Risk maturity assessment: what the result should tell the board

A risk maturity assessment is an evaluation of how developed and entrenched an organisation's risk-management processes and control environment are.

For a board, its real value is telling you how far you can rely on your controls — and where you cannot.

Understanding risk maturity and the control environment

Risk management and internal control should work as one integrated framework, not a series of isolated compliance checks. Under the Companies Act 71 of 2008, the board carries the ultimate governance responsibility for directing the company's affairs, setting financial record-keeping standards and overseeing corporate integrity. In the public sector, the PFMA, as administered by National Treasury, places explicit fiduciary duties on accounting officers and accounting authorities to maintain an effective, efficient and transparent system of financial management, risk management and internal control.

The National Treasury Internal Audit Framework recognises risk maturity directly when it ties the choice of internal audit approach to the maturity of an organisation's systems and processes — specifically, how far policies, procedures and internal controls are entrenched and complied with, and the general strength of the wider control environment. An organisation with well-established controls, clear workflows and an ethical tone at the top sits at a higher level of maturity than one where controls are informal, inconsistent or routinely bypassed.

Evaluating maturity against statutory expectations

A credible maturity assessment measures the organisation against established statutory and governance benchmarks. Under the National Treasury Internal Audit Framework, the internal audit activity must examine, evaluate and report on the adequacy and effectiveness of risk management, control and governance — and, to form an overall opinion on the adequacy of risk management, it must satisfy itself that the process addresses the recognised key objectives: that risks from strategy and activities are identified and prioritised, that management determines the acceptable level of risk, that mitigation is designed and implemented to bring risk to that level, that management receives periodic reports on the process, and that risk and control effectiveness are reassessed on an ongoing basis. That internal view is measured against Treasury Regulation 27.2.1, which requires regular risk assessments and a documented risk-management strategy with a fraud-prevention plan, and against the Auditor-General South Africa (AGSA) governance expectation that risks are periodically identified, assessed and effectively mitigated.

What the result should tell the board

A maturity result gives the board, audit committee and accounting authority three things. First, it says how much reliance can be placed on existing controls to deliver strategic and operational goals. Second, it exposes the specific vulnerabilities, unmitigated exposures and root causes — a policy gap, an absent supervisory review, an unmanaged IT risk — that threaten financial and service-delivery reporting.

Third, it sets the balance of assurance effort: as the National Treasury Internal Audit Framework explains, a weaker, less mature environment pushes internal audit toward concentrated risk-based audits that verify the key controls are in place and adhered to, while a stronger, more mature environment lets internal audit shift capacity toward cyclical maintenance auditing that keeps a sound control environment healthy over time.

Leadership should strengthen the documented risk-management strategy and fraud-prevention plan the Treasury Regulations require, using updated risk assessments to work out the skills managers and staff need to manage the exposures.

— Synthesis of South African regulatory guidance

From result to corrective action

A low maturity result is a call to act. The board and accounting authority should use it to entrench formal policies and procedures across every level, so that standard control practices become routine habit rather than occasional effort. Leadership should strengthen the documented risk-management strategy and fraud-prevention plan the Treasury Regulations require, using updated risk assessments to work out the skills managers and staff need to manage the exposures.

Accounting officers and audit committees must make sure the internal audit activity is adequately resourced and competently staffed, so Risk maturity assessment: what the result should tell the board can execute its risk-based plan without capacity constraints. And leadership must approve and actively monitor formal action plans that resolve the control deficiencies and their root causes, turning audit insight into permanent improvement.

Governance habits that lift maturity over time

Maturity rises through disciplined habits. Under Treasury Regulation 27.2.1, management must run regular risk assessments to catch the risks thrown up by changing priorities or external events, and the risk environment should be reassessed at least annually. The audit committee, under Treasury Regulation 27.1 and the National Treasury Internal Audit Framework, reviews the effectiveness of internal control and internal audit and the risk areas covered across internal and external audit scopes.

Leadership sets the ethical tone, enforces human-resource discipline, and communicates the risk-management strategy to all employees so a risk-aware culture takes hold. By working through AGSA management reports, tracking internal audit follow-ups and holding line managers to their corrective actions, leadership moves the organisation steadily up the maturity curve.

What good looks like

Good is a governance framework where risk maturity is continuously evaluated, actively lifted and built into strategic decisions. The board under the Companies Act 71 of 2008, or the accounting authority under the PFMA, keeps a robust system of risk management and internal control; leadership enforces an ethical control environment, approves an IT-governance framework and communicates the risk strategy across every level. An adequately resourced internal audit activity periodically judges the adequacy of risk management and gives the audit committee an objective opinion; risk assessments shape audit priorities so the mix of risk-based and cyclical work fits the organisation's maturity; and the findings in AGSA management reports and internal audit reviews drive monitored action plans that resolve root causes — securing transparent financial management, reliable performance and a sustained clean audit.

Related insights

• External audit and assurance: a guide for boards of complex organisations
• Enterprise risk management: connecting strategic objectives and operational decisions
• Internal controls: connecting design, ownership and reliable operations