The Board is responsible for the governance of risk, including determining the nature and extent of the significant risks which the company is willing to take.

The Board oversees the company’s risk management framework and policies, and ensures that Management maintains a sound system of risk management and internal controls.

The Board may delegate responsibility for risk governance to a board committee, such as the Audit Committee or a separate Board Risk Committee.

The Board, with the assistance of a board committee (where established), should review, at least annually, the adequacy and effectiveness of the company’s risk management and internal control systems and comment on the same in the company’s annual report. Such a review can be carried out internally or with the assistance of any competent third parties.

The Board’s commentary in the company’s annual report should include:

1. information needed by stakeholders to make an informed assessment of the company’s risk management and internal control systems;
2. a description of the principal risks (including financial, operational, compliance and information technology risk categories) facing the company and how they are being managed or mitigated;
3. an explanation of the company’s approach towards identifying, measuring and monitoring its key and emerging risks, and an elaboration of its approach towards the governance and management of these risks; and
4. an explanation of how the Board has assessed the prospects of the company, over what period it has done so, and why the Board considers it to be appropriate to use that period.