Risk management

introduction

The employment of an effective risk management process is critical to Hulamin achieving its strategic and operational goals, particularly in the current environment of change and uncertainty. Hulamin recognises that risk is intrinsic to the business and that there is a balance to be struck between managing risk and exploiting opportunities. The group’s response to identified risks includes acceptance, avoidance, transfer and mitigation, as informed by the group’s risk appetite and tolerance levels as shown in the diagram.

Click or tap for a larger version of this image

Risk management framework

Hulamin’s risk management framework provides the basis for the implementation of a consistent, efficient and economical approach to identify, evaluate and respond to key risks that may impact Hulamin’s objectives.
The framework also addresses the specific responsibilities and accountabilities for the Enterprise Risk Management (ERM) process and the reporting of risks and incidents at various levels within Hulamin. Hulamin’s risk management and governance structures, are aligned to its strategic and business objectives.

Click or tap for a larger version of this image

The framework, ISO 31000, which has been adopted by the group and assists Hulamin with:

• the aligning of its risk appetite and strategy;
• pursuing business objectives through transparent identification and management of acceptable risk;
• prioritising risks to ensure that resources and capital are focused on high-priority risks faced by the group;
• enhancing risk response decisions;
• reducing operational surprises and losses;
• identifying and managing multiple and cross-enterprise risks;
• seizing opportunities and developing strategic options;
• improving allocation and deployment of capital;
• ensuring compliance with laws and regulations; and
• increasing the probability of achieving objectives.

Risk management governance review

The board of Hulamin is ultimately responsible for the governance of risk of the group and assumes overall ownership thereof.

The board carries out its responsibilities for risk management via the Risk and the Strategy Committee which has oversight of the group’s enterprise risk management framework, policy and processes.

There is also a Hulamin Risk Management Committee, a sub- committee of the Hulamin Executive Committee, accountable to the Risk and Strategy Board Committee for designing, implementing and monitoring the process of risk management and integrating risk management into the day-to-day activities of the various departments.

The Hulamin Executive Committee, supported by management, supports Hulamin’s risk management philosophy; promotes compliance with Hulamin’s risk appetite; identifies, assesses and manages risks within their spheres of responsibility consistent with risk appetite and tolerances; and manages the implementation of risk reduction actions and appropriate internal controls.

A number of external stakeholders often provide information useful in effecting enterprise risk management, but they are not responsible for the effectiveness of Hulamin’s enterprise risk management.

Various external and internal parties provide risk assurance and compliance. The Hulamin Risk Management committee coordinates cross functional scenario teams (internal and external expert sources) to institutionalise the monitoring of scenario flags and appropriate strategic and tactical responses.

Principle Risk

The Risk Management Committee conducts a formal review of the most significant risks and the group’s responses to these risks three times a year.

The key strategic risks of the group, extracted from the group risk register, are shown in the table on pages 44 to 47. These risks have been assessed according to materiality and likelihood on an inherent and residual risk basis.

Internal control and assurance

The Hulamin board is responsible for establishing and maintaining an effective system of internal control which is designed to provide reasonable assurance that the group’s business objectives will be achieved in accordance with the group’s risk appetite.

A key element of the system of internal control is the review by assurance providers who assess the adequacy and effectiveness of the controls.

The group’s internal audit function is responsible, inter alia, for the following:

Effectiveness of internal controls and risk management

Internal audit provides a written statement annually to the board on the effectiveness of the systems of internal control and risk management.

Specialist assurance providers are used to assess the adequacy and effectiveness of controls in certain instances. These include environmental and safety audits. The output of the risk management process, in conjunction with the work of the independent assurance providers, indicates to the directors that the controls in place are adequate and effective. This assurance recognises that the organisation is dynamic and that at any point in time there are new areas of risk exposure which may require management attention. As such, there is a continual focus on ensuring that the control environment is understood and maintained at the required level.

Assurance efforts are documented in the combined assurance plan.

2018 Risk Focus Summary 

Reflecting on 2018	Status	Comment
Focus in risk culture and embedding risk	Ongoing	Multi-year workpkan
Risk review session	Completed
Risk appetite review	Completed	Clarify and explained
Operational risk framework	Completed
Strategic risk framework and risk scenario planning	In progress	Methodology agreed, implementation underway
Developed risk procedure and processes	Ongoing	Achieved ISO 9001 and new IATF certification which included process risk management.
15,5 and 2 year scenarios	Ongoing	Multi-year work plan
Embedding business continuity management	Ongoing	Multi-year work plan

 

2019 Focus 

Risk culture and embedding risk
15 year scenario linked to strategic options
Advancing risk controls and KPI via process optimisation
Focus on operational risk mitigation and controls linked to KPIs

Scenario Planning methodology integrates with Strategic Risk Management, Strategy and Business planning

Click or tap for a larger version of this image

Scenario planning is therefore embedded in the Risk management process and aligns risk management, business planning, budgeting and strategy development and execution for Hulamin. (Refer here for our external environmental assessment.)

The key risks in Hulamin’s risk register are summarised into the table below with appropriate responses. 

Enablers
E1	Transformation
E2	Talent management
E3	Sustainability
E4	Supportive regulatory environment
E5	Enterprise performance management

 

	Drive cash-flow to earn the right to invest
	Build capabilities
	Implement the strategic business model

	Drive cash-flow to earn the right to invest
	Build capabilities
	Implement the strategic business model

The following key enablers and capability build projects were identified as key risk mitigating requirements for Hulamin in any of the future scenarios.

Cluster A: refer link to “Our strategic response”, Pillar 2, “Building capabilities” , set out here.
Cluster B: refer link to “Unpacking the strategy”, set out here.

Hulamin also identified a number of strategic options, most of which are already under evaluation and development as part of our longer term strategy, that will make Hulamin more robust under the different scenarios.

The rationale for these strategic options are described below.

Cluster C: refer link to “Our strategic response”, Pillar 3, “Implement strategic business model changes” set out here.