Introduction
EFIC has successfully delivered finance and insurance services to Australian companies for over 50 years. In so doing, it has developed a strong risk management culture. The development of this Risk Management Framework underlines EFIC's commitment to improve continuously its risk management practices, with particular emphasis on planning to identify new risks.
This Framework describes the manner in which EFIC's risk appetite and tolerance is established and subsequently controlled. The Framework sets out core principles, outlines responsibilities, categorises the risks that EFIC faces and identifies the strategies it has adopted to manage those risks.
Core principles
EFIC's risk management is built on a foundation that includes:
- awareness and commitment to a single mission, common objectives, shared values and a Code of Conduct that are reviewed and renewed periodically
- a suite of policies and procedures which are supplemented by supportive systems
- human resources practices intended to recruit, train and retain employees with the required specialist skills
- delegation of responsibility throughout EFIC and accountability for outcomes
- control processes including structured management reporting, a system of independent review and Board oversight
- an operational philosophy that seeks to anticipate and mitigate risks before they occur and that reflects on the lessons learned when problems arise.
Roles and responsibilities
The Board is ultimately responsible for setting EFIC's risk appetite and tolerances. The Board’s Audit Committee is responsible for overseeing all aspects of risk management and internal control including compliance activity, the audit program, the appropriateness of accounting policies and the adequacy of financial reporting.
The EFIC Executive and the senior management team are responsible at the management level for implementing the Board-approved risk management strategy and developing policies, processes, procedures and controls for identifying and managing risks in all areas of activity.
The Credit Committee, chaired by EFIC's Chief Credit Officer, examines credit policy and practices in relation to all exposures and potential transactions.
The Treasury Risk Review Committee, chaired by the Head of Treasury, examines treasury activities, limits, noteworthy transactions and current issues.
An independent internal audit service provider is engaged by the Board to review risk management and internal controls. The internal audit service provider, currently Deloitte, reports to each of the Board and the Executive, and has full access to staff and information when conducting its reviews. The Australian National Audit Office and their appointed agent Ernst & Young perform an independent review of EFIC’s financial statements.
The Chief Financial Officer is responsible for the management of this Risk Management Framework, including its periodic review and renewal.
Risk appetite
The Board considers that risk appetite goes to the heart of how EFIC does business and is important in giving a clear indication to key stakeholders (such as the Government, employees, regulators and customers) of how EFIC operates from a risk-taking perspective and the type of risk culture that EFIC promotes.
To ensure effective monitoring and governance, EFIC’s risk appetite has a balanced mix of quantitative and qualitative measures. These are monitored within well-established risk policies, risk tolerances and operational limits set by the Board, the CAC Act and the EFIC Act and regulations.
Risk appetite is set within a range from “risk intolerant” to “risk tolerant”. EFIC willingly accepts risks that are aligned with its risk culture.
Types of risk
EFIC maintains a comprehensive list of risks that it must manage across the business. This list results from internal consultation within the management team and is reviewed periodically. Risks fall into the following categories:
- strategic risk – the risk to revenues, earnings and product offerings as a result of poor decision-making or implementation of those decisions
- reputational risk – the risk of deterioration in EFIC's reputation due to adverse publicity
- credit risk – the risk that a counterparty will default on obligations resulting in a financial loss.
- market risk – the risk of any fluctuation in the value of a portfolio resulting from adverse changes in market prices and market parameters
- operational risk – the risk of loss resulting from inadequate or failed internal processes and systems as well as the actions of people or from external events. EFIC groups operational risks into the sub-categories of general processes, external regulation, internal policies, domestic and international laws, and events.
Risk management
Strategic risk
The framework within which strategic risk is managed at EFIC is as follows:
- a Board- and Government-approved Corporate Plan. A key element of corporate planning is the identification of potential new risks that may emerge over the planning cycle
- business strategies as well as credit and market risk appetite are agreed by the Board at least annually after a review of the business environment and consideration of key risks
- the Board reviews strategies and performance in key functional areas on a periodic basis
- management reports financial outcomes monthly and EFIC's position against high-level key performance indicators quarterly
- independent internal auditing and reporting to management and the Board
- audited financial reports are prepared semi-annually.
Reputational risk
The framework within which reputational risk is managed at EFIC is as follows:
- a Corporate Responsibility Policy which outlines engagement with key stakeholders and includes an Environment Policy
- OECD-mandated commitments on export credits such as the Arrangement on Officially Supported Export Credits, the Action Statement on Bribery and Officially Supported Export Credits and the Common Approaches on Export Credits and the Environment
- the EFIC Act and the Code of Conduct, which requires, for example, that employees respect the confidentiality of information concerning EFIC and its clients.
Credit/country risk
The framework within which credit risk is managed at EFIC is as follows:
- a Board-approved Credit Policy sets out the framework for the management of credit risk within EFIC
- the Credit Committee reviews large or complex exposures and potential transactions and provides advice on matters of policy
- a delegation framework ensures larger exposures are reviewed by senior management, the Board and Government representatives (as appropriate)
- given the higher risk nature of the portfolio, intensive account management is performed throughout the life of an exposure. Systems have been developed to support account management.
- management reporting to the Board includes:
- a credit report (quarterly)
- country commentary (monthly) and a comprehensive review of all countries (semi-annually)
- exceptional cases (reported as they arise).
- independent internal auditing and reporting to Management and the Board.
Market risk
The framework within which market risk is managed at EFIC is as follows:
- a Treasury Policy and the Credit Policy set out the framework for the management of market risk within EFIC
- the Board and Government provide parameters within which activity can take place
- management’s Treasury Risk Review Committee meets periodically to review factors affecting the portfolio, discuss upcoming transactions and related issues
- a delegation framework ensures involvement of senior management and the Board in significant market risk management decisions
- systems support Treasury operations within the parameters set by the Board, the Government and the delegation structure
- management reporting includes Treasury reports provided quarterly to the Board Audit Committee and the Board and the reporting of exceptional matters as they arise
- independent internal auditing and reporting to Management and the Board.
Operational risk
The framework within which operational risk is managed at EFIC is as follows:
- the full range of operational risks that EFIC must manage has been identified and is updated annually in the context of EFIC's corporate planning. The entire senior management team is involved in the update
- specific policies and procedures and other control responses are in place to deal with each identified risk
- weekly management and Executive meetings facilitate ongoing oversight of key risks.
- employees are required to report compliance breaches to their immediate manager, or alternatively to any member of the senior management team, as they arise. Twice a year, each member of the senior management team makes a compliance declaration for actions within their area of responsibility and each member of the Executive makes a compliance declaration to the Board Audit Committee.
- independent internal auditing and reporting to management and the Board.
Review
The Risk Management Framework is reviewed and renewed periodically.