Demo Mutual Assurance (Pty) Ltd

Finding 1

Observation

Risk Culture & Capability is at Level 1 (1.0), 3.0 below the target of Level 4.

Impact

Heightened regulatory exposure: Risk Culture & Capability carries Critical regulatory criticality for this profile, and current maturity is below the expected standard.

Recommended response

The chief executive or equivalent should make a written statement of personal commitment to risk management, to be communicated to all staff, included in the next town hall or all-staff meeting, and referenced in the organisation's next available external communication (annual report, website, stakeholder update). The statement should be specific, not generic.

Finding 2

Observation

Strategy, Risk Appetite & Decision-Making is at Level 2 (2.0), 2.0 below the target of Level 4.

Impact

Heightened regulatory exposure: Strategy, Risk Appetite & Decision-Making carries Critical regulatory criticality for this profile, and current maturity is below the expected standard.

Recommended response

Develop a formal risk appetite statement with defined tolerance thresholds for the organisation's principal risk categories (financial, operational, regulatory, reputational). Present it to the board for approval as a standalone document, not embedded in the risk policy. Link the thresholds explicitly to strategic objectives.

Finding 3

Observation

Risk Management Process is at Level 2 (2.0), 2.0 below the target of Level 4.

Impact

Heightened regulatory exposure: Risk Management Process carries Critical regulatory criticality for this profile, and current maturity is below the expected standard.

Recommended response

Establish a defined risk assessment cycle: all business units must complete a full risk assessment (identification, analysis, evaluation, treatment plan update) at least annually, with the risk register updated in between for material changes. The risk function should facilitate and review assessments for quality and consistency before they are finalised.

Finding 4

Observation

Monitoring, Review & Improvement is at Level 2 (2.0), 2.0 below the target of Level 4.

Impact

Heightened regulatory exposure: Monitoring, Review & Improvement carries Critical regulatory criticality for this profile, and current maturity is below the expected standard.

Recommended response

Define formal KRIs for each of the organisation's principal risks: for each KRI, specify the data source, measurement frequency, amber threshold (early warning) and red threshold (escalation required). Have KRIs approved by the risk committee and incorporate them into the quarterly risk report.

Finding 5

Observation

Risk Governance & Oversight is at Level 3 (3.0), 1.0 below the target of Level 4.

Impact

Heightened regulatory exposure: Risk Governance & Oversight carries Critical regulatory criticality for this profile, and current maturity is below the expected standard.

Recommended response

Redesign board risk reporting to shift from a descriptive risk list to a decision-useful report that highlights what has changed since the last meeting, which risks are approaching or have breached appetite thresholds, and what management is doing in response. Implement the new format for the next two board cycles and refine based on feedback.

What this means

Board-approved risk policy and framework aligned to ISO 31000. A functioning risk committee (board or executive level) with a charter meets at least quarterly. A designated risk function with a defined mandate and reporting line. Three-lines responsibilities documented and broadly understood.

Recommended next steps

• Redesign board risk reporting to shift from a descriptive risk list to a decision-useful report that highlights what has changed since the last meeting, which risks are approaching or have breached appetite thresholds, and what management is doing in response. Implement the new format for the next two board cycles and refine based on feedback.
• Conduct an annual risk committee effectiveness review: assess whether the committee's composition, frequency, information quality and interaction with management are delivering effective oversight. Present findings and improvement actions to the full board. Consider using an established governance assessment framework or external facilitator for the first review.
• Expand the risk committee's oversight mandate to explicitly include strategic, emerging and conduct risks, not only operational risk register items. Add a standing agenda item for horizon risk (what is emerging in the external environment that could affect strategy in the next one to three years) and a periodic conduct risk review.

What this means

A broad risk appetite statement exists in policy but is not operationalised. Risk is considered informally in some decisions but without a consistent framework. Tolerance thresholds are undefined or untested.

Recommended next steps

• Develop a formal risk appetite statement with defined tolerance thresholds for the organisation's principal risk categories (financial, operational, regulatory, reputational). Present it to the board for approval as a standalone document, not embedded in the risk policy. Link the thresholds explicitly to strategic objectives.
• Formalise the annual strategic planning process to include a risk assessment step: the risk function should be involved in strategy development, not only consulted after the strategy is set. Introduce a risk register of strategic risks that is maintained alongside the operational risk register.
• Embed a risk assessment requirement in the business case or decision paper template for all decisions above defined approval thresholds. The template should require proposers to state the principal risks, the residual risk after proposed mitigations, and whether the risk falls within the board-approved appetite.

What this means

A documented framework aligned to ISO 31000 is in place and reviewed at least every two years. Common risk taxonomy, definitions and procedures are established and communicated. Dedicated risk resources with appropriate skills are in place; budget is allocated.

Recommended next steps

• Evaluate and implement a risk management technology solution appropriate to the organisation's size and complexity: this could range from a structured GRC system for larger organisations to a well-architected SharePoint-based risk register for smaller ones. The key requirements are: single system of record, audit trail, access controls, and the ability to produce consistent reports.
• Conduct annual risk resource benchmarking against peer organisations: compare the risk function's size, qualifications, budget and tools against available industry data or regulatory expectations. Use findings to make an evidence-based case for resource investments or to confirm adequacy.
• Integrate the risk framework into all major governance processes: reference it explicitly in the board charter, all committee terms of reference, the internal audit charter, HR policies (performance management) and the strategic planning process. The framework should be the thread connecting all governance activities, not a standalone risk document.

What this means

Risk assessments occur periodically (often annually) using basic likelihood/impact matrices. A risk register exists but may be static and owned by the risk function alone. Treatment plans exist for some risks. Root-cause analysis is applied inconsistently after significant incidents.

Recommended next steps

• Establish a defined risk assessment cycle: all business units must complete a full risk assessment (identification, analysis, evaluation, treatment plan update) at least annually, with the risk register updated in between for material changes. The risk function should facilitate and review assessments for quality and consistency before they are finalised.
• Establish a root-cause analysis standard: define the methodology to be used (e.g. 5-Whys, fishbone/Ishikawa, fault tree analysis), train relevant managers in its use, and make completion of a root-cause analysis mandatory for all incidents meeting defined significance criteria. Record findings in the incident log and track corrective actions.
• Introduce an emerging risk review as a standing item in the annual risk assessment cycle: at least once a year, facilitate a management discussion on what is changing in the external environment (regulatory, technological, economic, geopolitical) that could create new risks or alter the profile of existing ones. Document findings and update the risk register.

What this means

Risk culture is absent or counterproductive: bad news is suppressed, accountability is avoided, and risk is seen as the risk function's problem alone. No risk training or awareness programme. Incentives do not consider risk behaviour.

Recommended next steps

• The chief executive or equivalent should make a written statement of personal commitment to risk management, to be communicated to all staff, included in the next town hall or all-staff meeting, and referenced in the organisation's next available external communication (annual report, website, stakeholder update). The statement should be specific, not generic.
• Establish a basic risk training module for all staff, a one to two hour session covering what risk management means for the organisation, why it matters, the individual's role in managing risk, and how to report a risk concern. Deliver the training within the next 90 days and track completion.
• Establish an escalation channel: define (in writing) how staff can raise risk concerns, near-misses or potential compliance issues. This need not be a sophisticated whistleblower programme at this stage, a named contact (the risk officer), a documented process and a clear statement that concerns will be taken seriously and that the raiser will not face adverse consequences.

What this means

Some monitoring of top risks exists but is inconsistent and largely manual. Incident recording is ad hoc; lessons learned are not systematically captured. Framework review occurs infrequently and is driven by external events rather than planned cadence.

Recommended next steps

• Define formal KRIs for each of the organisation's principal risks: for each KRI, specify the data source, measurement frequency, amber threshold (early warning) and red threshold (escalation required). Have KRIs approved by the risk committee and incorporate them into the quarterly risk report.
• Implement a combined assurance approach: map which risks and controls are covered by first-line self-assessment, second-line risk function review, and third-line internal audit. Identify gaps (risks or controls with no assurance coverage) and agree with the risk committee how to address them within the current year.
• Conduct a lessons-learned review of all significant incidents from the past two years: identify whether root causes were addressed, whether the same incident types have recurred, and what systemic patterns exist. Present findings to management with a time-bound improvement plan addressing the most significant systemic gaps.

What this means

Structured risk reports are produced for management (monthly or quarterly) and the board (quarterly minimum) using a consistent format. A maintained risk register is accessible to relevant stakeholders. Regulatory reporting obligations are met on time. Data quality is considered in reporting.

Recommended next steps

• Redesign board and management risk reports to be decision-useful rather than descriptive: shift from listing risks to highlighting what has changed, what is approaching an appetite threshold, what management is doing about it, and what the board's attention or decision is required on. Pilot the new format with the risk committee and refine based on feedback before full implementation.
• Implement a GRC (governance, risk and compliance) system or an equivalent structured risk information platform that serves as the single system of record for risk data, provides access controls and audit trail, enables automated reporting, and integrates risk, compliance and assurance data. Develop a user adoption plan to ensure the system is actively used by risk owners.
• Formally assure risk data quality: establish a data quality review process that is conducted before each major reporting cycle, defines quality metrics (completeness, accuracy, timeliness), reports quality findings to the risk function management, and tracks quality improvement over time. Present data quality trends to the risk committee annually.

What this means

Compliance risk management is integrated with operational risk. The obligations register is maintained in near-real-time as regulations change. Regulatory relationships are proactive: the organisation engages with regulators on policy developments. Compliance risk appetite is defined.

Recommended next steps

• Automate compliance monitoring for key controls: implement technology-enabled monitoring (e.g. transaction monitoring for AML/CFT, automated data quality checks for regulatory reporting, automated access control reviews for data protection) that provides real-time or near-real-time compliance status and alerts for potential breaches.
• Become a recognised contributor to regulatory dialogue: respond formally to regulatory consultation papers in the organisation's sector; contribute to industry body working groups developing regulatory standards; present at regulatory forums. Position the organisation's compliance expertise as a public good as well as a competitive asset.
• Use ethical compliance as a market differentiator: document the organisation's compliance standards and ethical commitments, publish them in client-facing materials and tenders, and demonstrate compliance strength through independent assurance (third-party audits, regulatory commendations, industry certifications). Market compliance excellence as a client benefit.