Risk management framework 
 

 Risk management framework 

Introduction

Efic’s Risk Management Framework sets out core principles and the types of risk that Efic faces and forms the basis of the Risk Appetite Statement and the Risk Control Matrix. The Framework is a high level public document and is disclosed in the Annual Report and on Efic’s website.

The Risk Appetite Statement (RAS) describes in detail the manner in which Efic's risk appetite and tolerance (qualitative and quantitative limits) are established and subsequently controlled. Risk appetite is a fundamental part of both risk management and capital management. Efic’s approach to risk management and capital management is based around assessing the level of, and appetite for risk, and ensuring that the level and quality of capital is appropriate to that risk profile.

The Risk Control Matrix (RCM) sets out each of the individual risks that the business faces as well as the mitigants in place and the people responsible for managing the risks. It also includes management’s ratings regarding the likelihood and consequences of each risk. By assigning practical responsibilities to individuals and management, the RCM engenders a culture of risk awareness. Risks are classified depending on their nature: strategic, reputation, credit/country, market and operational/financial. 

RISK MANAGEMENT FRAMEWORK

Core principles

Efic's risk management is built on a foundation that includes:

  • awareness and commitment to a single purpose, common principles, shared values and a Code of Conduct that are reviewed and renewed periodically;
  • a suite of policies and procedures which are supplemented by supportive systems;
  • human resources practices intended to recruit, develop and retain employees with the required specialist skills;
  • delegation of responsibility throughout Efic and accountability for outcomes;
  • control processes including structured management reporting, a system of independent review and Board oversight; and
  • an operational philosophy that seeks to anticipate and mitigate risks before they occur and that reflects on the lessons learned when problems arise.

Roles and responsibilities

The Board is ultimately responsible for setting Efic’s risk appetite and tolerances. The Audit Committee of the Board is responsible for overseeing all aspects of risk management and internal control including compliance activity, the audit program, the appropriateness of financial reporting and performance reporting and the adequacy of accounting policies and procedures.

The Efic Executive and the senior management team are responsible at the management level for implementing the Board-approved risk management strategy and developing policies, processes, procedures and controls for identifying and managing risks in all areas of activity.

The Credit Committee, chaired by Efic's Chief Credit Officer, examines credit policy and practices in relation to all exposures and potential transactions. The Risk and Compliance Committee, chaired by the Compliance Counsel, examines, monitors and regulates compliance risks. The Treasury Risk Review Committee, chaired by the Head of Treasury, examines treasury activities, limits, noteworthy transactions and current issues.

An independent internal audit service provider is engaged by the Board to review risk management and internal controls.  The internal audit service provider, currently Deloitte, reports to each of the Board via the Audit Committee and the Executive, and has full access to staff and information when conducting its reviews.

The Australian National Audit Office (ANAO) and their appointed agent Ernst & Young review independently Efic’s financial statements semi-annually.

The Chief Financial Officer is responsible for the management of this Risk Management Framework including its periodic review and renewal.

Types of risk

Efic maintains a comprehensive list of risks that it must manage across the business.  This list results from internal consultation within the management team and is reviewed periodically.  Risks fall into the following categories:

  • Strategic risk – the risk to income, expenses and capital or to product offerings as a result of ineffective corporate planning, specific government policy, trade policy, dividend policy or other legislative implications, or poor decision-making or implementation of those decisions.
  • Reputational risk – the risk of deterioration in the reputation of Efic arising from adverse publicity.
  • Credit and Country risk – the risk that counterparties will default on obligations resulting in a financial loss.
  • Market risk – the risk of any fluctuation in the value of a portfolio resulting from adverse changes in market prices and market parameters including interest rates and exchange rates.
  • Operational and Financial risk – the risk of loss resulting from inadequate or failed internal operational or financial processes and systems as well as the actions of people or from external events.  Efic has grouped operational risks into a number of sub-categories, namely: general processes; external regulation; internal policies; domestic and international laws; and events.

Summary of Risks

Strategic risk 

The framework within which strategic risk is managed at Efic is as follows:

  • A Board approved Strategic Plan.  The Strategic Plan provides an in-depth view of Efic’s purpose and principles, evaluation of Efic’s operating environment, significant business and operational risks and issues, SWOT analysis, strategic objectives, key initiatives and performance evaluation and benchmarking.  The Strategic Plan is for internal use and approved by the Board annually.
  • A Board approved Corporate Plan.  The Corporate Plan is summary of the key business strategies and objectives identified from the Strategic Planning cycle with a particular focus on key performance indicators and financial projections over a four year period for both the Commercial Account and National Interest Account. The Corporate Plan is a public document and once approved by the Board, is sent to the Minister annually.
  • Credit and market risk appetite are agreed by the Board at least annually after a review of the business environment and consideration of key risks
  • The Board reviews strategies and performance in key functional areas on a periodic basis
  • Regular dialogue with Government at Board and Senior Management level to address government policy, trade policy, dividend policy or other legislative implications
  • Management reports financial outcomes monthly and Efic’s position against high-level key performance indicators quarterly
  •  Independent internal auditing and reporting to Management and the Board.
  •  Independently audited financial reports are prepared semi-annually.

Reputational risk

The framework within which reputational risk is managed at Efic is as follows:

  • A Corporate Responsibility Policy which outlines engagement with key stakeholders and includes a Policy and Procedure for Environmental and Social Review of Transactions.
  • OECD mandated commitments on Export Credits such as the Arrangement on Officially Supported Export Credits; the Action Statement on Bribery and Officially Supported Export Credits; and the Common Approaches on Export Credits and the Environment.
  • The Efic Act and the Code of Conduct under which employees are required, for example, to respect the confidentiality of information concerning Efic and its clients.
  • The PGPA Act, which is a principles-based framework with rules and guidance, helps establish a coherant approach to the use and management of public resources.
  • Detailed policies and procedures are reviewed by the Risk and Compliance Committee and submitted for approval to the Board including AML/CTF and Fraud.
  • Mandatory annual compliance training undertaken by all staff.
  • Independent internal auditing and reporting to Management and the Board.

Credit and country risk

The framework within which credit and country risk is managed at Efic is as follows:

  • A Board-approved Credit Policy sets out the framework for the management of credit risk within Efic.
    The Credit Committee reviews large or complex exposures and potential transactions, and provides advice on matters of policy.
  • A delegation framework ensures larger exposures are reviewed by Senior Management, the Board and Government representatives (as appropriate).
  • Given the higher risk nature of the portfolio, intensive client account management is performed throughout the life of an exposure.  Systems have been developed to support client account management.
  • Management reporting to the Board includes:
    a credit report (quarterly)
    country commentary (at each meeting) and a comprehensive review of all countries (annually)
    exceptional cases (reported as they arise).
  • Independent internal auditing and reporting to Management and the Board.

Market risk

The framework within which market risk is managed at Efic is as follows:

  • A Treasury Policy and the Credit Policy set out the framework for the management of market risk within Efic.
  • The Board and Government provide parameters within which activity can take place.
  • Management’s Treasury Risk Review Committee meets periodically to review factors affecting the portfolio, discuss upcoming transactions and related issues.
  • A delegation framework ensures involvement of the senior Management and the Board in significant market risk management decisions.
  • Systems support treasury operations within the parameters set by the Board, the Government and the delegation structure.
  • Management reporting includes Treasury reports provided quarterly to the Board Audit Committee and regularly to the Board including the reporting of exceptional matters as they arise.
  • Independent internal auditing and reporting to Management and the Board.

Operational and Financial risk

The framework within which operational and financial risk is managed at Efic is as follows:

  • The full range of operational and financial risks that Efic must manage has been identified and is updated annually in the context of the Corporation’s corporate planning. The entire senior Management team is involved in the update.
  • Specific policies and procedures and other control responses are in place to deal with each identified risk.
  • Fortnightly Executive and regular Management meetings facilitate ongoing oversight of key risks.
  • Employees are required to report compliance breaches to their immediate manager, or alternatively to any member of the senior Management team, as they arise. Semi-annually each member of the senior Management team makes a compliance declaration for actions within their area of responsibility and each member of the Executive makes a compliance declaration to the Board Audit Committee.
  • Semi-annual written representation letters in relation to the financial accounts are signed by the Managing Director and Chief Financial Officer and tabled at the Audit Committee and Board.
  • External auditing by the ANAO or their representatives and independent internal auditing and reporting to Management and the Board.

Review

The Risk Management Framework is reviewed and renewed annually.