1

COURSE NAME: ADVANCED PROGRAMME IN RISK MANAGEMENT

COURSE CODE: APRM05Y

STUDENT NAME: SMISO LIFA KENNETH GWEBU

STUDENT NUMBER: 77325443

ASSIGNMENT CODE: 723389

2

ADDING VALUE TO THE BUSINESS THROUGH INTEGRATED RISK

REPORTING

A study from the perspective of the financial institutions

S. L. K. Gwebu

77325443

Field Study Report in fulfilment of the requirements for the Advanced Programme in

Risk Management (APRM05Y) at the University of South Africa

I hereby declare that the Field Study Report is my own work and that all the sources

that I have used or quoted have been indicated and acknowledged by means of

complete references.

S.Gwebu 28 October 2016

Signature Date

3

Table of Content

Title Page

1. Abstract 4

2. Introduction 5

3. Problem Statement 6

4. Literature Review 7

4.1. Risk Management 7

4.2. Risk Reporting 9

4.3. Integrated Reporting 10

4.4. Value Creation 11

5. Conclusion 12

References 14

4

1. Abstract

Integrated risk reporting is a modern technique which the management and boards

of successful corporations utilise to maximise and create new opportunities for

shareholder value creation. Integrated reporting is seen as important to guaranteeing

the viability of any corporate strategy and, by extension, the value creation process

and as the board’s governance role expands accordingly, so integrated reporting is

increasingly being used as a tool to understand and communicate value creation in

its broadest context. The aftermath of the financial crisis of 2007/8 on has been a

major learning point for banks and one of the key emphases is the importance of an

effective and efficient enterprise risk management model. Enterprise Risk

Management (ERM) has over the years evolved from the normal reactive approach

of historical view of loss events to a model that is proactive approach to predict the

future. Recent studies have aimed at broadening the study of risk management

holistically only up to the extent of proving ERM as a tool to eliminate and mitigate

risk events from hindering delivery of business outcomes.

As a result this study “Adding value to the business through integrated risk reporting”

is formulated in order to gain better understanding of risk management practices and

to examine the critical success factors for effective integrated risk reporting on value

creation from a financial perspective view.

The study will aim at broadening the concept of risk management from what recent

researchers have already concluded by incorporating modern techniques.

Keywords: Integrated reporting, Risk reporting, Value to business, Enterprise

risk management.

5

2. Introduction

The management of risk in the financial institutions is increasing and vital for the

continuity of the business as advocated by the Basel Committee on Banking

Supervision (2003). Integrated reporting is increasingly seen as a necessary

requirement for delivering long-term value creation by businesses building

connectivity across organizations, breaking down internal barriers and enhancing

decision making. According to the International Integrated Reporting Framework

(IIRC 2013), integrated reporting aims at promoting a more cohesive and efficient

approach to corporate reporting that draws on different reporting strands and

communicates the full range of factors that materially affect the ability of an

organization to create value over time; improve the quality of information available to

providers of financial capital to enable a more efficient and productive allocation of

capital. Banks play an important part in the world economy, which became clear

during the recent global financial crisis where a number of banks were liquidated.

These typical losses can happen again if banks cease to perform their central role in

the economy, and it is therefore imperative that banks maintain their future growth

and ensure a sound risk management approach (Young 2012).

The financial crisis of 2007 is seen as a failure by banks to have proactive risk

management programs and as a result banks are investing on risk management.

Schroeck (2002) in his book titled “Risk Management and Value Creation in

Financial Institutions” argues that from a theoretical point of view, it is not

immediately clear if and how risk management at the corporate level can be useful

while another study by Stubbs and Higgins (2014) argue that while organizations are

producing some form of integrated report are changing their processes and

structures, or at least talking about it, their adoption of integrated reporting has not

necessarily stimulated new innovations in disclosure mechanisms.

6

3. Problem statement and purpose of the study

In this study we explore how financial institutions can use integrated risk reporting to

add value to the business. This has been necessitated by the confusion regarding

the level and accuracy of risk reporting and how the reports are to be handled

(Capitec 2013). According to the King Report on Governance for South Africa

(2009), by issuing integrated reports, a company increases the trust and confidence

of its stakeholders and the legitimacy of its operations. It can increase the company’s

business opportunities and improve its risk management. By issuing an integrated

report internally, a company evaluates its ethics, fundamental values, and

governance, and externally improves the trust and confidence which stakeholders

have in it. The report recommended integrated sustainability performance and

integrated reporting to enable stakeholders to make a more informed assessment of

the economic value of a company. Integrated risk reporting entails the use of Key

Risk Indicators (KRIs) and Key Performance Indicators (KPIs) in measuring the

current performance of the business and sustainability against the emerging risk.

Value creation is not only about product innovation, meeting sales target, but value

creation also includes to a greater extent the integrated reporting which will give

confidence to all stakeholders.

The boards of directors as a third line of defense have a fiduciary to protect all

stakeholders’ interest given that they have been presented with enough information

for decision making. Financial institutions deploy risk champions in the business

units who will collect key risk data and put together a report for the central risk unit,

from the central risk unit a board report will be formalized and tabled to the executive

committee. From the executive committee this risk report will go to the board where

decision will be taken. Boards are constantly discussing if there is value in investing

in risk management and Ernest and Young (2014) examines the theory of integrated

risk reporting.

7

4. Literature review

Researchers have explored the value creation purpose through integrated risk

reporting. Hatch (2013) is of the view that risk and value management are

interrelated functions and processes with value management considering the best

way to deliver the need or benefit and risk management being used to assist in

choosing the best solution and the management of the delivery risks to achieve the

expected benefit. Enterprise Wide Risk Management (EWRM) approach to risk

management and value creation must be adopted for efficiency (Bank for

International Settlements – BISS 2003)

Figure 1: Enterprise Wide Risk Management Drivers

(Source: Manab et al. 2010)

Chartered Institute of Management Accountants (CIMA 2011) provided some

insights on how it is possible to link risk to performance management through top

management reporting.

4.1. Risk Management

As with the definition of risk, there are equally many accepted definitions of risk

management in use as presented by many researchers in this field (IOSCO 1997,

Casualty Actuarial Society 2003, COSO 2004, Cumming et al. 2001, Hillson 2006).

Some describe risk management as the decision-making process, excluding the

Corporate Governance Improve communication

Regulation Globalization

Technology Advancement EWRM

Shareholder requirements

Competitive advantage Complexity of risks

Corporate companies’ failures Good business practices VALUE CREATION

8

identification and assessment of risk, whereas others describe risk management as

the complete process, including risk identification, assessment and decisions around

risk issues. According to Berg (2010), risk management is an activity which

integrates recognition of risk, risk assessment, developing strategies to manage it,

and mitigation of risk using managerial resources. The perception of risk in

contemporary times is changing. In the past, risk is seen negatively, while in

contemporary times, risk is viewed in either a positive or negative fashion in

response to outcomes of a myriad of events and because of the duality perspectives

of risk as both positive and negative, stakeholders need more information on risk

disclosure to make business and investment decisions and better understand

companies’ social responsibility positions (Social Responsibility Journal 2013).

Management of risk is not just ownership but responsibility, risk management entails

high levels of data integration and consideration of the interrelation of risk types for

efficiency and effectiveness in reporting. Cumming et al. (2001) affirms that risk

management involves not only an attempt to quantify risk across a diversified firm,

but also a much broader process of business decision making and of support to

management in order to make informed decisions about the extent of risk taken both

by individual business lines and by the firm as a whole. Integrated risk management

addresses risks across a variety of levels in the organization, including strategy and

tactics, and covering both opportunity and threat. Effective implementation of

integrated risk management can produce a number of benefits to the organization

which are not available from the typical limited-scope risk process (Hillson 2006).

The critical component to analyse is “Where does risk management sit in an

organisation?” However, this cannot be answered by not first addressing another

question “Where is the risk?” In order for risk to be effectively managed one needs to

understand the business, the core functions and expected outcomes. From these

variable risk will be identified and the risk owner will be easily identified and this is

where risk management sits (Duckert 2011). The risk management objectives should

be clearly defined and correspond with the parameters measuring the main goal of a

company (Wieczorek-Kosmala 2011). In Capitec’s view, risk management as a

means of ensuring that sustainable value is created for stakeholders in a responsible

manner (Capitec 2013). Wieczorek-Kosmala in his study acknowledges that the idea

9

of the risk management integration is growing on importance nowadays. The primary

objective of risk management is to ensure the ongoing existence of the company

(Stiller and Joehnk 2014)

4.2. Risk Reporting

Society of Actuaries (2005) broadens the study of effectiveness of risk management

strategies to protect the organisation with special focus on the reporting the risk to

the board. There is a general concern about what should be in a risk report as often

the preparers of this report provide less information and the users of the reports want

more of this information (Association of Certified Chartered Accountants - ACCA

2014). Risk reporting is a critical function of risk management as informed decision

making flows from good operational risk reporting (Blunden 2013). Duckert (2013)

further highlights that the usage of data or facts will lead to rapid and accurate

evaluation of risk and timeliness of reporting that cannot be achieved by any means.

An effective risk reporting model is one inclusive off all risk associated with the

business, consist of qualitative and quantitative data, proactive rather than reactive

and must be data-centric (Duckert 2013).

From the model of integrated risk reporting it is critical to deviate from the norm that

the audience of the report will determine the level of the report, the report is the basis

of decision making at all hierarchal levels of the company and as such the reporting

should inform all stakeholders. There is no value created from a thumb sucked report

as this is highly likely to misinform the board. High-quality risk reporting increases

investor confidence, not just in terms of the risks being discussed, but also in the

overall quality of management (ACCA 2014). Duckert (2011) argues that risk

reporting can be summarised using the concept of risk assessment which constitutes

the identification of risk, calculating the probability of occurrence and determining the

impact or exposure. However, the ACCA (2014) study provides a broader outlook of

risk reporting, the user wish list of the risk report constitutes: identification of the key

risks the company faces, preferably in plain English; an explanation of why

management believes these risks to be critical; an explanation of why management

10

believes these risks to be critical; identification of emerging and new risks and an

explanation of how management assesses risk throughout the year.

4.3. Integrated Reporting

During the recent global financial crisis it became clear that risk reports were either

taken for granted or that the reports did not provide sufficient enough information for

accurate and timely decision making and we have seen the hike in regulatory fines

within the financial institutions mostly attributed to risk management failure.

Integrated reporting is the latest reporting innovation, emerging in 2010 with the

formation of the International Integrated Reporting Council (Stubbs and Higgins

2014). Integrated reporting builds on the practices of Financial Reporting, and

Environmental, Social and Governance Reporting, and equips companies to

strategically manage their operations, brand and reputation to stakeholders and be

better prepared to manage any risk that may compromise the long-term sustainability

of the business (KPMG 2011). The consequences of the fines have lead to

liquidations, unquantifiable reputational losses and significant decline in market

share. Board members are best placed to ensure overall organizational and cultural

alignment and to achieve the benefits that come from effective reporting practices.

Investors may not yet routinely request integrated reports, but this should not be a

reason for boards to delay starting their integrated reporting journey. Investors say

they have more confidence in management when they gain a clear picture of the

business from reporting (IIRC 2014). Whilst this concept has been adopted in many

institutions there has been some criticism by some researcher for its focus on

financial capital providers to the detriment of the information demands and needs of

other key stakeholders (Cheng et al., 2014).

11

4.4. Value Creation

Figure 2: Integrated view of value creation in banks.

(Source: Schroeck: Risk Management and Value Creation in Financial Institutions)

According to Hatch (2013) Investors are seeking the best risk weighted investment

return for their capital with a risk profile that is congruent with their tolerable risk

level.Effectively managing or controlling the factors that cause risk can result in

market leadership, increase in company growth and investor confidence (Manab et

al. 2010). Jensen (2001) argues that creating value takes more than acceptance of

value maximization as the organizational objective. As a statement of corporate

purpose or vision, value maximization is not likely to tap into the energy and

enthusiasm of employees and managers to create value. Seen in this light, change

in long-term market value becomes the scorecard that managers, directors, and

others use to assess success or failure of the organization. The choice of value

maximization as the corporate scorecard must be complemented by a corporate

vision, strategy and tactics that unite participants in the organization in its struggle for

dominance in its competitive arena.

The retail department of one of the leading bank was in the process of introducing a

new investment product of the bank, from the product research conducted the results

were clear that this product was to be launched immediately, the department called

in all the stakeholders for a project scoping meeting and the risk department was

12

excluded as it was viewed as business disabler. The product was eventually rolled

out to the market at significant costs to the company, without a proper risk

assessment for board approval and no regulatory approval granted. The product did

not yield the expected outcomes, customer complaints and claims increased and the

regulator fined the bank heavily. The board instituted investigations and one of the

key findings was that a risk assessment was not conducted on the product which

could have highlighted the significant flaws and provided solutions for a safer product

to create the value it was intended for. The three lines of defence in risk

management working collectively can achieve results far beyond the management of

risk.

The biggest benefits of integrated reporting will not come from being compliant or

from attracting investors, they will come from the discipline of needing to think, plan

and manage in a more integrated way and this will help companies achieve the

agility and flexibility they need to respond to change and seize opportunities in an

increasingly transient world (IIRC 2014). Ranesh et al. (2012) concluded that bboth

risk management and value management are considered to be best practice in

project management and enable organizations to define objectives when delivering

complex projects whilst reducing risk and maximizing value.

5. Conclusion

The risk culture incorporated with integrated reporting can achieve results far beyond

the management of risk, it creates a culture of integrated thinking and integrated

decision making where everyone understands and operates on the culture. As

affirmed in the Capitec (2013) report that integrated risk management can be utilised

in aligning strategy, processes, people, technology and knowledge with the purpose

of evaluating and managing opportunities, threats and effectively balancing risk and

controls. Value Management and Risk Management are key enablers and

interrelated processes for successful decisions and delivery of benefits for an

organization (Hatch 2013). Any organization that continuously identifies and pursues

growth and expansion opportunities will unlock and create value for its stakeholders

as affirmed by (Mpact 2015, Ranong et al. 2009). Regulators are strengthening their

13

grip on financial institutions in as far as corporate governance as a result of the

recent global financial crisis, the reporting hierarchy in the banking industry has been

put under spotlight with regulators constantly dictating on what is to be reported in

the risk reports and the ownership of those reports.

It is my conclusion that integrated reporting will create a platform of innovative ideas

to give any organisation a competitive advantage over its competitors. The users of

the reports rely on the creators of the reports for accurate and timely decision

making that will add value to the long-term strategic objectives of the business.

Therefore, a well sponsored corporate governance framework with emphasis on

integrated risk reporting will not only be a function used for the risk universe but will

now be used as a business enabler in value creation.

14

References

1. Association of Chartered Certified Accountants, 2014. Accountants for

Business; Risk Reporting.

2. Bank for International Settlements, 2003. Basel Committee on Banking

Supervision, the Joint Forum; Trends in Risk Integration and Aggregation.

3. Berg, H. 2010. Risk Management: Procedures, Methods and Experiences.

June 2010.

4. Blunden, T., Thirlwell, J. 2013. Mastering Operational Risk. 2nd Edition.

Harlow Pearson Education Ltd.

5. Capitec Bank Holding, 2013. Integrated report

6. Casualty Actuarial Society. Overview of Enterprise Risk Management. May

2003.

7. Chartered Institute of Management Accountants, 2011. Integrating Risk and

performance in Management Reporting. Volume 7, Issue 5.

8. Cheng, M., Green, W., Conradie, P., Konishi, N. and Romi, A. 2014. The

international integrated reporting framework: key issues and future research

opportunities. Volume 25, Issue 1.

9. Committee of Sponsoring Organizations (COSO). Enterprise Risk

Management—Integrated Framework: Executive Summary. COSO, New

York, 2004.

10. Cumming, C.M., and Hirtle, B.J. 2001. The Challenges of Risk Management

in Diversified Financial Companies.

11. Duckert, G.H. 2011. Practical Enterprise Risk Management: A Business

Process Approach. John Wiley & Sons, Inc., Hoboken, New Jersey.

12. Ernest and Young Global Limited, 2014. Integrated Reporting; Creating Value.

13. Hatch 2013. Integrated Risk and Value Management for Decision Making on

Projects.

14. Hillson, D. 2006. Integrated Risk Management as a Framework for

Organizational Success.

15. Institute of Director Southern Africa, 2009. King Report on Governance for

South Africa

16. International Integrated Reporting Council, 2013. International Integrated

Reporting Framework.

15

17. International Integrated Reporting Council, 2014. Creating Value; Value to the

Board.

18. International Organization of Securities Commissions (IOSCO), 1997.

Financial Risk Management in Emerging Markets Final Report.

19. Jensen, M.C. 2001. Value Maximization, Stakeholder Theory, and the

Corporate Objective Function.

20. Manab, N.A, Kassim, I., and Hussin, M.R. 2010. Enterprise-Wide Risk

Management (EWRM) Practices: Between Corporate Governance

Compliance and Value Creation.

21. Monika Wieczorek-Kosmala 2011. Beyond Standardization: Remarks on the

recent approaches to the integrated risk management implementation.

22. Mpact 2015. Risk Management Review.

23. PWC, 2015. Integrated Reporting; Where to Next.

24. Ranesh, A., Zillante, G., and Chileshe, N. 2012. Towards the Integration of

Risk and Value Management.

25. Ranong, P., and Phuenngam, W. 2009. Critical success factors for effective

risk management procedures in financial industries.

26. Schroeck, G. 2002. Risk Management and Value Creation in Financial

Institutions. John Wiley & Sons, Inc., Hoboken, New Jersey.

27. Social Responsibility Journal Vol. 9 Issue 1 2013: Risk disclosure during the

global financial crisis.

28. Society of Actuaries, 2005. Risk Management; Developing Effective Risk

Management Strategies to Protect your Organization.

29. Stiller, D., Joehnk, P. 2014. Risk Management in Companies: A Questionnaire

as an Instrument for Analysing the Present Situation

30. Stubbs, W., Higgins, C. 2014. Integrated Reporting and Internal Mechanisms

of Change.

31. Young, J. 2012. International Conference; Improving Financial Institutions:

The proper balance between regulation and governance.

32. www.kpmg.co.za: Integrated reporting; Understanding the requirements.