system operates appropriately to inform the Board of the major risks facing the Group.

An ongoing process for identifying, evaluating and managing the key risks faced by the Group has been in place for the year under review and up to the date of approval of the annual financial statements.