corporate governance - woolworths holdings limited

isk committee
The risk committee consists of three executive
directors and three non-executive directors
including the chair Mike Leeming. The presence
of the executive directors on this committee is
deemed important in ensuring that effective risk
management is in place and part of the day-today
operation of the company.
The responsibilities of the committee are set
out in its terms of reference which is reviewed
and updated on an annual basis. The main
responsibilities include:
■ assisting the directors in fulfilling their
responsibility of ensuring that there is an
effective and embedded risk management
process in place throughout the group;
■ assessing whether there are appropriate
processes/controls in place to manage the key
risks down to an acceptable level, in line with
the board's risk appetite;
■ assessing if the risk management process will
ensure that emerging risks are identified and
managed;
■ assessing whether all new business
opportunities have been appropriately
considered from a risk perspective;
■ assessing if appropriate processes/controls are
in place to ensure regulatory compliance; and
■ reviewing the adequacy of the group’s
insurance portfolios.
Based on a review of management reports and
appropriate discussion and enquiry by the
members, the committee believes that it
performed the functions set out in its terms of
reference and continues to identify and
prioritise the risks relevant to the business.
The committee met a total of four times during
the year. The details of individual attendance at
the risk committee meetings are set out on
page 31.
The Chairman attends the meetings in February
and August following the group’s financial half
year and year end.
risk management
The board recognises risk management as a key
business tool, which is designed to:
■ balance risk and reward within both existing
and new businesses; and
■ protect the group against uncertainties and
hazards, which could prevent the achievement
of business objectives.
The board is responsible for the risk
management process and is assisted in its
responsibilities by the risk committee. The dayto-day
responsibility for risk management and
the design and implementation of appropriate
processes to manage the risks resides with
management.
The risk management process is effective and
adds value to the group by:
■ improving the quality of business decisions,
through a more formal identification and
assessment of risk before new business ventures
and/or projects are presented for approval; and
■ contributing to an improvement in the
processes and controls in place to manage the
key risks.
The risk management process applied is
designed to ensure that:
■ all relevant risks are identified and
appropriately evaluated, based on their impact if
they were to occur and their likelihood of
occurrence;
■ risks and the required processes and controls
to manage these risks are assessed in line with
the board’s risk appetite; and
■ appropriate management information and
monitoring processes are in place to manage
the exposure to each of the key risks, so that
where required appropriate corrective action
can be taken.
The focus for the year was to integrate risk
management with the strategic and business
planning process. This has further embedded
risk management into our established business
disciplines, as has the definition and
measurement of objective metrics, to assess our
exposure to the key risks. During the year:
■ each business unit updated their business risk
profile during their strategic and business
planning. The purpose was to identify key risks
linked to the strategy and our business model
and the required processes and controls to
manage these risks over the next three years;
■ the key inherent risks for the group were reevaluated,
based on the revised business unit
profiles and a reassessment of the prior year
key inherent risks; and
■ the required management information and
metrics to objectively assess our exposure to
the key risks were clearly defined.
The key inherent risks and their status are
reported to the risk committee on a quarterly
basis. This report is complemented by risk
reports on specific focus areas including, crisis
management, business continuity planning,
disaster recovery, food safety and quality,
occupational health and safety, legal risk
management and insurance.
21