Risk Frontiers-Africa 2015

Political risk tops list of concerns for risk managers across Africa Emphasis on risk management is on the increase Liz Booth news@commercialriskafrica.com

P

RISK TO BUSINESS Don’t know—3.5%

OLITICAL RISK TOPS THE LIST

of concerns for risk managers across Africa this year, mirroring the experience of 2014.

According to 91% of risk managers surveyed from 15 countries across Sub Saharan Africa, political risks have been rising for the past year. This compares to three-quarters of those asked in 2014, who found that political risk had increased, while just 25% in 2014 felt there had not been any change in the levels of risk facing companies operating across Africa.

This year, of those who feel there has been no change, two-thirds come from Kenya, while 33% are from Nigeria. Of those who feel risk is increasing, all South African respondents agree that political risk is up in the past 12 months, compared to the previous year.

The risk managers, surveyed by Commercial Risk Africa to form the Risk Frontiers-Africa report, include elements like corruption as well

Decreasing 3.5%

No change 15%

Overall, do you think risks to your business are increasing?

Increasing 78%

SOURCE: Risk Frontiers-Africa Survey 2015

as political instability and the risk of political violence within their definition of political risks..

In 2015, 100% of Nigerians surveyed see an increase in political tensions—perhaps no surprise as the country faced presidential

elections with considerable predictions of unrest increasing, while increases are also recorded to follow. However, not a single South African from the likes of Angola, Botswana (the country risk manager believes there is any decrease in ranked best in Africa in terms of political stability Don't know political risks from last year to this. Overall, by other measures), Congo, DRC and Zambia.

97% of South Africans have seen an increase in SKILLS SHORTAGE CONCERN political risk.

No change In terms of a skills shortage, 70% of risk They say this reflects an increasing lack of Algeria–3% managers record rising concerns about the lack confidence in the government to tackle pressing Lebanon–3% Decreasing Others skilled employees while 13% feel the economic and unemployment issues. Although Egypt–4% of available8% risk is reducing and 17% see no change year on few predict outright violence aimed at the Qatar–4% Increasing year. government, risk managers are concerned that Turkey those figures, risk corruption risks are increasing, thanks to the Morocco Looking deeper at 25% managers are more equally divided. South perception of problems from the top down in Saudi Arabiamirrors the continent-wide figures, with Africa government.

13% issues have risen up the Corruption is a relatively new risk in terms of 70% worried that skillsIran UAEseeing a decrease 18% and 19% seeing daily business life, they say, and it is of increasing agenda, 11% 16% no change. concern to all business managers.

In Kenya, 80% of risk managers are worried, Only risk managers in two countries report Source Swiss Re sigma Jan 2015 with 10% each saying they see an improvement any decrease in political tensions—Mozambique in the skills issue or no change. and Kenya. Even then, the Kenyans who believe The figures for Nigeria and Zimbabwe are political risks are increasing amount to 68%, exactly the same—with 50% worried by the compared to 20% who see no change and 12% skills issue, 25% recording an improvement in who believe the risk is decreasing.

Like the Nigerians, 100% of risk managers SURVEY: Page 2 | DATA CHARTS: Page 3 surveyed from Zimbabwe see political risks

Establishing the role key to success of risk management Liz Booth news@commercialriskafrica.com

R

ISK MANAGEMENT IS ON THE MOVE UP THE AGENDA IN

businesses across Africa. However, there is still concern among risk managers that boards are paying lip service to the discipline and not embedding risk management into their culture.

The next few years could see a fundamental shift in the perceived importance of risk management and its place in organisations, according to those surveyed by Risk Frontiers-Africa. The current position was this year summed up as similar to that of human resources a decade or two ago.

Human resources was often considered a niche back office function when first introduced. However, it has become an increasingly important part of any organisation. Risk management too has been treated as a back office function by some firms and it is only just reaching the boardroom in a meaningful way in many businesses.

Risk managers are concerned that regulators and government are driving the agenda rather than the business itself. Organisations are ticking the boxes but not necessarily embracing the concept.

Nairobi-based Duncan Ikiara-Robert said: “The risk management discipline must rise up through the organisation regardless of the slow reception by the main board in Africa. There is need for recognition and appreciation of the importance of the discipline by the main board (government, stakeholder, CEO) as their support is vital.”

He believes risk managers have a key role to play in this.

“To achieve this,” he said, “the main board should be educated, trained and sometimes pushed to spearhead the embedding of the risk management functions in both profit and non-profit organisations.”

That, he said, would mean “the internal and external incorporation of a winning risk culture will contribute to an agile, resilient and sustainable organisation.”

His views were echoed by Nigerian Adebayo Adebeshin, Risk Manager of MTN Nigeria, who added: “Boards, in my experience, are getting to better grips with the value [of risk management].

Management (especially commercial units) is still struggling with the fluid value from risk management.”

Reginald Hamam, South Africa-based Executive Head: Risk & Assurance, Royal Bafokeng Platinum, believes the next few years will see a massive change, with new qualifications playing a part in getting risk management recognised for the value it delivers to business. Although he said existing chief risk officers might not go back to school, those coming through the ranks will use formal qualifications to evidence their expertise and it will become increasingly important for the future.

This year’s survey has also revealed a maturing of the role, with a variety of risk management roles and responsibilities emerging.

Maria Van Vuvren, a risk manager at SSG Security Solutions in Johannesburg, asked the question: “Are we referring to risk executives or risk managers? They operate at different levels.

“Normally in South Africa the risk managers will not see anyone on the board. They do not have a voice when it comes to

corporate governance because they have a very narrow scope.”

She also feared that business remains in silos, making it hard for the risk manager to interact with all levels of people across an organisation.

However, Terry Booysen, Chief Executive Officer of CGF Research Institute, said the way forward would be to break down silos and force risk management into the boardroom.

The risk managers agreed that the most successful businesses are those where there is an all-pervading culture of risk management—every line manager will be making risk assessments as part of their daily life, evaluating the risk of taking a decision—and equally the risk of doing nothing.

However, they said that was still a “nirvana” for many businesses, where board members still hang on to power and are reluctant to allow risk managers too strong a voice. As part of the growing maturity, they also acknowledge that not every risk manager is destined for board level and that there is a need for a range of risk people, able to deliver at different levels.

One risk manager pointed to large international organisations that centralise risk management at headquarters and then have a number of risk managers operating in different countries at a number of levels, from security and health and safety-type functions up to regional managers, answering to the team at headquarters.

Overall, there is a feeling that risk management is gaining a permanent place in the organisation, with help from the regulators, but there is also realisation that it is still a young sector across Africa and there is a lot more to be done.

SUPPORTED BY

1

CRA-SR-RF-Africa-2015.indd 1

14/5/15 13:40:39

[AFR I CA S U RVE Y | 2 0 1 5] Political risk continues to threaten confidence and stability across Sub Saharan Africa as elections come and go.

The perception of risk is often the biggest challenge, according to risk managers, who say fragile confidence can easily be shattered with significant consequence for their organisation—without anything actually happening

Political risk still greatest fear for African risk managers

P

OLITICAL RISK REMAINS THE TOP CONCERN

for risk managers across the continent—in all its guises, whether that is political violence through to expropriation, resource nationalism or foreign exchange restrictions.

However, the list of top three risks grew somewhat in 2015, reflecting the evolving nature of organisations and some of the emerging risks.

There was also some disparity between the issues keeping the board awake at night as opposed to the issues keeping risk managers awake.

Overall, risk managers admit they face a barrage of challenges, not all of which can be managed easily. Risk transfer is not always available and the question for risk managers is often around creating awareness within the organisation at the right level to the right people.

When answering questions around the role of risk management, Volker Von Widdern, Risk Manager and Managing Director of Marsh Middle East & Africa at Marsh Risk Consulting, talked of risk managers not having a crystal ball but somehow there is an expectation that they have just that.

Ian Clegg, Manager: Integrated Risk Management Services at Anglo American, also talks of the issue of risk managers being expected to prevent all disasters. When something goes wrong, he says, senior management will interrogate the audit function, alongside the risk management, to see if the event could have been foreseen and any preventative action taken.

Woe betide the risk manager, he says, who is not able to respond to that satisfactorily.

However, risk managers all agreed that even if it is not possible to see the next black swan event coming—by their very nature black swan events are rarely foreseeable—there is much that can be considered and at least factored in to business decisions.

Political risk Risks are coming from every angle, both micro and macro. On the macro level, political risks still dominate.

It is no surprise then that the Nigerian risk managers surveyed put political issues at the top of their list, with presidential elections delayed from February to March, fears of a poll too close to call and the violence that might engender.

Adewale Adeniyi, Compliance Officer at Meristem Wealth Management, puts the risk into context. “It is not just about the election itself,” he says, “but it includes a lot of other factors.

Policies change, contracts can be cancelled and other changes happen.”

His words were echoed by Lagos-based cyber risk manager Onwukike Chinedu. “Contracts have often been signed on the basis of who you know but when a regime changes…”

SURVEY: Continued from page 1 the skills issue and 25% saying there has been no change.

COMPLIANCE RISK UP Interestingly, when it comes to concern around compliance issues, South Africa and Zimbabwe stand alone with increased levels of worry.

Overall, 69% of South African risk managers see an increase in compliance risks this year, with 21% saying there has been no change. In Zimbabwe, 75% of the risk managers report an increase in complianceassociated risks.

Elsewhere in Africa, the picture is much less clearcut. For example, in Kenya 64% of risk managers fear there is an increase in risk around compliance but 36% disagree. In Nigeria, only 25% of those surveyed believe the risk around compliance has gone up in the past year.

The 2015 figures compare to two-thirds of respondents in 2014 that were worried by increased regulatory risk, while one-third were not so concerned. In 2014, those who said they were not concerned did agree they faced increased regulation. The difference was that they felt greater regulation would drive up standards and so was not a bad thing. All

Confidence in the economy can be upset. With Nigeria becoming Africa’s largest economy in 2014, there was a feeling of enormous confidence but risk managers and businesses alike had a nervous start to the year as they waited to see what would happen.

As it turned out, the elections were peaceful, thanks in large part to the quick concession of defeat by outgoing president Goodluck Jonathan. Elections will be held in some 16 African countries this year and analysts are quick to warn of impending problems.

Nearby Togo is a good example. After peaceful elections in late April, the losing candidate has come out to say he did not believe the elections had been fair and would be challenging the result. Whatever the final outcome, risk managers say the perception of the risk of political violence is enough to destabilise any similar situation and cause foreign investors to hold off from a commitment. All that has to be factored in to any risk assessment.

Kenyan troubles Political risk concerns are by no means limited to Nigeria. In Kenya, increasing concern around the risks posed by Al Shabaab have made risk managers nervous. While they say foreign investors may not be disappearing as yet, the tourism industry has already been massively impacted.

Putting it in perspective, Konstantin Makarov, Managing Director of the Nairobi-based research firm StratLink-Africa, says: “The Garissa attack, as a standalone incident, is unlikely to pose a significant impact on foreign direct investment (FDI) inflows going by precedents set.”

He bases his answer on the following precedent—between 2012 and 2013, the year of the Westgate Siege, FDI inflows accelerated by 98.9% to $514.4m, which effectively doubled the previous inflows.

Between 2001 and 2002, the year of the Kikambala terror attack at the Kenyan coast when there was a failed attempt to shoot an Israeli airliner and a successful attack on an Israeli-owned hotel in Mombasa where 15 people died, FDI inflows grew near five-fold to $27.7m.

“It is also important to note that both 2002 and 2013 were election years that typically send jitters among investors and decelerate appetite towards the economy,” says Mr Makarov.

“The Garissa incident is also likely to be eclipsed by the ranking of Kenya among the projected top 10 fastest growing economies in 2015 according to Bloomberg and the hosting of the Global Enterprise Summit, which will be attended by US president Barrack Obama in July 2015. Having said that, the incident in Garissa highlights the security challenges facing Kenya, which will have to be addressed by the government to ensure growth continues to accelerate,” he says.

However, any terrorist attack that impacts the tourism

of those questioned agreed that firms face an increasing burden of compliance.

All the risk managers surveyed in 2015 agree they have seen increasing compliance demands. The question, again, is whether those demands become a risk to business. Generally, risk managers in South Africa express concern that, while regulation applies equally to all, they believe many small businesses in particular are simply paying lip service to the regulatory requirements.

The result, they worry, is that some businesses will prove to be in breach of the regulations. They also believe that, ultimately, those that do not embrace the new requirements for a stronger risk management ethos across the organisation will find themselves less profitable, or that they will fail completely.

industry will ultimately impact other sectors too, including insurers and the banking sector, and also risk the economy at large.

But risk managers in Kenya were keen to point out that there is more to politics than terrorism. They say it encompasses every part of business life and much of it is about perception.

Gilbert Mwalili, a risk manager at Protecht, says: “It may change our perception based on how we monitor risk. In business, much of what we do is affected by politics and there is a lot of political instability today. Different organisations will react differently to the same event. In terms of political risk, one organisation may see the risk as of zero concern but others may see it as a big risk.”

South African woes South Africa, too, has some major issues. Although not linked to elections, political uncertainty remains around the leadership and for the first time, the South African risk managers are putting corruption risks into their top three.

Earlier this year, the Institute of Risk Management South Africa launched the first annual Risk Report, in which corruption has topped the list of top 10 risks by likelihood and by consequence.

In a survey of 620 risk managers, the report found corruption has shot up the list of risks in the country in the past couple of years and they are extremely concerned about the impact this may have on the perception of the risk of doing business in the country, particularly for foreign investors.

Nico Snyman, CEO of Crest Advisory Africa, summed up those fears for Commercial Risk Africa. “The problem starts at the top,” he says. Mr Snyman points to the news of the former national police commissioner who was convicted and has now died. “That is setting the standard for the whole country,” he warns.

My Snyman says corruption is destroying trust as well as adding costs to doing business in the country. His greatest fear is that corruption becomes endemic in every level of society and of business life.

Governance failure ranked number two on the list of risks by consequence, linked to the corruption fears and the risk of falling trust in the system and proper oversight of the system.

Terry Booysen, Executive Director, CGF Research Institute, warns: “The Special Investigating Unit estimates 20%-25% of state procurement, representing approximately R180bn, is lost each year due to corruption. Corruption of this magnitude undermines state legitimacy and service delivery; it furthermore distorts market competition, increases the cost of doing business and decreases the ease of conducting business. Understandably, this scourge is a massive and debilitating burden on South Africa’s development.”

one-third were not so worried. Interestingly, in 2014, all of the South Africans questioned were worried by the depreciation of the rand against the US dollar and other major currencies, while 50% of the Kenyans questioned were among the one-third of respondents who were unconcerned.

This year, the countries where risk managers across the board are less concerned include just DRC and Mozambique. Those where everyone is concerned include Angola, Botswana, Congo, Namibia, Swaziland and Zambia.

In both Kenya and South Africa the split is the same—two-thirds of those surveyed (66%) believe the risks around the exchange rate have increased, while one-third (33%) feel the risks have diminished in the past year.

Again, these figures do not necessarily reflect the worsening exchange rate position; rather that, in some cases, the risk managers believe their businesses are either not directly affected or that their businesses have assessed the risk, are factoring it into their business plans and so do not see the problem as an increasing risk.

FOREX RISK When asked whether exchange rate risks have increased in the past 12 months, not a single risk manager feels the risk has remained unchanged. Overall, 71% reveal increasing concerns around exchange rate issues, while 29% believe the risk is diminishing.

This compares to the figures from the 2014 poll, in which two-thirds of those questioned were worried by exchange rate issues while

RISK MANAGEMENT When it comes to risk management more generally, 78% of risk managers across the

continent believe that risk management is increasing across their business, sector or country. Just 3% say risk management is decreasing, while 19% see no change.

In South Africa, where there is a formal risk management association for risk managers, whatever their industry sector, and where formal qualifications are being launched, the split is quite different to elsewhere in the continent.

In South Africa, almost three-quarters of those who responded to the survey (73%) say they believe risk management is increasing, with 20% saying there has been no change, 3% claiming risk management has decreased and 3% saying they do not know.

In Nigeria, Kenya, Zimbabwe, Zambia and all the other countries across Africa— with the exception of Namibia—all the risk managers surveyed agree that risk management is on the rise in their country.

Asked whether overall risks to their business are increasing, 78% of risk managers say they do believe their organisation is seeing increasing challenges.

Just 1% of those who responded report a decrease in the risks businesses face, while 15% see no change from the previous year and 6% do not know.

2

CRA-SR-RF-Africa-2015.indd 2

14/5/15 13:40:39

[AFR I CA S U RVE Y | 2 0 1 5]

Commercial Risk Africa—Risk Frontiers-Africa survey results POLITICAL

Decreasing 3.5%

No change—7%

87

No 20 change

Increasing

Decreasing 15

Do you think political risk is increasing?

Algeria–3% Lebanon–3% Others Egypt–4% 8% Qatar–4%

Increasing

10

5

0

Saudi Arabia 13%

0 Kenya

No change Turkey 25%

Morocco Increasing 89.5%

Decreasing

0

0

UAE 16% South Africa

Nigeria

Iran 18%0

0

Zimbabwe

Source Swiss Re sigma Jan 2015

SKILLS / TALENT

Do you think the skills/talent risk is increasing?

Don’t know—5%

63

Don't know 20

Increasing

No change 15

No change 10.7%

Algeria–3% Lebanon–3% Others Egypt–4% 8% Qatar–4%

Decreasing

Decreasing 12.8%

10 Increasing 5

0

Saudi Arabia 13%

0 Kenya

0

UAE 16% South Africa

Nigeria

No change Turkey 25%

Morocco

Increasing 71.5%

Decreasing

Iran 18% 0

Zimbabwe

Source Swiss Re sigma Jan 2015

COMPLIANCE

Are you worried by increasing compliance demands?

Don’t know—5.1%

Don't know 20

62

Increasing

No change

Decreasing

15

No change 16.9%

Algeria–3% Lebanon–3% Others Egypt–4% 8% Qatar–4%

Decreasing

No change

10 Increasing

Decreasing 11.7%

Turkey 25%

Morocco

Increasing 66.3%

5

0

Saudi Arabia 13%

0 Kenya

0

UAE 16% South Africa

0

0

Nigeria

Iran 18% 0

0

Zimbabwe

Source Swiss Re sigma Jan 2015

EXCHANGE RATE

Are you worried by exchange rate issues?

Don’t know—3.5%

64

Don't know 20

Increasing

Decreasing 15

Decreasing 24.6%

Algeria–3% Lebanon–3% Others Egypt–4% 8% Qatar–4%

Increasing

10

5 Don't know

Saudi Arabia 13%

0

0 change No

Kenya

0

0

UAE 0 16% South Africa

Nigeria

Has your company increased its focus on risk management?

Increasing 22 Don't know 20

Decreasing 3.5%

Zimbabwe

Decreasing

Algeria–3% Lebanon–3% Others Egypt–4% 8% Qatar–4%

No change

10 Increasing

Turkey 25%

Morocco

5

0

0

Increasing

Decreasing

Increasing 78.2%

Iran 18%

66

No change 15

No change 14.8%

No change

Source Swiss Re sigma Jan 2015

Decreasing Don’t know—3.5%

Decreasing

Turkey 25%

Morocco

Increasing 71.9%

RISK MANAGEMENT

22

Saudi Arabia 13%

0

0

Kenya

Nigeria

0

0

UAE 16% South Africa

Iran 18% 0

Zimbabwe

Source Swiss Re sigma Jan 2015

3

CRA-SR-RF-Africa-2015.indd 3

14/5/15 13:40:42

[AFR I CA S U RVE Y | 2 0 1 5] [ COMMENT ]

I

Vive l’evolution management. Those surveyed report a growing awareness of their business risk and increasing maturity in terms of decisions around sharing responsibility for the risks between the organisation and the insurance carriers.

This, in turn, is changing the demands on insurers. Risk managers are calling for a shift between insuring tangible and intangible risks and want to see insurers make that shift with them.

On the subject of the growing maturity of risk management, the continent has its first locally-based professional qualifications, courtesy of the Institute of Risk Management South Africa (Irmsa), which has launched the first of two exams. The first sitting has proved successful and risk managers are excited by the prospect and the way in which this should help create an established career path for young professionals starting out.

Irmsa has also published a major Risk Report, which has taken a look at both the key risks facing players in the domestic market and also the reasons that lie behind those risks. Like our survey, it is to become an annual publication and should prove to be an interesting reflection of changing times.

The risk management community across Africa continues to build and evolve. It will be interesting to see how the year ahead shapes up.

In the meantime, I hope you enjoy reading this report and all that remains is for me to say a massive thank you to all those who completed our short survey as well as to those who have taken part in the various roundtables across the continent—we could not have produced this without you!

T HAS BEEN ANOTHER CHALLENGING YEAR FOR BUSINESSES

across the region, with risks from the highly political in the form of critically important elections, to terrorist attacks and financial upheaval.

As Commercial Risk Africa grows, so does this annual survey of risk manager views from across the continent. I would like to thank our sponsors, Africa Re and Control Risks, for their valued support in this evolving project. In line with so many comments across the year, it is important to recognise the continental, regional, national and local variations in concerns and needs.

But it is also interesting to see how many common themes emerge.

As was clear from our global study last year, African risk managers face similar challenges to their counterparts across the world. It is just the context that changes.

Risk managers are all struggling with some shared challenges— not least of which is driving the culture of risk management through the organisation and into the boardrooms. In South Africa, in particular, there is a real concern that boards are still paying lip service to risk management even though regulators are forcing risk management into the everyday workings of the business.

Outside of the business, macroeconomic factors loom large— employment and unemployment are typical of that. Many countries report a dearth of highly qualified professionals in a range of sectors, while others are battling with high unemployment numbers.

The trick should be to marry the two but that is for government and, in the mean time, risk managers are having to highlight the consequential risks to their business.

Skills issues also play a major part in the changing nature of risk

LIZ BOOTH—Editor—Commercial Risk Africa

The changing shape of risk management: A move away from known hazards

A

S RISK MANAGEMENT increasingly becomes part of the fabric and as businesses adopt a more risk management-focused culture across all areas of the operation, the more obvious risks are not necessarily the ones to occupy the daily life of the risk manager.

Volker Von Widdern, Risk Manager and Managing Director of Marsh Middle East & Africa at Marsh Risk Consulting, explains: “I think boards worry about big risks that are down to insurable and non-insurable—nondamage supply chain issues; environmental loss; intellectual property issues.

“A lot is moving away from known hazards.

What a risk manager is doing is understanding the business model and looking at how you would continue given certain events—including non-physical events.

“If the board is worrying about computer issues, for example, there are so many

strategic issues which are not transferrable in the insurance sense that they should be considering,” he says.

“The corporate market has become more discerning about risk and how it is handled.

It is not simply all passed onto the insurance market but assessed and measured against risk appetite.” One of the risks for corporates, he says, is whether the insurance market is actually sustainable in its current form.

A lot of people, he says, fear the market is not functioning well and will not be sustainable in the long term as insurers compete by driving prices down.

As another risk manager says: “Risk managers are sometimes expected to know it all and to be able to predict everything that is about to happen. But how many people predicted the 2008 financial crisis, the Arab Spring or even that Goodluck Jonathan would step down so graciously?”

EDITOR Liz Booth +44 [0] 1263 861 676 [W]

SENIOR REPORTER EAST AFRICA Steve Mbogo +254 [0] 722 214 261

lizbooth@commercialriskafrica.com

smbogo@commercialriskafrica.com

GROUP PUBLISHING DIRECTOR Hugo Foster

SENIOR REPORTER WEST AFRICA

+44 [0] 7894 718 724 [M]

Billie McTernan

hfoster@commercialriskafrica.com

bb.mcternan@gmail.com

Beauty Mazibuko, a South African risk manager, says increasingly risk managers are expected to operate at more strategic levels and be in a position to identify the intangible risks.

They need to be able to converse with the board about macro events, such as geopolitical events and socioeconomic factors.

Working in the mining sector, she says, one of the emerging risks is the level of debt among workers.

Explaining what she means, she says: “There is a ripple effect,” as debt increases among workers, or they have to support increasing numbers of family members unable to get work elsewhere, and the likelihood of discontent in the mines grows.

“Workers want to be able to support their families and if they have more debt, they need larger pay packets to cope.”

Looking internally for risks is no longer enough, agree risk managers across the

REPORTERS:

Commercial Risk Africa is published monthly, except August and December, by Rubicon Media Ltd.—Registered Office 7 Granard Business Centre, Bunns Lane, Mill Hill, London NW7 2DQ

news@commercialriskafrica.com

Gareth Stokes, Ben Norris, Stuart Collins, Tony Dowding, Rodrigo Amaral, Nick Pratt

GROUP MANAGING EDITOR: Adrian Ladbury

aladbury@commercialriskeurope.com

DESIGN DIRECTOR:

Alan Booth +44 [0] 20 8123 3271 alan.booth@calixa.biz www.calixa.biz

continent. They need to be able to inform the board of the potential risks and to anticipate black swan events.

As Ian Clegg, Manager: Integrated Risk Management Services at Anglo American says: “After an event materialises, the board will look to the risk management and audit functions first to see how they functioned. If the risk management function has operated properly and the risk had been foreseen; they will ask questions about how that risk was reduced and mitigated against.”

Cape Town-based Antonella da Cunha adds: “We have to be able to give strategic advice. We have to look at broader issues, apply them to our businesses and inform the executive management.

“This might be an internal concern but these days it is just as likely to be a much broader issue but one which we need to explain its relevance to our bottom line.”

RUBICON MEDIA LTD. © 2015 All rights reserved. Reproduction or transmission of any content is prohibited without prior written agreement from the publisher

For commercial opportunities email hfoster@commercialriskafrica.com TO SUBSCRIBE EMAIL SUBS@COMMERCIALRISKAFRICA.COM

While every care has been taken in publishing Commercial Risk Africa, neither the publisher nor any of the contributors accept responsibility for any errors it may contain or for any losses howsoever arising from or in reliance upon its contents. Editeur Responsable: Adrian Ladbury.

4

CRA-SR-RF-Africa-2015.indd 4

14/5/15 13:40:43

[AFR I CA S U RVE Y | 2 0 1 5] [ REGULATORY

RISKS]

Playing by the rules For risk managers across Africa, increasing regulation is among their top three concerns for 2015, as it has been for several years.

The picture is not entirely even across the continent but they all agree that regulatory intervention is increasingly disrupting business

F

Globalisation

OR MANY RISK MANAGERS,

regulation tops their list of risks. It is something that keeps both them and their boards awake at night as a growing list of regulations must be complied with. This is something that affects all layers of the business and compliance is a full-time job.

The risk managers say compliance and risk, however, are two different things and although some risk managers also have compliance in their job titles, some risk managers were quick to point out that they are two different functions, requiring different approaches.

Lagos-based Adewale Adeniyi, Compliance Officer at Meristem Wealth Management, says: “Regulation is massive. A lot has happened in the past year and a lot of big firms have been caught out by changes. It is no longer business as usual—there has been tremendous change from previous years.”

However, regulation is not entirely negative. The risk managers report that it does help provide a level playing field, in which their businesses can compete more fairly. It is also helping to drive risk management up the agenda.

As Lagos-based cyber risk manager Onwukike Chinedu says: “It is getting better because they are being forced.”

Terry Booysen, Chief Executive Officer of CGF Research Institute, agrees but fears that for many there is still too much of a tickbox exercise and that boards are still not fully adopting risk management as part of the everyday culture.

Neither, he warns, are they giving the risk manager enough credence in the boardroom. He fears that some may fall foul of increasing regulation because they are paying lip service to the rules and not fully understanding the need to embrace the regulations as part of their culture.

Regulators themselves were not immune from criticism. Alex Aquereburu, Chief Risk Officer at Continental Re, sums up the feeling from a group of risk managers in Kenya who say they feel regulators tended to react to events rather than take a proactive stance in Africa.

He explains: “Most regulators have some kind of guidelines which companies have to follow but risk managers complain regulators do not do enough in terms of providing feedback.” The risk managers also fear that following regulations was often a bit of a “cut and paste job” and was turned into a tickbox exercise, rather than leading to better overall risk management.

Corporate governance is another hot topic. Mr Aquereburu says risk managers are concerned that sometimes there are conflicts between risk managers and board members. The risk managers surveyed agree there needs to be strategies in place to cope with any such conflict to make sure the risk management voice is properly heard. There are particular concerns around the levels of risk reporting.

Conflict of interest Risk managers raise concerns about the conflict between risk management and adding value. As Mr Aquereburu explains: “They feel there is a conflict between value creation and risk management. Most boards are interested in creating value, not looking at the downside of risk.”

Peter Mulwa Kioko, Risk Manager at East African Breweries, questions whether boards really pay much

attention to regulations—until they see them being fully enforced. He believes Kenya is one of the most progressive countries in terms of regulation but he says it is also about good governance and that is where it can fall down.

There is a huge variance between companies, he says, when it comes to the quality of their boards and how they operate. “If there are regulations, such as in the banking sector, the standards are higher—because they have to be. But in other sectors, the picture is more mixed.

“I think you need a combination—a good legal framework and having the right people on the board,” he adds.

FOREIGN EXCHANGE

Foreign exchange risks can easily be the result of political upheaval as the world markets generally get nervous ahead of a poll, however it can also be affected by the general state of the economy, as those in Ghana have seen in the past year.

Almost all the risk managers cited foreign exchange as having an impact on the business—whether it be a direct impact in terms of profits reported in US dollars, for example, or indirect in terms of rising costs of supplies and raw materials.

Either way, they say, it has to be factored into the business appetite for risk and investment. Foreign exchange controls too play a part, as foreign businesses will not invest without having the ability to extract profits. This is not just about multinationals in Europe or the US but about African firms with operations in other African states.

Africa Re does business in local currencies but reports in US dollars, so it directly affects the results and growth projections. The reinsurer had expected to grow around 10% but that figure has dropped back to nearer 8% purely because of the exchange rate. Sere Mada Kaba, Director of Risk Management and Compliance for Africa Re, adds: “It becomes a business risk because we had projected a certain level of premium but we can’t reach it because of currency fluctuations. If you do the analysis of business in the local currency, it is growing and achieving targets.”

Risk managers report a growing awareness of the interconnectivity of risks and that includes regulation. Take, for example, the UK Bribery Act. Although primarily aimed at UK businesses, any business anywhere in the world that does business with a UK firm, or has UK shareholders, will find themselves subject to its rules.

Across Africa, regulators have become more proactive, driven by growing commerce, the need to protect investors and maintain confidence in the economy, and compliance with the global standards.

Failure to be informed on the trends of regulations becomes a major risk for the company because of the resulting high fines, legal action and possible deregistration.

In east Africa, for example, there has been a raft of regulations, especially in the financial sector, meant to regulate structures in those sectors, create transparency, maintain control and standardise best practices.

Regulations are also meant to address the issue of corruption and its destructive effects on the economy and development. Again in Kenya, examples include the Ethics and Anti-corruption Act 2011, the Leadership and Integrity Act 2012, the Public Finance Management Act 2012, and the Proceeds of Crime and Anti-Money Laundering Act 2009 among others.

“As the pace of regulatory change continues to increase, keeping updated becomes progressively challenging. Penalties for non-compliance can be severe—both in reputational and financial terms,” says one observer.

“Businesses therefore need to understand current legislative obligations, engage in ongoing monitoring of changing regulatory requirements, plan to stay up to date with requirements, monitor changing levels of risk for entities covered by legislation, and monitor national enforcement actions, judgments and fines in order to understand how exactly legislation is being implemented.”

Failure to monitor the trends in regulation results in an even bigger risk. Johannesburg-based Rivaj Parbhu, Account Manager at Control Risks SA, says regulations are not just about how they affect the business directly but also about some of the unintended consequences.

For example, South Africa’s Immigration Act changed in the middle of last year. “It has had a big impact on businesses and tourism,” he says. Someone needs to be watching on the radar when these sort of things change. How many people have done a risk assessment around immigration?

“It has had a huge impact but nobody was watching the impact. Another change is coming this summer with the Black Economic Empowerment Act. Again it will have a big impact, but is everybody factoring it into their business plans?”

Some of the regulation will be industry-specific.

The South African insurance industry, like Kenya’s, has seen a raft of regulatory change, with plenty more in the pipeline. So too the mining sector. Beauty Mazibuko, a South African risk manager, says: “One of the risks we are facing is the change in mining legislation across Africa. Most countries have reviewed their mining legislation and it has had a huge impact on the cost of operations.”

Ian Clegg, Manager: Integrated Risk Management Services at Anglo American, sums it up: “We are seeing two aspects—complying with existing regulations and then change. Can we respond to unexpected changes?

That is the risk we have to watch.”

5

CRA-SR-RF-Africa-2015.indd 5

14/5/15 13:40:45

[AFR I CA S U RVE Y | 2 0 1 5] [ EMERGING RISKS]

New risks added to the top three This year’s survey has revealed plenty of new and slightly unexpected risks, from falling oil prices to traffic jams

E

NERGY HAS BECOME AN INCREASING ISSUE

for South African businesses, while the falling price of oil has become a particular issue in Nigeria, where risk managers worry about its long-term impact on the wider economy.

In South Africa, continuity of energy supplies has shot into the top three concerns as Eskom hits crisis point and a system of cutting power to communities on a rolling basis, known as load shedding, has been implemented. Load shedding is designed to prevent total collapse of the grid.

Power down Risk managers say it is incredibly hard to move from a country where power has been widely available for corporates to a nation where energy cannot be taken for granted. When load shedding occurs, businesses can turn to their own generators but this brings its own risks.

As one risk manager explains: “It’s all very well saying you have a generator but how much diesel do you have to run it?

What happens when you can’t get another delivery of diesel?”

The South African government is well organised in terms of informing the general public. TV stations, radio shows, national and local newspapers as well as social media are all used to inform people of where the load shedding will occur and at what level.

However, risk managers fear companies have yet to realise the potential impact of load shedding. As Johannesburgbased Rivaj Parbhu, Account Manager at Control Risks SA, says: “When you run through the actual consequences, you see people’s faces falling. They had not realised the full implications.”

Gillian le Cordeur, Chief Executive Officer at the Institute of Risk Management South Africa, adds: “People don’t realise how debilitating the cuts are. It is obvious if you are a manufacturing-based operation that you will not be able to operate without a generator.

“But even if you try to continue business as normal, you will find staff can’t get to work because all the traffic lights in the area are down too and the area is gridlocked.”

She adds that service-based businesses are just as heavily affected. Computers will not work and mobile networks and other communications will be down too.

Risk managers say the business has to choose between sending staff home early or having them stay but unable to function properly.

Retail outlets are closed too because lights are off and tills do not operate—even those with a generator discover the credit card machines are inoperable because communications are disrupted.

There then becomes an issue over staff payments—particularly for businesses with staff paid hourly; another risk that risk managers warn is not necessarily being factored in sufficiently.

Anne Reed, a risk manager with Runsums Advisory Services and Health Gateway, says: “Possible consequences include unproductive hours in mining, agriculture, manufacturing and in offices.

“It can mean lower turnover with consequential staff layoffs and lower taxes receipts to the government coffers. Higher overheads make firms uncompetitive in the global markets. In agriculture, it will result in higher food costs and a strain on household budgets. Shortcuts to make up production may cause accidents.”

She continues: “In financial terms it can make the cost of borrowing higher and put pressure on the fiscal system. For companies, the increase in electricity tariffs will probably be 12.7%. The regulator granted 8%. This increase is for those supplied by Eskom. Those who have their supply from the municipalities will see a higher increase. There will also be increased overhead expenditure on mitigating measures, for example purchase of fuel to generate energy.”

Like the others, she worries about some of the lesser

considered risks. “Higher unemployment can result in more civil disobedience, theft and xenophobia, as well as an increase in substance abuse, crime, terrorism and money-laundering.

“Unproductive hours in traffic can result in road rage and high stress levels, with a consequent increase in alcohol intake.

Resulting accidents (fatal and/or severe) result in the possible loss of a breadwinner.

“In terms of health, water can be contaminated, with pumps not functioning—resulting in diarrhoea. There is also a hygiene/sanitation risk with sewerage plants not functioning and there is a risk of food poisoning from food that is not safely preserved. For education there is also a risk that schools cannot function properly and so syllabus targets are not met.”

One of the questions South African risk managers are having to field from their organisations is: “The other countries (notably Nigeria) have coped for years without sufficient power, so why can’t we manage?”

The risk managers surveyed by Risk Frontiers-Africa say it is a fair point, however other countries are in a different place in terms of power supply development and this would be a backward step for South Africa.

They also point to a statistic that suggests GDP drops two points purely on a lack of adequate power supply. That factors in the extra cost burden to business of operating on generator power, rather than from the national grid.

Water scarcity According to the UNEP Finance Initiative: “South Africa is a water-scarce country where the demand for water is in excess

management, says: “The systems required to manage our water resources are failing. This is a major national crisis that threatens the lifeblood of the country.”

The National Business Initiative’s SA Water Annual Report 2013 states: “Water scarcity is the most significant waterrelated risk for the surveyed JSE-listed companies.

“With much of the region’s economic activity occurring in areas of reduced water availability, growing concerns regarding water quality, infrastructure and the continuing legacy of unequal access to water, there is an evident need for private sector engagement to promote more sustainable water practices.

“A particular area of concern relates to the poor understanding of risks in the supply chain, with 28%, (21% in 2012), of respondents unable to identify whether their supply chain is at risk.”

Ms Reed warns this is only moderately recognised as a risk in some companies. She says: “The CDP SA Water Report 2014 reveals that the 58 companies from the JSE 100 which participated and eight companies outside the target sample agree exposure to water-related risks are increasing.

“Overall, 90% of responding companies (83% in 2013) report their direct operations are exposed to water risks and 55% believe these risks will materialise within the next three years. Half have experienced detrimental water-related impacts that have had financial implications.”

She believes there are four elements of risk: n 1 — Physical risk, drought or pollution; n 2 — Reputational risk; n 3 — Regulatory risk; and n 4 — Financial risk.

However, she stresses, the more concerning gap is the opinion of the emerging companies: “The National Development Plan expects 90% of the 11 million new jobs needed by 2030 to come from SMEs. These companies already face regulatory challenges—will they have time to manage water risks?

“The SME Growth Index shows small firms spend an average of eight working days a month dealing with red tape. Taxes, labour and black economic empowerment issues are identified as the most timeconsuming.

“So the under-the-radar risk here is that these companies may not be monitoring water as a risk.”

Alarmingly, she believes: “Very little is being done. Businesses are still driven by short-term goals. Very few businesses are able or have the appetite to measure what is below the iceberg.”

Such issues are far from isolated— and nor are they restricted to South Africa. Most of Sub Saharan Africa suffers from droughts at some point and in some regions. However, few of the risk managers surveyed reported that their boards were factoring the impact into their business projections.

Traffic jams

of natural water availability in several river basins.

“Water pollution is a growing problem and can be attributed to municipal pollution, industrial effluent, acid mine drainage and salinisation caused by irrigation. ” The South African Department of Water & Sanitation says Gauteng Province is the economic hub of South Africa, however in September 2014, parts of Gauteng were left without water for three weeks.

Anthony Turton, a scientist specialising in water

Another new and emerging risk is that of traffic jams. While this may seem a small problem, easily resolved, it appears risk managers are beginning to factor it into their thinking.

As Gilbert Mwalili, a risk manager at Protecht based in Nairobi, says: “Traffic is a big issue—and a bigger one than people realise.

“Routinely people are leaving the offices at 4pm to try to beat the traffic home. They are starting their day at 4.30am but there are still jams.

“It is a business risk because every time you hold a meeting outside your office, you can pretty much guarantee one person will not show up.”

If that person is the decision-maker, he says, then the EMERGING: Turn to page 6

6

CRA-SR-RF-Africa-2015.indd 6

14/5/15 13:40:46

[AFR I CA S U RVE Y | 2 0 1 5] [ EMERGING RISKS]

EMERGING: Continued from previous page

continent and contract commitments put on hold, spreading the economic impact across the region, way beyond the borders of countries that had cases of the disease.

Luckily for the world at large, the outbreak appears to have been contained and the three most directly affected countries are at the point of being declared Ebola-free. Better still for the long term, a potential antidote has been developed, while foreign aid is being pumped into the health services to try to prevent any future outbreak taking such a hold.

Travel has resumed once again, although the economic impact on the three countries has been severe. Risk managers say the experience was a measure of their individual organisation’s risk appetite and also gave them, as risk managers, the chance to prove their value to the business.

As Mr Akinwale says: “If an organisation did not have insurance or the tolerance for risk, the only option was to walk away. It is important risk managers are knowledgeable and have confidence. You cannot be scared if you are a risk manager.

“They know it is not just a ‘no’ conversation if you can communicate your knowledge and present both sides of the argument so they can take an informed decision within the parameters of their risk appetite.”

meeting will be a waste of time for everyone.

The problem is getting worse as increasing numbers of Kenyans have cars, and the cost of fuel drops, but the infrastructure development is not keeping pace.

Fuel concerns Nigeria has long suffered with both electricity supply issues and with traffic jams, particularly in Lagos. But there the concern is less about coping with those issues than the broader issue of the falling oil price.

Verisk Maplecroft sums up the impact of falling oil prices on the wider economy. It fears the slump in global oil prices will have “severe implications for Nigeria’s macroeconomic stability.”

The company warns that, despite increasing economic diversification in recent years, the oil sector is the main pillar of the Nigerian economy and accounts for the majority of government revenues, exports and foreign direct investment.

As a result, it says: “Falling oil prices will increase fiscal pressure on the government, with greater borrowing or spending cuts likely to be necessary. The oil price drop is likely to focus attention on longer-term challenges facing Nigeria’s oil and gas sector, including major supply disruptions and prolonged regulatory clarity.”

Disruptive technology With Africa often becoming the test bed for innovation— think of the Mpesa system in Kenya; the use of seed supplies for insurance sales; and the use of drones for accessing remote communities—it is no surprise that disruptive technology has been added to the list of emerging risks across the region.

This risk is felt across many sectors but for many risk managers, insurance is one of the most at risk from disruptive change. Volker Von Widdern, Risk Manager and Managing Director of Marsh Middle East & Africa at Marsh Risk Consulting, points out that many firms see insurance as a grudge purchase and would look for alternatives if they were available.

Hillary Wachinga, Risk Manager at Kenya Re, worries that insurers are not making enough money from pure underwriting and are tampering with investment income to make their profits.

The danger, he believes, is that there is not enough investment into underwriting skills and this leaves the door open for new approaches to undermine existing insurance sales.

Kenya has been a hotbed of mergers and acquisitions in the insurance sector, as has Nigeria. For existing market players this is offering both an opportunity and a challenge.

For those that are bought or receive foreign investment, there is an enormous opportunity in markets that are poor in terms of insurance penetration. However, if your insurance firm does not attract that overseas investment, the firm is left competing with those that have much deeper pockets.

It may not seem an obvious risk, but the risk managers across Africa say foreign investment is both a blessing and a curse and needs to be factored into the overall strategy of organisations across the region.

New investors, particularly if they are strong market players elsewhere on the continent, will often bring new and radical approaches to the market. Those kind of shake-ups can prove very disruptive to existing firms, the risk managers warn.

Ebola outbreak While the risk of Ebola appears to be subsiding, risk managers across the continent see this as a new risk to be considered. The risk of disease and pandemics have been factored in but the recent Ebola outbreak has become about much more than the disease itself.

Adewale Gbenga Akinwale, Head, Enterprise Risk Management at Nigerian Aviation Handling Company, and winner of the Risk Manager of the Year prize at the Nigerian Risk Awards 2014, says: “We had just got a licence to operate in Liberia and then Ebola came.”

The question, he says, was whether the company should continue with the investment or if the outbreak would cause long-term disruption.

He says the company listened to his perspective as a risk manager. That in itself adds new pressures. “When I tell them that if we do ABC your profits will improve and it happens, next time round they will listen. That puts a lot of pressure on me to be right,” he says.

“You have to have the right facts to be able to deliver with certainty and these things are not cast in stone.”

Which brings the conversation back to Ebola.

Organisations took very different views of the risk and risk managers had to react to a fast-changing situation. For months Ebola hardly made the news and then it was blown up into a major international story. At that point, many senior executives were watching their TV screens and hearing that it could become a global pandemic.

Risk managers were being asked questions and, for many companies, the decision was taken to stop travel across Africa.

This was not just true of US, Asian or European firms but of African firms too.

International conferences were cancelled across the

7

CRA-SR-RF-Africa-2015.indd 7

14/5/15 13:40:47

[AFR I CA S U RVE Y | 2 0 1 5] [ CYBER RISKS]

Don’t let the cyber pass Cultural change is needed within African businesses if the growing cyber threat is to be managed, according to risk managers on the continent

C

YBER RISKS ARE SOMETIMES

considered new but, as the risk managers surveyed this year agree, it is more a case of cyber risks evolving as technology changes and thus opening up new risks.

For example, social media hardly existed five years ago but now it is part of everyday life and has opened up a raft of new challenges for business. In contrast, the risk of having a computer system hacked into, with consequences for business interruption, has been around as a risk for many more years and is something risk managers, along with their senior executives, are well accustomed to dealing with.

It is an often-voiced criticism that so much fraudulent activity is launched from African countries. The African Cyber Risk Institute believes Africa has become the biggest originator of global cybercrime thanks to a combination of access to fast internet and weak or non-existent regulations.

International criminal gangs have taken advantage of these factors to launch cyberattacks from Africa.

for the consequences of what happens, but they have abdicated the descisions to someone far too junior.

Too easy Jackson Kiboi, a risk manager for Icealion Insurance in Nairobi, also worries that the penalties for misbehaving are still way too low. In last year’s

Reputational risk

Cultural issue Beza Belayneh, Managing Director of the Institute, says many companies are using technical skills to tackle the challenge of cybercrime yet it is a cultural issue that should be addressed by directly involving employees in managing risks associated with cybercrime.

“The issue of cybercrime has not reached the level of boards of directors in most African companies. It is a cultural issue that requires involvement of the staff more than the technical skills to stop it. Companies need to understand that any system can be hacked and having technical know-how does not stop this,” he warns.

Risk managers also fear there is a complete failure to prioritise the human factor in cybercrime and that firms should be addressing the weakest link, which is the staff, in addressing the menace.

A recent survey by EY Africa showed 63% of African businesses face rising threats in their information security risk environment, so it is no wonder the risk managers surveyed also put the risk high on the agenda.

Within Africa, more than 60% of respondents to the EY survey cited several issues as high risk, including: business continuity/disaster recovery resilience; data leakage/data loss prevention; IT security and operational technology integration; lack of fraud support; inadequate/inefficient identity and access management; and lack of regular security testing.

Ebbe Rabie, Senior Account Executive, Specialty, JLT SA, based in Cape Town, fears: “We are just seeing the tip of the iceberg.” Antonella da Cunha, another Cape Town-based risk manager, agrees: “Often boards don’t worry about it because they [aren’t really ] in touch with reality.” Terry Booysen, Chief Executive Officer of CGF Research Institute, points out that, too often, boards will delegate the responsibility to someone more junior in the organisation, choosing them because they believe younger people have a “better handle” on all things IT. The danger with that behaviour, he warns, is that the board still has the ultimate responsibility

not limited to reporting crimes, however, and without broader transparency, he believes it will be hard to tackle cyber and corruption risks.

“There are wider reporting issues,” he explains.

“Self reporting is non-existent in many countries but in east Africa we put things on the table. In Kenya we do talk about things more. We aspire to a certain standard, which means we talk about things and things are reported.”

That means, the risk managers agree, that sometimes the problem seems worse than it is compared to other countries, when the reality is that it is just because the problem is being aired.

Risk Frontiers-Africa survey, Kenyan risk managers complained that it was too easy to commit some kind of cybercrime and that the penalties were too low so there was little in the way of disincentive.

Mr Kiboi warns little has changed and there is little in the way of support from the authorities, with relatively low prison sentences and no ability to recover stolen monies.

Peter Mulwa Kioko, Risk Manager at East African Breweries, agrees but also says there is a problem in terms of the culture of reporting problems. This is

FRAUD COSTS

Corruption is a major factor of business in Africa. It is external and internal and affects the private sector as much as it does the public sector.

The depth of the cost of corruption is such that according to the United Nations Development Programme, corruption costs African economies more than $148bn each year.

An estimated 65% of illicit financial flows are due to commercial tax evasion, mainly through trade mispricing.

Approximately 30%-35% of illicit financial flows are generated through drug trafficking, racketeering, counterfeiting and other criminal activities. Three per cent of illicit outflows are due to corruption like bribery and theft by government officials, according to the Global Financial Integrity Report 2010.

A large part of reputational risk follows on from concerns around cyber risks. Damage to a company’s reputation comes from many different directions. Social media, for example, is a growing risk, according to the risk managers.

“A few years ago this would not have been on the radar,” says one. “But now, you just need one disgruntled employee letting loose on the social networks and it can threaten the entire business.”

Most agreed senior management has yet to wake up to the scale of the risk from social media and, again like cyber risk, it is only when something happens to them or to someone close by, they realise the damage that can be done.

Lagos-based cyber risk manager Onwukike Chinedu sums it up: “Most industries are really worried by reputational risks. Whenever we talk about cyber risks to the business, it is reputational damage that is worrying them the most.

But it is not just about cyber attacks, it could follow a regulatory investigation or even a political event.”

He warns it is dangerous for any business to simply think of reputational damage in terms of any one event, when in reality there are so many ways in which an operation can be affected.

Peter McKinley, a Cape Town-based risk manager, adds that the use of social media can impact in so many other ways on a socioeconomic level. “The Arab Spring was the classic example,” he says. “Without the internet, word could not have spread so fast and the large crowds could not have been galvanised.”

He warns dissatisfied youth remains an issue for many African countries. While it is not seen as a direct threat in South Africa, the risk managers voice huge concern about the way in which a young girl was enticed to travelling to Syria to fight for IS in the past couple of months. Although she was stopped

by South African immigration officials, her story has given the whole country a wake-up call in terms of the power of social media, say the risk managers.

Another Capetonian risk manager, Franci Merry, also worries that social media is increasing a sense of entitlement across Africa’s young population.

“It is not about instability as such but they are increasingly dissatisfied as a result,” she warns.

Risk managers need to keep an eye on the issue in case it becomes more directly a threat to their operations, they all agreed.

8

CRA-SR-RF-Africa-2015.indd 8

14/5/15 13:40:49

[AFR I CA S U RVE Y | 2 0 1 5] [ INSURANCE]

Addressing the needs of the market remains haphazard warn risk managers Insurers still need to plug the gaps in their product offerings, according to risk managers across the continent, who say their organisations are becoming more aware of what insurance they need and what can be managed internally

T

Antonella da Cunha, a Cape Town-based risk manager, is not convinced by the available cyber cover. She wonders whether such cover should become an automatic extension of existing covers—business interruption, for example.

She says that selling standalone cover raises the spectre of double cover and also creates confusion for the insured, which is faced with the potential of an expensive add-on without really knowing what they will get for their money.

Another Cape Town risk manager, Franci Merry, warns: “People selling those policies haven’t got a clue. If you put an insurance person selling cyber against someone from IT they lose 6-0.” She also questions whether companies need cyber policies at all.

However, Ebbe Rabie, Senior Account Executive— Specialty with JLT SA, says the dangers of being hacked make such a policy worthwhile. “If your company is hacked,” he says, “and you are shut down for two days, the implications can be catastrophic.”

HE USE OF INSURANCE CONTINUES TO BE A

key risk transfer tool across Africa and increasing innovation, together with the introduction of new products, is helping risk managers in that transfer.

However, there are still some key issues around who does the insurance buying. For example, in a meeting of risk managers in Nairobi, only one of those in the room actually bought insurance. For the others the job was done by the finance director, who has different criteria for making the final decision on which insurance to buy.

At another roundtable, the split was much less even but those risk managers too acknowledged the difficulties in persuading their boards to buy the right cover.

In terms of what cover is available and whether it responds to the concerns raised across this survey, the risk managers have a mixed response. Adewale Gbenga Akinwale, Head, Enterprise Risk Management at Nigerian Aviation Handling and winner of the Risk Manager of the Year prize at the Nigerian Risk Awards 2014, is one of those who believes insurers are responding with new products.

“Talking of directors’ & officers’ (D&O) policies, for example,” he says. “We never thought about this cover in the past and I think policies can be created to address the new risks we are seeing.”

However, Adewale Adeniyi, Compliance & Risk Management at Meristem Wealth Management, complains: “There is a huge gap between products the insurers offer and how they meet the risks.”

He does welcome an influx of foreign insurers into the Nigerian market, which is resulting in new products and more communication with insureds. He also believes it is helping to raise standards among local insurers, which are faced with competing with the deep pockets of international players.

In South Africa, Volker Von Widdern, Risk Manager and Managing Director of Marsh Middle East & Africa at Marsh Risk Consulting, believes there is a greater understanding of the types of insurance available and that risk managers are becoming more discerning about what they choose to buy.

“They are getting to the point of being discerning about risks they are willing to take and that is impacting insurers,” he believes.

Mr Von Widdern explains that the upshot of risk managers not buying so much cover, and cherry picking what they want, is that if the insurance market suffers one big loss it will withdraw, because the market is not sustainable.

A sustainable insurance market is critical, they all agree, if the right products are to be easily available across the continent.

It is not just about standard covers but also about new forms of insurance. As well as D&O, which is new to many African markets, there is cyber cover. The world over, insureds are battling with what cyber insurance should actually cover and how that differs from other classes of business.

Need for innovation In South Africa, new privacy legislation is impacting this approach but, she says, few insurers are talking to insureds about the new exposures. And with new legislation, Ms Joubert says, comes all kinds of compliance issues—again an area where insurers could be showing more innovation.

Another example, she says, is business interruption. With all the energy blackouts, the insurance market has yet to make the most of business interruption sales, not just for the obvious clients but across the board.

Political risk is another area where the risk managers believe insurance could help in a fast-changing environment. Kenya is an example of that, where the risks posed by Al Shabaab have implications not just in terms of physical property damage but also in terms of business interruption, loss of profit and reputational damage.

Reputational damage brings the Kenyan risk managers back to the subject of cyber risk. Hillary Wachinga, Risk Manager at Kenya Re, believes the insurance industry is “backward” in the way it handles its own business, let alone its offering to clients.

The one good point about that, he says, is it makes insurers less susceptible to cyber fraud themselves. However, his words are instantly rebutted by Monica Arita, Risk Manager at GA Insurance who says: “It is not true that we are not facing cyber risks.”

The Kenyans also believe there is much more the insurers can do in the microinsurance space, which can also help SMEs develop. Catherine Nyaga-Mbithi, Risk Manager at Heritage Insurance, is one of those who feels microinsurance offers new opportunities but she also admits insurers could do more in the cyber space for more developed businesses.

She says there is a move to try to address fraud issues and pay more attention to the concept of “treating customers fairly”.

Changing market

Filling the gaps

Reginald Haman, South Africa-based Executive Head: Risk & Assurance, Royal Bafokeng Platinum, believes the market has been disrupted in the past few years. “In South Africa the role of the intermediary has changed significantly,” he warns. Mr Hamam believes the upshot of this is that, as the market has become ultra competitive, insurers and brokers do not spend enough time understanding the risk.

This plays out in terms of the type of cover available and, going back to cyber cover, there is real concern among the risk managers that the insurance market has yet to get to grips with some of the new challenges such as cyber and even D&O. Janine Joubert, the Institute of Risk Management South Africa’s 2014 Risk Manager of the Year, believes there needs to be more partnership between insurers and insureds in terms of sharing and understanding the risks better.

However, she fears, insurers have yet “to get their minds around” some of the new technology and the risks it brings.

She points to the concept of “bring your own devices” to work, which she says opens the doors to all kinds of risks for the organisation.

Robertson Kiragu, a risk manager at Standard Chartered, says many organisations are asking their risk managers for tools to mitigate against the main risks and then are looking to use insurance to “plug the gaps”.

Fraud is one of those gaps, according to Agnes Mbaire, Risk Manager at Postbank. She says: “It is a major risk for the banking industry, in particular. Human resources is key in tackling this because it is about changing people’s culture.” But she says there is also a role for insurance.

Mr Kiragu agrees, adding that so much fraud is internal, it can be about having the right people in place and insurance as a backstop when things go wrong. Joan Kirika, Risk Manager at the Insurance Regulatory Authority, warns that many insurers still need to invest in technical expertise to be able to address these kinds of risks and deliver the right type of products.

Again, the influx of foreign insurers is seen as a positive step because they will bring greater expertise from other markets and help raise standards internally, as well as delivering new products to the market.

9

CRA-SR-RF-Africa-2015.indd 9

14/5/15 13:40:50

[AFR I CA S U RVE Y | 2 0 1 5] [ INSURANCE]

A fine balancing act between pricing and products Choosing insurance and the right carrier is not necessarily the job of the African risk manager but most do have a say in the needs of the business in terms of cover. However, the risk managers surveyed by Risk Frontiers-Africa report the insurance market still has some way to go before they feel it is really delivering in terms of new opportunities

R

ISK MANAGERS ACROSS THE

continent are concerned the insurance market may become unsustainable, which would leave everyone vulnerable to collapsed firms and unpaid claims, if pricing across the region does not stabilise.

While risk managers say they are enjoying the low cost of premiums at present, managers from market after market question whether this is good for the long-term sustainability of the sector.

In some markets, such as Kenya, the split between those who manage risk and those who buy insurance within firms is highlighted as an added cause for concern because of the risk that the insurance buyers do not understand the dangers of an unsustainable market and are thinking purely in the short term.

Kenyan risk managers are among those who warn that too many insurance buyers are searching out deals on price. “They look for who will undercut the most,” says one, while another agrees “They want a 5% or 10% cut on last year and don’t ask how the insurer is achieving that. It might be worse terms and conditions or simply a cut in profit—either way that’s not good news.”

Jacob Njeru, Finance Director and Company Secretary at Nampak, stresses the dangers, saying that if insurers are continually forced to cut prices they will stop investment in new products or in their own businesses and again the ultimate losers will be the clients.

He adds: “We can’t complain about undercutting when we as buyers are getting a good deal. The problem is whether pricing would cover risks if anything were to crystallise into a loss.” He also believes pricing is becoming more transparent and there is growing understanding among insureds about how the insurance pricing chain works and who receives commission for what.

Increasing maturity The risk managers surveyed agree that the days when insurance was seen as the all-singing, alldancing solution to risk are gone.

Ian Clegg, Manager: Integrated Risk Management Services at Anglo American in South Africa, agrees, adding that increasing maturity among risk managers helps them negotiate the best deals with insurers.

Being able to show understanding of the risk and what risk reduction measures are in place all builds a picture of a well risk-managed business, they all agree, and that helps reduce premiums.

Insurers too need a good understanding of the risks and the risk managers say they want to feel confident that the insurer has that understanding—going back again to the risk of low prices affecting the technical training available within the insurer itself.

Reginald Haman, South Africa-based Executive Head: Risk & Assurance, Royal Bafokeng Platinum, calls for more advice and technical services from the insurer as part of better understanding of risks from both the insurance and insured sides.

higher rates for insurance to have the certainty of a reliable insurer at their backs, most risk managers agree that it is a good idea. However, for those who do not buy insurance directly, they say it is far harder to convince the people with the chequebook that it is a good idea.

For those who do buy insurance directly, they have the freedom to make the choice but they still have to justify their decision to the finance holders and that is not easy either.

There is a feeling that insurers need to shift away from insuring purely the physical assets and to place more emphasis on some of the intangibles. Cape Town-based Antonella da Cunha suggests: “There is a need for insurers to innovate. The market is not going to harden in our lifetime but insurers can innovate.”

They agree markets do vary and, looking to Europe, they see many more “giveaways in terms and conditions than in their own market”.

The risk managers also stress that they would like to share risks with insurers. By taking on higher deductibles, they say, the organisation has a responsibility to better manage their operations to minimise the number of small claims and to be able to use their insurance policy as a backstop for the larger claims.

Many of them see this type of behaviour in other markets but not in their own and they would like to see a shift in thinking from

He is also concerned that insurers do not always ask for the right information. Mr Hamam says they will ask questions “but the world has changed” and he worries insurers are not showing the right signs of keeping pace.

The risk managers also argue over the rights and wrongs of a growing trend for the risk manager to name the insurer they want to use. While some see this as progress because it reflects increasing knowledge on behalf of the risk management community, others worry about the implications of that.

For example, some of the South African risk managers say they want a particular insurer because they know that cover will work for them in the event of a claim. But others argue that the danger is that the risk manager will end up “holding the can” if something goes wrong and they have been seen to be so prescriptive in their choice of insurer.

Mr Hamam still believes it is a good idea to use a broker to gain access to the widest choice of insurers. “That person should understand what my needs are and if there is a claim, you know you have someone on side to defend you and help you through the process.

“You need a history with an insurer,” he believes. “If you have a difficult claim you need to know the insurer will back you.”

Buying insurance Asked if they see the value in paying slightly

the insurers to support their new approach.

This, they say, is not about setting up their own captive but becoming better at managing the attritional losses and about developing a growing maturity within their community.

Some suggest the problem lies with the size of the local corporate market, which leaves insurers unwilling to innovate when so few policies would be sold, however others fear the reverse—that there are too many insurers and this creates a security risk.

Regulation and foreign investment Most welcome increasing regulation of insurers across the continent, which they believe brings local African markets up to international standards in terms of regulated and secure insurers.

They also welcome the influx of international players, bringing expertise and new ideas. But they are also keen to maintain the local players too, because they feel these insurers truly understand local market conditions and are well placed to serve their operational insurance needs.

Overall, they say, they do understand the need for insurers to drive up prices to properly sustainable levels, however they say insurers too have a responsibility to adapt to new market conditions and to respond to the needs of the insured.

10

CRA-SR-RF-Africa-2015.indd 10

14/5/15 13:40:51

[AFR I CA S U RVE Y | 2 0 1 5] Risk managers are playing an increasing role in the strategy of their organisations, but not everyone has left the grass roots behind...

Risk managers’ role continuing to evolve

R

ISK MANAGEMENT CAN BE SUMMED

up in three stages, according to risk managers from across Africa.

Many point to an evolving picture as risk managers gain maturity in their roles and as regulators encourage more active risk management from businesses.

Adebayo Adebeshin, Risk Manager at MTN Nigeria, sums up the core skills of any risk manager: “They need knowledge. They need technical knowledge but they also need knowledge of the business and industry; ecosystem knowledge (such as economy, terrorism, technology, politic and corruption); trends; and leading signals.”

Mr Adebeshin also believes a risk manager needs experience so they can identify controls and governance, manage operations and have leadership which helps with relationships, advocacy and enables change.

Again, he says the ability to manage change is a key quality, adding the qualities required include being “change-oriented, broad-minded, a leader, able to develop relationships and advocate change”.

His words are echoed by Jacob Njeru, Finance Director and Company Secretary at Kenyabased Nampak. He says: “Key qualities can be divided into two core areas—knowledge and experience. The qualities required are that risk managers are decisive, broad-minded and analytical. In terms of knowledge they must understand business modelling, commercial and social risks, while in terms of experience, they must have an appreciation of business model foundations and risks facing that particular environment.”

to have a good business management background,” he says. “A chief risk officer is a prescribed officer but the key is that the CRO has solid business experience.

I feel it is secondary as to whether they have qualifications for that. Not every risk manager will be a prescribed officer but business experience is critical.

“Technical skills relevant to the specific industry can be added onto that. But a risk manager needs to understand how to review a problem and offer advice to the business.”

“Business acumen is key,” according to Janine Joubert, named Risk Manager of the Year in the Institute of Risk Management South Africa’s 2014 awards.

Ms Joubert says, however, that good understanding of the business is just one core skill and other aspects—such as the ability to communicate effectively with others—are just as critical. “In my view good communication is one of the most critical

Varied role However, there is also panAfrican appreciation that the role of the risk manager will be different from company to company. There was widespread acknowledgement that in some companies risk management is still very much a tickbox exercise, done to meet compliance demands rather than as a benefit to the company.

Elsewhere, some risk managers have the effective role of security officers or, alternatively, of health and safety managers.

They are very much working on the operational side with little in the way of strategic planning.

In some jobs the risk managers will have no say in the ultimate risk transfer. So, while they may identify the risks, it will be down to the finance director to buy the necessary insurance. The danger of this, they warn, is that the finance director may look for lower cost policies or cut back on terms of a policy to save money, without fully understanding the implications of that risk-taking.

Some risk managers surveyed said they were still seen as the ‘no’ officers, always rejecting ideas on some grounds or other. There is still some way to go, they said, in terms of convincing businesses that they can offer so much more than a simple ‘no’.

More positively, others reported that risk managers are climbing the corporate ladder and, as they do so, they are acquiring or need more sophisticated business management skills so that they can properly inform the business.

Reginald Haman, South Africa-based Executive Head: Risk & Assurance, Royal Bafokeng Platinum, looks at it slightly differently. “A risk manager needs

areas. If people understand what you are saying, they are much more able to act on it.”

Volker Von Widdern, Risk Manager and Managing Director of Marsh Middle East & Africa at Marsh Risk Consulting, warns it is not an easy role: “Risk managers are meant to have a crystal ball, according to some, but could they predict the global financial crisis or the way oil prices have tumbled this year? The skill is being able to put these events into the local context and that comes down to business and analytical skills.

“Risk managers are able to understand what black swan events could do to the business and that is one of their key qualities.”

Ms Joubert believes one of the major challenges for risk managers in the future is the way so many still work in silos. Instead of taking the work across areas,

too often, she says, companies will keep everyone in a separate silo so the risk officer is not regularly communicating with, say, the IT manager.

Outside the box In Kenya, many risk managers are relatively new to the discipline, brought into the job courtesy of regulatory requirements. Robertson Kiragu, Risk Manager at Standard Chartered in Nairobi, says risk managers need to be able to “think outside the box and through the box”.

He also believes it is important to be able to improve the perception of risk management in the business and evolve so that risk management becomes increasingly adopted as part of the business culture.

“You also need to be critical in your analysis so you can identify gaps and be aware of what needs to be done,” he says.

The ability to multitask was highlighted by Monica Arita, Risk Manager at GA Insurance. “You have to be able to juggle. You might face a crisis in the business, be dealing with the regulator and be called into a strategy meeting by the board.”

She says it is challenging in Kenya because it is such a new discipline and many risk managers have come out of the audit function, so it is sometimes hard to know where to turn. She, however, stresses that it is not necessary to understand, as a risk manager, how to underwrite, for example. The key for her is to understand the processes and regulatory considerations so the potential risks can be evaluated.

Dorothy Maseke, Risk and Compliance Manager at Icealion Insurance Group, feels: “You almost have to be an expert in everything. You certainly need a multiplicity of skills. You need to have an intelligent conversation but more than that you need to have integrity because you need to have the moral authority to help people to deal with the positive and negative.”

Catherine Nyaga-Mbithi, a Nairobi-based risk manager for Heritage Insurance, sums it up. “Above all, you must be interested,” she says.

“Sitting in your office you are not learning much. Simply walking around the organisation means you are getting to know what is happening— are we launching new products? Are people worried about something?

“If you interact with people they will tell you what is happening. Get to know what is happening otherwise things will be passing you by. We might be seen as a back-office function but by being interested and interacting with people, you can do your job so much better.”

Overall, the risk managers agree their role is evolving. As some suggested, there have been three stages of risk management to date—firstly they came in as health and safety-type officers, checking operations, they have become the holders of risk registers and now they have advanced to the stage of helping the business develop strategically.

None of them feels the role has fully developed but instead believe it is a function that will continue to be a more integral part of the business and will become increasingly embedded in the culture of businesses for the future.

11

CRA-SR-RF-Africa-2015.indd 11

14/5/15 13:40:54

[AFR I CA S U RVE Y | 2 0 1 5] [ TALENT]

Finding the right people for the job poses new challenges A lack of skilled people as well as threats rising out of unemployment are high on the risk list for risk managers across Africa but are perhaps not high enough up the list of concerns for their boards, they warn

T

HE QUESTION OF FINDING THE RIGHT

people and then keeping them is something that is worrying boards across Africa, in all industry sectors and at all levels.

With economies across the region continuing to improve, the need for more skilled workers has never been so pressing. Even in South Africa where unemployment is a huge issue, there is still a skills gap.

A recent PwC survey shows 96% of African chief executive officers (CEOs) are concerned by the lack of skilled workers, while this number only drops to 87% in South Africa even though unemployment levels are so high. Technology and engineering firms are struggling the most with the shortage of skilled employees, according to PwC. Another report, this time from McKinsey, says that, despite the creation of 37 million new and stable wage-paying jobs in the past decade, only 28% of Africa’s labour force holds such positions. “Instead, some 63% of the total labour force engages in some form of self-employment or ‘vulnerable’ employment, such as subsistence farming or urban street hawking,” it warns.

McKinsey believes: “If the trends of the past decade continue, Africa will create 54 million new, stable wagepaying jobs in the next 10 years—but this will not be enough to absorb the 122 million new entrants into the labour force expected in the same period. However, by implementing a five-part strategy to accelerate the pace of job creation, we estimate Africa could add as many as 72 million new wage-paying jobs in the next decade, raising the wage-earning share of the labour force to 36%.”

Tackling the problem The scale of the problem is enormous. The risk managers surveyed by Risk Frontiers-Africa suggest some of the problem starts with the education system in many African countries, which is not producing the right calibre graduates.

However, others say it is far too simplistic just to blame the schools and colleges. Odunayo Bammeke, Group General Manager, Nigerian National Petroleum Corporation, believes there is a real risk posed by the number of talented Africans choosing to leave the continent. One of the “greatest dangers is a brain drain”, he suggests.

“Why should any African youth want to come back and stay in Africa given the political and economic environment? Young people are more enlightened and aware of the choices they have but he says business leaders have a job to do in convincing young people of the value of staying or returning to Africa.

“We need to offer more training and help them enhance their careers here in Africa. We have a responsibility and a duty,” he says. Young people bring fresh approaches and

a much-needed energy to business, while encouraging innovation, Mr Bammeke adds.

“We have an opportunity to create a bridge to the next generation. The critical skills are the capacity to think, manage change and innovate. Any business today that does not innovate will not survive.”

Identifying talent that already exists within the business is key. “It is important for us to attract and also to retain leaders in our sector,” he says.

Mr Bammeke’s words were echoed across the continent by the risk managers surveyed. Edwin Kagunya, Risk Manager at Toyota East Africa, says: “People lead processes. Most of the time finding the right people is quite a challenge.

“We have training and programmes in place and have developed a training academy but it is still a challenge to find the right people in the first place.”

Antonella da Cunha, a Cape Town-based risk manager, agrees: “If you want to find the right person, you have to headhunt them so you look at your competitors or you look overseas. Junior people don’t have the context and experience so there is a problem.

“Then when you do train someone up, they get headhunted by your competitors instead, so you lose them very quickly if they are any good,” she warns.

Skills mismatch Employment also features highly in the Institute of Risk Management South Africa’s (Irmsa) Risk Report.

Dr Mark Bussin, Chairperson, 21st Century Pay Solutions Group, says: “Economists are now emphasising another problem, which includes the mismatch between the skills that young people offer and the ones that employers need. Employers are awash with applications, but complain that they cannot find candidates with the right abilities.”

Unemployment ranked second in terms of a likely risk in that report. Nico Snyman, CEO of Crest Advisory Africa, was bleak about the future in South Africa, saying the official unemployment figure stands at around 26% but that masks a huge number of unemployed young people who are underqualified and struggling to get onto the employment ladder at all.

Michel Sauzier, also based in Cape Town, worries about the security situation as a result of the growing youth unemployment. “Labour unrest is a big problem,” he warns. “We are a resource-dependent country so it is a major problem. We are all interlinked and there is a risk that the impact will spill over to all sectors.”

He fears much of the problems stem from the legacy of apartheid and, although the government is pumping money into education, it is the educational system where many of the problems start. Mr Sauzier urges risk managers to factor labour into their risk assessments.

Henk Du Bruyn, Senior Account Manager at Control Risks SA, agrees: “The labour force is not getting better and government measures are not focusing on the problem. Whatever is being done, there is still another Marikana looming and it will affect all of our businesses.”

In Johannesburg, Janine Joubert, Irmsa’s Risk Manager of the Year for 2014, also warns of the risks around social unrest and general discontent about the direction the country is moving in.

She questions whether organisations are factoring the

VISAS— A NEW CHALLENGE This year has seen an increasing number of disagreements between governments over entry to each other’s countries.

While east, west and southern Africa all have regional communities in which the local population can travel more freely, the past few months have seen problems arising when Africans choose to travel outside their home region.

Tempers have flared between the Nigerian and South African governments in particular and it has become a new risk to be factored into planning, say risk managers.

For example, senior executives may find they have to travel home between meetings just to send their passport into the right visa office. That passport may sit in the visa office for four weeks, or even a couple of months.

When visas are granted, they may be for a very specific numbers of days, restricting the ability to do business, or they may not be granted at all, stopping executives from accessing markets in which they are already doing business.

Nicholaas Van Niekerk, Head of Risk at Specialised Services Group, raises the spectre of visa applications stopping freedom of movement. Rivaj Parbhu, Account Manager at Control Risks SA, says the Immigration Act changed in the middle of 2014 and this is where many of the issues stem from.

However, he says, the change was a long time coming and really brings South Africa into line with other jurisdictions.

“It has had a major impact on business and tourism,” he acknowledges. “But the problem is not the law but the way it was implemented. It was flipping the switch and expecting it to happen. People were caught outside the country and then found they couldn’t get back in. There was no lead-in time.

“There are more draconian laws in the US or Canada, for example, but people were upset when the same laws were applied in South Africa.”

risks around talent sufficiently in their planning.

“Social unrest is new and political uncertainty is brand spanking new,” she warns. Ms Joubert says the risk broadens out too. If employees are not earning enough to cope, then the risk of corruption escalates.

Another problem arises out of the employment/ unemployment question. South Africans have been rocked by the recent xenophobic attacks—Beauty Mazibuko, a risk manager in the mining sector, is among those risk managers warning that it could become an issue.

She puts labour issues among her top concerns and with mines generally employing large numbers of southern Africans, as well as South Africans, the issue is high on their agenda.

“We need to have a holistic view of the challenges we face,” she says. “We need to be looking at things like community development.”

All the risk managers are concerned by the development of a bored and disaffected youth. While most in South Africa are less concerned that this could prove fodder for activists and even terrorists, those elsewhere in Africa are not so confident, particularly those in Nigeria and Kenya who are dealing with Boko Haram and Al Shabaab, respectively.

12

CRA-SR-RF-Africa-2015.indd 12

14/5/15 13:40:55

[AFR I CA S U RVE Y | 2 0 1 5] New risk management qualifications launched in South Africa this year could pave the way for a continent-wide certification that will give risk managers a formal career path for the future

Proving you’re qualified becomes one step easier

I

N THE PAST YEAR, TALENT HAS RISEN UP THE

agenda as a key issue for businesses operating in Africa, regardless of territory or business line. As already identified earlier in this survey, chief executive officers (CEO) in Africa (96%) responding to a PwC survey are most concerned about the lack of skills. Technology and engineering firms are struggling the most with the shortage of skilled employees, according to PwC. As you will see from the data on page three, that concern has been reflected in the Risk Frontiers-Africa survey of risk managers, with many putting the lack of adequately skilled people as a business risk for the coming year, but what about for risk managers themselves?

The feeling across Africa is that too many risk managers ‘fall into’ the job, moving from another discipline, and that there is little in the way of a formal career path for risk managers.

While some do not see this as a major problem, others are not so confident and would like a more structured progression from school into the business environment.

Some of the debate comes back to how risk management has evolved and the actual role of a risk manager. However, the fact that risk managers have moved on from the early days of health and safety regulation monitoring has led to increasing numbers calling for more formal qualifications, recognised across borders.

says: “There is no one-size-fits-all. What Irmsa is doing is putting together best practice standards and frameworks.”

There is also a feeling that everyone who works in a business should have an element of risk management in every element of their work. How far the risk management qualifications need to spread is another question posed by the risk managers.

Should risk management be part of broader business degrees, for example? Should there be separate modules on risk management or should it be included in every module?

Continental differences However, so far South Africa is alone across Africa in terms of having any such formal qualifications. Mostly, risk managers rely on US or European qualifications, if any.

Nigeria is one such market where the risk managers are generally well qualified, although it is a mixed bag in terms of the numbers who have any risk managementspecific qualifications as opposed to more general business qualifications.

Adewale Gbenga Akinwale, Head, Enterprise Risk Management at Nigerian Aviation Handling Company, and winner of the Risk Manager of the Year prize at the Nigerian Risk Awards 2014, feels it may be hard to develop a

of them are on a fast learning curve, without structured training as yet. For example, one risk manager reports having a drink with a risk manager from a different company each week to discuss the broader challenges of the job and how to tackle them.

Likewise, one of those surveyed said she has established a network of internet/phone buddies. Again, they contact each other on an informal basis to swap ideas and stories.

Jacob Njeru, Finance Director and Company Secretary at Nampak, says it is hard to have one standard because: “Education and training will depend on eventual industry of practice together with productivity and liquidity drivers of the industry once a basic college degree is attained.” Some local aspects are available, complemented by eternal postings and/or external educational systems.

Joan Kirika, Risk Manager at Kenya’s Insurance Regulatory Authority, says qualifications are emerging but only slowly. The

Meeting demand This time last year, the first survey of African risk managers, conducted by Risk Frontiers-Africa , revealed a huge thirst for qualifications.

Since then, the Institute of College of Management Studies has a risk course, she says and Moi University has some elements of risk management in its course.

Room for improvement

Risk Management South Africa (Irmsa) has launched its first formal certification, with exams set at two levels. The first exams, at the lower levels, will be sat in June, following a successful pilot exam last November.

The pilot exam for the second tier, which will be set at postgraduate level, will be trialled later this year, with the first exams due in 2016.

Antonella da Cunha, a risk manager based in Cape Town, believes: “The best thing that has happened is the new Irmsa qualifications.” She is delighted by the fact that learning from the books will not be enough, because the qualification will test knowledge and the way it is applied, something that can only have been learnt through experience.

Tim Szoke, another Cape Town-based risk manager, who has only just joined the profession, also sees the new qualification as a good thing. He admits: “I am not a risk manager yet because one job has morphed into risk management so I am having to learn as the role develops.”

There is a realisation that risk managers can come from a variety of professions, often with business-related degrees, such as audit or project management.

Franci Merry, another Cape Town risk manager,

precise qualification because risk management is such a broad discipline.

“You have to consider project management, business analysis, business development. I think risk management is really wide but not so deep, which is why it is difficult to see how specific training would work.”

He suggests risk managers should continue to take a series of short courses throughout their careers to keep abreast of the latest thinking, rather than relying on one qualification taken early on.

That is something Gillian le Cordeur, CEO of Irmsa, is also extremely concerned about. “Our qualifications include an element of continuing professional development,” she says.

Mr Akinwale says courses may not be strictly on risk management but on such issues as cyber risk or reputational risk. All of it helps to build awareness of the broader issues affecting organisations, he believes. “A lot of industries are infusing risk management but you still need to learn as a risk manager.”

Adebayo Adebeshin, risk manager at MTN Nigeria, adds: “A risk manager needs a proper risk education, which is not available as a compact course in Nigerian Universities. Risk might only be treated as part of other related fields of study like accounting, audit and finance.

Most risk management professionals therefore spill over from these ‘related’ academic fields.”

He believes: “Professional certification (like from IRM UK or IIA) provides the bridge, which the Nigerian academia does not offer the risk professional.”

Again, the Kenyan risk managers report that many

However, the Kenyan risk managers believe there is plenty of scope for development. Gilbert Mwalili, a Risk Manager with Protecht, says: “Where Kenya is right now we are seeing demand for risk managers—it is very high among insurers and government institutions because it is now mandatory.

“Do those people have degrees in risk management? Are they doing a good job? I think they are and I don’t think a formal qualification automatically makes a good risk manager. So much depends on the industry sector.”

He also warns against “scaring employers” by being overqualified. However, while Peter Mulwa Kioko, Risk Manager with East African Breweries, sees risk managers as being in a unique position within organisations, he also believes identifiable qualifications will be introduced.

“Kenya is quite progressive in terms of qualifications,” he says, “which makes the likelihood of regulating the profession higher.

“You can’t be a CFO without qualifications. It is mandatory for any bank to have a senior officer as a risk manager, independently reporting to the MD. That role is for a qualified professional. I think we are likely to see a lot more regulation in the wider banking sector,” he adds.

Asked if risk managers would like to see any qualifications recognised internationally, Lagos-based Mr Adebeshin sums it up: “I say ‘glocal’. It’s not enough to be local. But a global certification without that horizontal flexibility in its body of knowledge may remain abstract in local context. I favour the IRM UK qualification.

“Just like accounting and finance professionals tend to specialise into certain industries, risk managers will eventually face the same metamorphosis, hence qualifications should be tailored for the local market but backed by global standards of practice.”

13

CRA-SR-RF-Africa-2015.indd 13

14/5/15 13:40:58

[AFR I CA S U RVE Y | 2 0 1 5] Risk managers believe their position in the organisation is changing as their role evolves but not all agree that they need to sit on the board to do the best job

Getting your voice heard at the top

T

V SHOWS, RADIO AND internet have all been used to full advantage by risk managers in the past year as ways to raise awareness of risk management among board-level colleagues.

As Lagos-based cyber risk manager Onwukike Chinedu explains: “We have been using TV shows to raise public awareness of things like cyber risk.

“When we then go into the boardroom the next day, the directors say: ‘Oh yes we saw something about cyber risk yesterday, what are we doing about it?’ It makes them sit up and take notice in a way that we struggle to achieve otherwise.”

His comments highlighted the split, shared across Africa, of risk managers saying something and the board listening to the message.

Many of those surveyed stressed the importance of having the ear of the chief executive officer (CEO) and other board members; of being able to identify risks so that the board could make fully informed decisions.

There was a clear message from the risk managers that their job is not to deal directly with the risk but to have considered it and to be able to inform those who are able to make decisions and take action.

Too many of those surveyed say they are still expected not just to identify the problem but solve it as well, whereas it should be the line managers or board members who take the actual decisions.

Risk managers also report increasing maturity, however, as their role within the organisation evolves. They say that, for the most part, they are now more than straightforward health and safety officers and an increasing number do report direct to the board.

Chief risk officers are also emerging in greater numbers, often associated with large multinational companies, both those headquartered on the continent and those based elsewhere.

But some risk managers warn against

and not every risk manager will become a chief risk officer (CRO) and not every risk manager will necessarily ever have to inform the board.

moving too high up within organisations, saying it is vital risk managers have their ear to the ground and do not lose sight of what is happening elsewhere in the operation.

Nicolaas Van Niekerk, Head of Risk, says that too often he has seen risk managers who do not do simple things such as walking around the building and going on site visits. And Dianna Games, CEO of Africa @ Work, adds: “If you move too high up, you can’t always tap into the network.”

The South African risk managers came to the conclusion that risk management is a little like human resources. Not originally considered a key part of the business, over time, it has become just that.

Across departments They also agreed that it was important to break down silos in organisations so that risks were communicated across all parts of the business.

An event in one department may appear innocuous to those in that team but actually have much larger consequences for the business as a whole and only by breaking down the silos is the risk manager able to keep abreast of those potential developments.

Anne Reed, a Johannesburg-based risk manager and consultant at Runsums, says: “Risk should be measured both as a positive and a negative. It is an integral part of the sustainability of an organisation, be it a profit or not-for-profit organisation.”

She believes: “For an organisation to have a thriving integrated risk management discipline, the risk function ought to sit outside management reporting lines and ought to report into the audit and risk committee. Also, it should have a dotted line to the social and ethics committee. Further, a member of the risk management team should be part of the internal audit team.”

Nairobi-based risk manager Duncan IkiaraRobert says: “The modern risk manager! This term is new in various African organisation management sectors. Insurance companies have vividly adopted enterprise risk management (ERM) practices and roles.

“However, various management sectors have been left out in this growth—the African energy, agriculture, transport, construction, communication and industrial sectors need to embrace the values offered by true active ERM.” He explains: “ERM is actively involved in the management and monitoring of organisation risk functions, ie. internal audit, customer service, strategic planning, insurance, accounting, quality assurance, marketing, compliance and ethics.

“Typically, all departments are involved. To achieve the company objectives through risk control and the seizure of opportunities, the modern risk manager should be at the right hand side of the CEO operating as a CRO and should report directly to the CEO. “Indeed, African ‘chiefs’ need to sit on the same chair.”

Adebayo Adebeshin, risk manager at MTN Nigeria, agrees: “The risk manager should report to the board directly and the CEO (dotted line). On the horizontal he should also be working with the chief audit executive and the entire C-suite leaders.

“Boards, in my experience, are getting to better grips with the value. Management (especially commercial units) is still struggling with the fluid value from risk management.”

Ms Reed adds: “Risk is a continuous evolving subject matter and needs the continuous backing of the board. The board should allow for robust debates, (in a control matter), as this will contribute to an agile and resilience organisation.”

Agreeing with his South African colleagues on the evolution of risk management, Patrick Gitau, Head—IT Risk Management at Equity Bank Limited in Nairobi, says: “As part of corporate governance and strategic imperative, enterprise risk management has been rising to become one of the top three management issues worldwide. Organisations are today, more than

On board?

Debate also raged as to whether risk managers should have a seat on the board or sit outside the organisation and act more like a consultant to the board. Some see this as a good solution, particularly for businesses that do not have large back office teams to support the operation.

By sitting outside, others agreed that the risk manager is able to have oversight of all areas without being accused of interfering.

But Ian Clegg, Manager: Integrated Risk Management Services at Anglo American, disagreed, saying: “I think you need to be in the organisation itself to tap into information flows, although risk management services are supplied by a centralised function outside the business unit.

“You need to be able to pick up scraps of information that can be fed back to the board and inform their decisions.”

Ms Games agrees but adds: “Wherever you sit within the company, the critical thing is to have the ear of the board.

Mr Clegg says: “Boards are starting to ask questions. Our exco and audit committee are starting to say ‘we want more than lists of risks with ratings, we want to understand what the consequences might be if these risks turn into events’. These are the kind of conversations we are having right now.”

However, they all agreed it is ‘horses for courses’

ever before, recognising the need to understand the big picture of risks being taken when seeking to achieve objectives and attain the desired level of reward.”

He believes, like many others surveyed, that risk management has benefited from the global financial crisis of 2008, because: “Since then, global enterprises are increasingly becoming aware of the cost of the wrong risk culture, thus making enterprise risk management a top governance issue.”

Wide reach Like others, Mr Gitau believes one of the most important lessons is that a strong risk culture should permeate all levels of an organisation.

“As a starting point, it’s important to realise that risk culture should affect everyone,” he says.

“Secondly, and bearing in mind the increasing regulatory expectations and standards especially in the financial services sector, capability to deal with whole risk exposure and right risk culture building have marked a turning point in rethinking the risk management role of an organisation’s success or failure,” he stresses.

All the risk managers surveyed agreed that the tone from the top was crucial. Again, it was the risk managers in South Africa who expressed most concern that some organisations are still failing in this, regarding risk management as a tickbox exercise.

Terry Booysen, CEO of CGF Research Institute, warns: “I think risk managers are seen as prescribed officers for regulatory purposes. If he or she is not doing their job and informing the board it can cause incredible damage.”

He suggests risk managers need to recognise their responsibilities within the organisation and says they are effectively directors because of the impact of what they do—or not do.

Mr Gitau suggests: “To promote a strong tone at the top, management at all levels should receive risk management education and training, follow the risk management policies of the company and analyse decisions considering the company’s official risk policies.”

Jacob Njeru, Finance Director and Company Secretary at Nampak, adds: “Risk must fit the business economic model and hence its positioning depends on the interface with key platforms of productivity and liquidity streams.

“If these platforms have assimilated risk as part of their processes, then risk will be more of a compliance function, informing the board of areas that need attention. In a new business model, risk becomes part of board decisionmaking. Risk dimension must continuously bring value, defend or unlock value to be relevant.”

Mr Gitau says that risk culture should also extend outside the organisation to third-party suppliers and partners to help ensure third parties are managing risks within guidelines or meeting their own risk standards.

One suggestion he makes is that: “Organisations can also incorporate risk in the hiring process by gaining a sense of if candidates will fit into the company’s risk culture. A strong risk culture in an organisation means that employees know what a company stands for, the boundaries within which it can operate, and that they can openly discuss which risks should be taken in order to achieve the company’s longterm strategic goals.”

All the risk managers agreed having the ear of someone on the board was essential if they are to add most value to the business, but Mr Njeru adds a note of caution: “Boards understand risk but the risk voice depends on a sustainable commercial model—risk industry and professionals must keep that in mind.”

14

CRA-SR-RF-Africa-2015.indd 14

14/5/15 13:41:04

[AFR I CA S U RVE Y | 2 0 1 5] [ ASSOCIATIONS]

Having a local voice key for risk managers Being able to share experiences and to have a stronger united voice are just two reasons why risk managers would like to have good local risk management associations, according to the risk managers contributing to the Risk Frontiers-Africa survey

T

HERE IS AN OVERWHELMING SENSE THAT

the risk managers surveyed would prefer to have the option of local qualifications that have recognition worldwide and which dovetail with other qualifications.

Outside of South Africa, risk managers are faced with choosing between various US and European qualifications rather than domestic ones. Risk managers across the region say they would like to see risk management qualifications developed in their local markets, delivering education that will answer local dilemmas.

However, as South Africa has proved, to achieve local qualifications there needs to be a strong academic system, with a suitable curriculum or a strong local association that can build those kinds of qualifications.

In Kenya, there are moves to develop an association.

In the past year, risk managers have reiterated their desire to develop a formal group. Risk managers say they do meet informally. Monica Arita, Risk Manager at GA Insurance, for example, has a group of seven risk managers who meet and talk on an irregular basis, while Hillary Wachinga, Risk Manager at Kenya Re, also has a group of risk managers who meet on an infrequent basis.

The Kenyan risk managers say they are missing representation at all levels as a group, so any new body MTN Nigeria, says: “I know there is a risk managers’ should have the capability to be able to represent the association in Nigeria and I have spoken at one of profession at government discussions and elsewhere. their events. It is a good organisation. [But] for me, They need engagement between the sector and the challenge with that is it evolved from a credit risk government and, importantly, they need people to understand exactly what risk management is about. By association, which is majorly focused on banking. I have forming an association, the hope is that the concept of worked in the banks too but I believe the ecosystem is risk management would gather momentum and there bigger than the banks and so is risk management. It would be increased awareness among companies more should be enterprise-wide, private and public sector and, generally, which in turn would help risk managers evolve in fact, personal life.”

Instead of using Riman, he says: “My immediate and and mature in their profession. wider work teams and other specialist Too often, according to the risk risk management teams across my managers, they are working alone in silos so being able to discuss general issues and company are a good risk management forum for me. Apart from the enterprise concerns with likeminded people would risk management Unit itself, we have be a huge advantage. specialities in business continuity; Some of them say the focus today is Top 10 most likely risks from SHE; crisis management; information too much on financial and compliancethe Irmsa Risk Report 2015: security risk management; insurance; driven risks but an association would 1. Corruption fraud risk management; subscriber fraud hopefully clarify the scope of a risk 2. Unemployment manager and help risk managers investigations; and internal audit.”

3. Infrastructure demonstrate the broad role within their Mr Adebeshin says the local affiliate 4. Political and businesses. of the Institute of Internal Auditors social instability is “fertile ground also for risk-related Having an association would also give 5. Organised crime discussions” and he is “very involved with risk managers a collective opportunity 6. Cyber attacks the Institute in Nigeria”. to challenge regulators, before new rules 7. Financial mechanism He adds: “I know of a few certificate are introduced. And it would give them 8. Income disparity holders of the IRM UK here in Lagos a voice in influencing decisions and 9. Urbanisation and we have toyed with a Lagos Forum providing a different approach.

10. Data fraud of the IRM UK members or certification Another benefit, according to the holders.” workshop delegates, would be that an He believes in the power of local association would allow risk managers to organisations: “Yes it is a good idea. Question is—should challenge the insurance markets more often, again the it be an affiliate of a world-renowned risk organisation collective voice being more powerful than the lone risk or a homegrown association? For certification focus, manager. world-renowned organisations will sell faster. For true Nigeria local content, risk discussion and focus on knowledge Risk management associations do exist in Africa—in share instead of certification, a local organisation will be Nigeria and South Africa. The Risk Managers perfect. As in most cases, a balance between the two will Association of Nigeria (Riman) has regular training be fine. sessions and each July holds an annual conference, “I do not think a standalone for a market is going with this year’s theme being ‘Governance & Risk to add a lot of value. An ideal risk organisation should Management: the Way Forward’. be a platform for cross-industry risk discussions. Risk The risk managers surveyed for Risk Frontiers-Africa management associations with industry silos can also say they are aware of the Association but say it has get too technical and narrow (although deep) leaving been born out of the banking sector and they are not ecosystem issues such as economy, terrorism and politic, convinced it is appropriate for them. corruption and so much more out of their scope.”

For example, Adebayo Adebeshin, Risk Manager of Adewale Adeniyi, Compliance Officer at Meristem

BY THE NUMBERS

Wealth Management, agrees wholeheartedly that the mix of local and international is a good idea, while Adewale Gbenga Akinwale, Head, Enterprise Risk Management at Nigerian Aviation Handling Company, and winner of the Risk Manager of the Year title at the Nigerian Risk Awards 2014, stresses the importance of being able to share ideas with like-minded colleagues.

Associations, he says, “are a fantastic base” and provide an opportunity to converse with someone from outside the business. “I attended a course just to see what other people are doing and to see whether what I am doing is right. I had to start from scratch in my business and meeting with others gives me confirmation that I am doing the right things.”

South Africa Across the survey, South African risk managers applauded the new exam and certification system being introduced by the Institute of Risk Management South Africa (Irmsa). Reginald Haman, South Africa based Executive Head: Risk & Assurance, Royal Bafokeng Platinum, is among those who are delighted to see the new qualifications. “There is a big need for both exams,” he says. “There are 8,000 members who need a risk management qualification. Very few people have done anything.”

Like Mr Hamam, Cape Town-based Antonella da Cunha welcomes the exams and the fact that two levels have been designed to appeal to people at different stages of their career. The risk managers agree the exams give young risk managers clearly defined goals on which to develop a career path as well as providing affirmation to those already working in the sector.

Irmsa also holds an annual conference, an awards dinner and regular training sessions for risk managers throughout the year.

Last year, the Institute moved into new headquarters in Johannesburg, complete with in-house training facilities. This year it published the first of what will become an annual risk report, looking at the issues facing the sector and the macro reasons that lie behind the challenges.

For the future, Irmsa has stated that it wants to become the voice for risk managers across southern Africa and to work more closely with risk management groups worldwide, such as the Federation of European Risk Management Associations.

15

CRA-SR-RF-Africa-2015.indd 15

14/5/15 13:41:05

CRA-SR-RF-Africa-2015.indd 16

14/5/15 13:41:05