OUR CONTEXT
OUR BUSINESS
Risk and Opportunity Management
Enhancing Value Creation Through Integrated Risk Management
In 2024, SAICA continued to prioritise integrating Enterprise Risk Management (ERM) with its strategic objectives, recognising that effective risk management is essential to creating and preserving value. The focus of our ERM approach remains firmly on supporting SAICA’s constitutional mandate and driving organisational performance while managing the evolving risk landscape.
Through continuous engagement, training, and communication, we ensure that risk management practices are embedded within the organisational culture and business activities. This integration strengthens SAICA's ability to proactively respond to both current and emerging risks, ultimately enhancing decision-making and supporting sustainable value creation.
Key Focus Areas in 2024
The revised SAICA strategy for 2024-2028 has informed a comprehensive risk review, ensuring that our top risks align with strategic priorities and support the achievement of our key objectives. The overall level of risk maturity has been assessed at a foundational level (Level 3), that is, Enterprise Risk Management (ERM) clearly outlines the risk management processes. There is room for improvement in the process, and as such, SAICA recognises the opportunity to advance proactive risk management which will underpin future aspirations including the development of the insights-driven organisation (IDO).
Having considered the challenges experienced by SAICA in 2024, SAICA was not satisfied with the status of implementation of the approved Enterprise Risk Management (ERM) Policy and Framework, which aims to effectively drive the risk management culture and improve the control environment.
Key areas of focus included the following:
Risk appetite and tolerance framework
This framework was reviewed, updated and approved by the SAICA Board. The review ensured alignment with the new strategy, adjusting risk thresholds to reflect evolving business needs and the changing risk environment
Support for the Ushintsho programme and digitisation strategy
The Risk and Assurance division actively supported these strategic initiatives, ensuring risks were identified and mitigated through collaboration with project management teams. A detailed project management review was conducted to understand the root causes of project performance
Internal Audit and combined assurance
We made good progress with the 2024 Internal Audit Plan and implemented the Combined Assurance Framework to ensure a cohesive, coordinated approach to risk management, control, and governance
Business continuity management (BCM)
The BCM Committee continued to oversee SAICA’s continuity efforts, including regular testing and updates to our plans, ensuring that the organisation is prepared for unforeseen events
Risk Governance
Risk management is an integral part of SAICA’s governance structures, woven into everyday discussions from performance reviews to Board meetings. Significant risks are evaluated and addressed at each Audit and Risk Committee (ARC) meeting and reported to the Board. The internal audit function and other assurance providers offer independent assessments to enhance our control environment and help achieve our objectives.
Our Governance Structure
Board of Directors
The SAICA Board sets the tone for risk management and assumes ultimate accountability, but delegates oversight of risk management to the ARC and the day-to-day risk management activities to management. They ensure that assurance services and functions enable an effective control environment and support the integrity of information for internal decision-making and of the organisation’s external reports
Executive Management
Management is charged with the responsibility for taking appropriate risks within the risk appetite framework approved by the Board to create value. The Board receives quarterly reports on the status of existing as well as emerging risks and opportunities
Enterprise-wide Risk Management Function
Establishes the policies and procedures for managing risk, as well as promoting a culture of risk awareness and control. The SAICA ERM policy and frameworks adopted by the Board govern ERM in the organisation and clearly define the roles and responsibilities of the Board, Board sub-committees, and various lines of assurance providers, promoting a sound risk culture. Risk is integrated with performance management and aligned to strategic objectives and performance goals
Risk Owners
Risk owners are the staff who are directly accountable for ensuring that risks are managed effectively by implementing actions required to treat the risks
Internal Audit
Internal audit and other appointed assurance providers are contracted to provide independent assurance to assist management and the Board in ensuring that the control environment improves, and objectives are achieved
External Audit
External auditors provide an additional line of defence. Their role is to provide reasonable independent assurance on the integrity of financial statements, as well as the effectiveness of internal controls in mitigating risks
