Understanding Combined Assurance for Better Risk Management

Standard Bank Group Combined Assurance

What is Combined Assurance? COMBINED ASSURANCE COMBINED ASSURANCE presents to the Audit Committee a map of: Key risks/processes Key risks/processes across the Group, The assurance providers assurance providers The extent extent, and effectiveness provided by the assurance providers assurance providers against the key risks/processes key risks/processes effectiveness, of assurance 2

What is Integrated Assurance? INTEGRATED ASSURANCE takes the outcomes outcomes of the CAM and consolidates these to provide a holistic overall opinion holistic overall opinion of the Group, and its operations, in its entirety IA Adviser April/May 2017, p 28 Our journey starts by achieving Combined Assurance with The achievement of Integrated Assurance as a next logical step 3

Why are we doing this? Common Language Enhanced Assurance & Accountability Assurance over "new" things Combined Assurance Efficiency Gains & Cost savings High assurance standard benchmark Reduced Audit Fatigue Combined Assurance: One Language, One Voice, One View (Sam CJ Huibers) 4

The journey to Integrated Assurance Integrated Assurance Combined Assurance Assurance on Intergrated Reporting Assurance Planning 5 IA Adviser April/May 2017, p 28

What does good look like? Risk Management Framework Establish a mature risk management framework Awareness Create awareness across the Group as to Combined Assurance COMBINED ASSURANCE 6 KEY COMPONENTS Champions Identify appropriate Combined Assurance champions FOR Assurance Strategy Develop a strategy of who provides what assurance Mapping Map assurance providers to their activities Reporting Report Combined Assurance findings Implementing combined assurance: insights from multiple case studies, Lo c Decaux and Gerrit Sarens, January 2015 6

The desired operating model A COMBINED ASSURANCE OPERATING MODEL THAT harnesses the three lines of defence, and through a common language and understanding of risk, control and assurance, provides management, the board and its committees, with appropriate assurance that, an effective control environment, supports internal decision-making and external reporting 7

The project roadmap Integrated Assurance Combined Assurance IT solution implemented Stakeholder discussions Identification of pockets of good across the Group Develop the Combined Assurance operating model operating model fully Deliverable embedded into Group Business As Usual processes Project business case Research into Phase II Stakeholder discussions Map assurance activities at Group and Business Unit (PBB, CIB, Wealth, Corporate Functions) levels (Integrated Assurance) Establish working group Scope finalisation IT solution considered Map and agree Top Risks for the Group Initial views of relative levels of assurance (confidence levels) Common language and definitions developed and Combined Assurance Forums designed and deployed agreed (including taxonomies) 2017 2018 2019 Beyond 8

The wider team so far Group Combined Assurance Team GIA Lead Group Group Group Enterprise Risk Group Credit Risk Review Group Models Validation Operational Risk Compliance Internal Audit Francis Karuhanga Avasha Authar Shabnam Singh Vinesh Viranna David Chaplin 9

Questions