Download the Annual report 2011 - Unisa

The risk management structures that are in place to assess,
manage and monitor risk at the university include:
• The Council is responsible for overseeing the adequacy
and overall effectiveness of the university’s risk
management function and its implementation by
management.
• The Audit and Enterprise Risk Management Committee
of Council has specific responsibility for the
risk management process and receives the risk reports
of the university, and reports to Council on key risks
facing the university and associated risk mitigation responses.
• Central to the risk management process at Unisa is
the Risk, Ethics and Controls Committee (a subcommittee
of the Management Committee) comprising
members of Executive Management. In 2011 this
Committee met four times to review, evaluate and coordinate
themanagement of identified strategic and
operational risks (financial and non-financial) faced by
the university. Management, acting on the advice of
its Risk, Ethics and Controls Committee, is accountable
to the Council for designing, implementing and monitoring
the process of risk management and integrating
it into the day-to-day activities of the university.
Accountability is established at Management level for
each significant risk and the identified portfolio manager
with his/her management team is tasked to
identify relevant measures to manage identified risks.
The control appropriateness of the measures is evaluated
and the perceived residual risk exposure determined
and monitored.
• A dedicated Directorate: Enterprise Risk Management
comprises competent and experienced staff.
The Directorate oversees the process from the perspective
of strategic direction, ongoing improvement
in methodology and processes, and technical assistance.
Operational risk registers for a number of departments
have been developed and are in various stages of completion
as reflected in the table below:
Summary of operational risk registers developed
Category Description Number (%)
A Completed 56 (58%)
B In progress 35 (35%)
C Not started
– valid reasons available 7 (7%)
TOTAL 98 (100%)
UNISA ANNUAL REPORT 2011
| 58 |
Enterprise Risk Management has matured from operating
under a reactive framework toward being effective
in a wider context of identifying and managing risks
proactively and seeking to introduce best practice initiatives.
All basic structures are in place and operational to
cope with the current maturity level. Risk registers are
constantly being updated. However, it is acknowledged
that the university has not as yet established enterprisewide
risk and compliance profiles and the process of ensuring
compliance will receive additional focus
throughout the next planning period and beyond.
In line with its concerted focus on sound corporate governance
and sustainability (Goal 6) Unisa has embarked
on a risk-based planning methodology for its 2013-
2015 institutional planning cycle. The planning methodology
is based on the national statutory and regulatory
obligations, the principles of good practice as established
by the King III Code, and the institutional requirements.
The most significant risks that the university currently
faces include those pertaining to service delivery (14,40),
throughput and success rates (12,92), attracting and retaining
competent staff (12,96), and technology and information
systems (15,91). The criticality factor (residual
rating) of these risks is indicated in brackets. (A rating
scale of 1 to 25 is used: 25 being the highest exposure.)
These risks are included in the university’s Key Risk Register
and Operational Plan.
The table on the following page provides a brief description
of some of the key risks to which the university is
exposed, and the mitigating controls in place to manage
these risks, as approved by the Management and
Council.
Identified ‘financial risks’ and ‘non-financial risks’ and are
dealt with in accordance with their allocated levels of priority.
Financial risks are discussed in the Consolidated Financial
Statements.
Insurance policies are in place to cover risks. These are
monitored by the Finance Committee, which satisfies itself
that cover against fire and related risks, accidental
damage, business interruption, theft, money and fidelity
and, critically, both public and employee liability is adequate.
Despite the evident progress, the university acknowledges
that embedding the awareness and understanding
of risk management so that it becomes part of the integrated
culture of the organisation is an organic process.