The risk maturity of South African private and public sector organisations

Abstract

Risk management is a fairly new concept for organisations world-wide, both in the private and the public sectors. With the evolution of corporate governance in general and specifically risk management, formalised risk management frameworks have been recognised by many as an effective tool in assisting management with their responsibilities. In South Africa, this is supported by the fact that risk management is included in the leading corporate governance codes and in legislation, such as the Public Finance Management Act, No 1 of 1999 and the King Report on Governance, 2009. However, the question remains as to how comprehensive an organisation’s risk management strategy should be. This article explores the concept of assessing risk maturity by using a risk maturity scorecard. After an existing risk maturity model was adjusted for the South African corporate governance environment, a scorecard was developed that was used to determine the risk maturity level of certain organisations within the South African private and public sectors. Results indicate that organisations within the private sector are mostly risk mature, while public sector organisations are lacking many elements within their risk management frameworks and no risk mature respondent could be found in this sector. Secondly, the article indicates that management’s commitment to risk management could be the one main concern that should be addressed to ensure an effective risk management strategy.