Fundamentals of Risk Management

Risk strategy
268
TAbLE 
22.3
Responsibilities of the RM committee
To advise the board on risk management and to foster a culture that emphasizes 
and demonstrates the benefits of a risk-based approach to risk management
To make appropriate recommendations to the board on all significant matters 
relating to the risk strategy and policies of the company
To monitor the performance of the risk management systems and review reports 
prepared by relevant parties
To keep under review the effectiveness of the risk management infrastructure of
the company, including:
●
●
assessment of risk management procedures in accordance with changes in
the operating environment
●
●
consideration of risk audit reports on the key business areas to assess the level 
of business risk exposure
●
●
consideration of any major findings of any risk management reviews and the 
response of management
●
●
assessment of the risks of new ventures and other strategic, project and 
operational initiatives
To review the risk exposure of the company in relation to the risk appetite of the board 
and the risk capacity of the company
To consider the development of risk management and make appropriate 
recommendations to the board
To consider whether disclosure of information regarding risk management policies 
and key risk exposures is in accordance with financial reporting standards
the organization. However, for some business sectors, the level of risk that the
organization should take is a fundamental business strategy decision. This is certainly 
true in banks and other financial institutions.
In these circumstances, deciding on a risk appetite and the monitoring of actual risk 
exposure becomes a high-profile board responsibility. Therefore, the risk committee 
will need to be a committee of the board with executive and non-executive member-
ship. Even in these circumstances, however, the risk committee will probably not be 
a non-executive committee, as will be the case with the audit committee. If a risk 
committee is established as a sub-committee of the board, then it will be important 
for the organization to maintain the integrity of the three lines of defence model.
The terms of reference of the risk committee and its position within the risk 
architecture are fundamentally important decisions for any organization. In all 
circumstances, the arrangements should be appropriate for the organization and 
aligned with business activities. Also, the nature of the risk committee will need to be 
appropriate and proportionate within the external, internal and risk management 
contexts of the organization. 

---