Fundamentals of Risk Management

Risk assurance
428
Table 36.2 is an example of a list of risk factors, but it does not include all of the 
items contained in the full list filed as part of Form 20-F. Each of the listed risks 
would usually be described in more detail, by way of a detailed explanation of up
to half a page. Additionally, the Securities and Exchange Commission (SEC) is
considering whether to require more detailed reports on the risk committee reporting 
structure in companies listed on US stock exchanges. The SEC is the federal regulator 
of US stock exchanges and has the mission to protect investors, maintain fair, 
orderly and efficient markets, and facilitate capital formation.
Charities’ risk reporting
Risk reporting by charities is compulsory in most countries in the world. In general, 
there is an expectation that charities should have detailed risk management procedures 
broadly equivalent to those required of government departments or of companies 
listed on a stock exchange. A shortened version of the advice on risk reporting set out 
in the UK Charity Commission guidance is as follows:
The form and content of risk reporting should reflect the size and complexity of an 
individual charity. The Charity Commission is not seeking to standardise risk reporting. 
A narrative style report that addresses the key aspects will be an acceptable approach to 
reporting, provided that the report provides:
●
●
an acknowledgement of trustees’ responsibility;
●
●
an overview of the risk identification process;
●
●
an indication that major risks have been reviewed or assessed;
●
●
confirmation that control systems have been established.
It is recognized that some charities, particularly larger charities or those with more 
complex operations, will wish as a matter of best practice to expand on this basic 
approach in their reporting. Where this more detailed approach to reporting is 
adopted it will be desirable to address the following broad principles, describing 
how they have been incorporated into the risk management procedures of the
charity:
●
●
linkage between the identification of major risk and the operational and 
strategic objectives of the charity;
●
●
procedures that extend beyond financial risk to encompass operational, 
compliance and other categories of identifiable risk;
●
●
linkage of risk assessment and evaluation to the likelihood of its occurrence 
and impact should the event occur;
●
●
ensuring risk assessment activities and monitoring are ongoing and embedded 
in management and operational procedures;
●
●
trustees’ review and consideration of the principal results of risk 
identification, evaluation and monitoring.

---