CASE STUDY: RISK MANAGEMENT $$ THE ROLE OF A RISK MANAGER

From $2020$ to the present date, many incidents and events caused a focused

approach towards risk management and the role of risk managers. Examples of

these events are the COVID$-19$ pandemic and the severe effects on many countries,

economies, and businesses. South Africa is not excluded and is even further

hampered by a severe shortcoming of power supply and inadequate service delivery

to the people. These are all risk$-$related incidents$/$events involving risk managers to

assist in the management thereof. According to an article in the Enterprise Risk

Magazine $(2023),$ uncertainty also boosted the profile and role of risk managers, and

it seems that, lately, large$-$scale risks happen more often, which requires solid,

predictive risk management to cope with an increasingly cloudy business and

environment. As such, it seems imperative that the role of risk managers is clear,

and that the most appropriate risk management tools are available. The classic three

lines of defence risk governance model endeavour to demarcate the various roles

regarding the management of risks. Although there are many issues surrounding this

model, it provides a foundational guideline between the roles of the main role$-$players

in risk management.

Regarding the tools for operational risk management, it seems there are concerns

over the predictive powers of key risk indicators $($KRIs$),$ the value of risk and control

self$-$assessments $($RCSAs$),$ and the subjectivity of scenario analysis to manage

operational risks $($Enterprise Risk Magazine, $2023).$ In addition, embedding an

operational risk management framework is becoming essential. However, it seems

there is a vague understanding of the exact role of a risk manager. Furthermore,

according to the Enterprise Risk Magazine $(2023),$ too much effort is being spent on

issues that generate too little value when using operational risk management tools RCSAs are, for example, tools that should provide value to organisations by

identifying the primary inherent risks, which can be used for analysing risk scenarios

and determining and managing KRIs. In addition, RCSAs can also determine control

weaknesses to manage the residual risks effectively. The Enterprise Risk Magazine

$(2023)$ mentioned that organisations should focus their RCSA efforts on the

effectiveness and adequacy of controls in mitigating low and mediumfrequency$/$medium and high$-$impact operational risks. Concerning risks leading to

high$-$frequency and low$-$impact operational loss incidents should be managed by

means of more real$-$time monitoring of KRIs. This could ensure the obtaining of value

from the RCSA activity.

The year $2023$ will see certain risk events escalate, requiring a more $$aggressive$$

and formal approach by risk managers to assist organisations in coping with these.

According to the Institute of Risk Management $($IRM$,2023),$ some of these risks,

specifically for South Africa, were identified by various risk managers as follows:

$$ Future disasters such as floods, global warming and drought will continue in

$2023.$

$$ The energy crisis is constantly negatively influencing the economy.

$$ The slow pace in sustainability and investment projects.

$$ Poor maintenance and development of infrastructures.

$$ Cyber risks and cybercrimes are increasing.

$$ Fraud and corruption are not adequately dealt with.

General comments on the abovementioned stated that there seems to be a lack of

effective business continuity processes and disaster management to manage future

disasters. This is valid for the public and private sectors$.$ Fraud and corruption are

causing a negative view of the country, causing investors not to invest in a degrading

economy, which leads to unemployment, poverty, and inequalities. Technology also

needs to be insourced due to a lack of adequate expertise, which causes the country

to be more vulnerable to cyber risks. Qualified people are emigrating to other

countries due to various uncertainties surrounding the country's well$-$being. The

energy crisis also primarily contributes to the country$$s economic demise. The loadshedding is causing businesses to fail and hamper service delivery. In addition,

this leads to the poor maintenance of infrastructures and provisioning of water and

sanitation services. In addition, unmaintained infrastructure also affects the

environment, economy, and society, causing a negative impact on sustainability and

investment projects.

For training purposes, some fictitious information is included in the case study.

Analyse the case study and answer the related questions

Question $1$

$(30)$

Diagrammatically illustrate the three lines of defence to indicate the roles in terms of risk management. Explain the differences between the roles of the head of operational risk management and the third line of defence in detail.