WIXLIB

TermDefinitionthe risk of a strategic, financial, or personnel loss for a firm because of such nonmarketfactors as macroeconomic and social policies (e.g., fiscal, monetary, trade, investment,industrial, income, labour, and developmental), or events related to political instability (e.g.,terrorism, riots, coups, civil war, and insurrection).Preventive ControlType of control that is designed to eliminate the possibility of an undesirable riskmaterializingProject RiskProject risks are those that could cause doubt about the ability to deliver a project to time,budget and qualityReduce/Treat/ControlResponse to a risk that can be (further) reduced by introduction of cost-effective controls.Also known as control or mitigateRemediation ControlsPlanned actions to take after a risk has materialised to manage the after effects. This couldconsist of a business continuity or disaster recovery plan (see above)Reputational RiskReputational risk can be defined as the risk arising from negative perception on the part ofcustomers, counterparties, shareholders, investors, debt-holders, market analysts, otherrelevant parties or regulators that can adversely affect an organisation’s ability to maintainexisting, or establish new, business relationships and continued access to sources offunding (e.g., through the interbank or securitisation markets). Reputational risk ismultidimensional and reflects the perception of other market participants.Residual RiskExisting level of risk taking into account the controls already in place. Also known as currentriskRiskThe possibility of an event occurring that will have an impact on the achievement of1objectives. Risk is measured in terms of impact and likelihood.Risk AppetiteRisk appetite is the aggregate level and types of risk that an organisation is willing to acceptor take to meet its strategic objectives, deliver its business plan or take advantage of anopportunity. The level of risk appetite depends on the nature and type of activities underconsideration. It is decided in advance and is intended to ensure that the organisationoperates within its risk capacity.Risk AppetiteStatement (RAS)The written articulation of the aggregate level and types of risk that an organization willaccept, or avoid, in order to achieve its business objectives. It includes quantitativemeasures expressed relative to fiscal targets, and other relevant measures as appropriate.It should also include qualitative statements to address reputation and conduct risks as wellas money laundering and unethical practices.Risk CapacityThe maximum amount of risk an organization is able to assume given its capital base, riskmanagement and control capabilities as well as its regulatory constraints.Risk ContextThe environment within which risks are being managed, both internal and external to theorganizationRisk CultureAn organisation’s norms, attitudes and behaviours related to risk awareness, risk-taking andrisk management, and controls that shape decisions on risks. Risk culture influences thedecisions of management and employees during the day-to-day activities and has an impacton the risks they assume.1Institute of Internal Auditors: International Practices FrameworkGovernment of Jamaica – Enterprise Risk Management Policy 2019Page 9

TermDefinitionRisk ExposureLevel of risk to which the organisation is exposed, that is the combination of the likelihood ofa risk occurring and its impactRisk GovernanceRisk governance refers to the institutions, rules conventions, processes and mechanisms bywhich decisions about risks are taken and implemented. It can be both normative andpositive, because it analyses and formulates risk management strategies to avoid and/orreduce the human and economic costs caused by disasters. Risk governance goes beyondtraditional risk analysis to include the involvement and participation of various stakeholdersas well as considerations of the broader legal, political, economic and social contexts inwhich a risk is evaluated and managed.Risk GovernanceFrameworkAs part of the overall corporate governance framework, the framework through which theboard and management establish and make decisions about the organisation’s strategy andrisk approach; articulate and monitor adherence to risk appetite and risk limits vis-à-vis theorganisation’s strategy; and identify, measure, manage and control risks.Risk LimitsSpecific quantitative measures or limits based on, for example, forward-looking assumptionsthat allocate the organisation’s aggregate risk to business lines, legal entities as relevant,specific risk categories, concentrations and, as appropriate, other measures.Risk ManagementA process to identify, assess, manage and control potential events or situation to provide2reasonable assurance regarding the achievement of the organisation’s objectives.Risk MapPresentation of risk information on a grid or graph, also referred to as a risk map or heatmap. It is often used to summarise the risk status of an organisation in a single diagram andis useful for reporting to senior management (see annex 4)Risk ProfileThe totality of risks faced by an organisation, considered as a whole.Risk RegisterRecord of risks, the controls currently in place, the risk score, additional controls that arerequired and responsibility for risks and control activities (see annex 5). Separate riskregisters are maintained for different aspects of organisational activities: strategic,operational, project, etcRisk ScoringRisk assessment process that analyses the likelihood and impact of a riskRisk ToleranceRisk tolerance reflects the acceptable variation in outcomes related to specific performancemeasures linked to objectives the entity seeks to achieve.Risk UniverseThe full range of risks which could impact, either positively or negatively, on the ability of theorganisation to achieve its long term objectives.Spotting ControlA control that will identify that a risk is about to occur and highlight this so that pre-emptiveaction can be takenSovereign RiskThe risk arising on chances of a government failing to make debt repayments or nothonouring a loan agreement. These practices can be resorted to by a government in timesof economic or political uncertainty or to portray an assertive position misusing itsindependence. A government can resort to such practices by altering any of its laws,thereby causing adverse losses to investors.Strategic RiskStrategic risks are long-term and/or opportunity driven and are concerned with where theorganisation wants to go, how it plans to get there and how it can ensure survival. These2IbidGovernment of Jamaica – Enterprise Risk Management Policy 2019Page 10

TermDefinitionrisks are very directly linked to the over-arching plans of the organizationTarget Risk ScoreThe level of risk that it is anticipated once all planned actions have been implementedTransferResponse to a risk that is outside the organisation’s risk appetite that can be shared with ortransferred to others, by means of insurance, contract, joint venture, partnership or similararrangementsGovernment of Jamaica – Enterprise Risk Management Policy 2019Page 11

1. Purpose and Objectives1.1.PurposeThis Policy is a formal acknowledgement of the commitment of the GoJ to effective risk management.It aims to ensure that public entities use a consistent approach to effectively manage risk, balanceexposure against opportunities with the goal of enhancing capabilities to create, preserve, and realizevalue for their stakeholders.The GoJ considers ERM to be integral to its operations as it helps to improve decision making ingovernance, strategy, objective setting and day-to-day operations of its entity. It also helps to enhanceperformance by more closely linking strategy and business objectives to both risk and opportunity. Assuch, ERM principles shall be integrated into all aspects of the GoJ’s operations - both at the strategicand operational level - to include governance, strategy, performance management, and internalcontrol.This Policy applies to all public officers and requires all employees to understand the nature of risksand accept responsibility for managing risks in their area of authority. The GoJ has adopted theinternational standard for risk management ISO: 31000 as its ERM framework.The ISO 31000 Risk Management Framework is anchored on eight principles, which are:1) The ERM strategy should be customized and proportionate to the type of organization.2) Appropriate and timely involvement of stakeholders is necessary.3) Structured and comprehensive approach is required.4) Risk management is an integral part of all organizational activities.5) Risk management anticipates, detects, acknowledges and responds to changes.6) Risk management explicitly considers any limitations of available information.7) Human and cultural factors influence all aspects of risk management.8) Risk management is continually improved through learning and experience”33Source: Institute of Risk Management (2018), “A Risk Practitioners Guide to ISO 31000”Government of Jamaica – Enterprise Risk Management Policy 2019Page 12

1.2.ObjectivesThe objectives of ERM in the GoJ are to: Enhance management’s ability to select a strategy that aligns anticipated value creation withthe entity’s risk appetite and its capabilities for consistently managing risks; Embed ERM practices within the strategy-setting and operational processes of public entitiesso that risks are consistently managed in accordance with the GoJ’s values, in a pragmaticand cost-effective way; Proactively anticipate changes to the operating environment (rather than reactively managethe outcomes) that may impact achievement of the entity’s strategic objectives and implementan effective risk mitigation strategy; and Enhance management decision-making so that it can be determined whether decisionscreate, preserve, realize or erode value for the entity.2. Enterprise-wide Risk Governance FrameworkThe GoJ has developed a comprehensive enterprise-wide framework for risk governance (the‘Framework’), which, together with culture, forms the foundation for the effective operation of ERM.Culture reflects the organization’s ethics: the values, beliefs, attitudes and understanding of risk. Itsupports the achievement of the organization’s mission and vision and the GoJ embraces a riskawareness culture, which emphasizes the importance of managing risk and encouraging atransparent and timely flow of risk information.The Framework sets out the GoJ’s enterprise-wide approach to managing risks across public entities.It comprises the following key interrelated components, which are presented in Figure 1 anddiscussed in the following sections: Defining risk, risk management and enterprise risk management – Section 2.1 Mission, vision, core values and guiding ERM principles – Section 2.2 Risk appetite – Section 2.3 Management objectives – Section 2.4 Managing Risk in the GoJ – Section 3 Enterprise-wide Risk governance structure - Section 4Government of Jamaica – Enterprise Risk Management Policy 2019Page 13

Figure 1. GoJ Enterprise-wide Risk Governance FrameworkMission, VisionCore ValuesERM PrinciplesRisk AppetiteManagement ObjectivesEnterprise-wide Risk GovernanceStructureRisk Management Process2.1.Defining risk, risk management and enterprise risk managementTermDefinitionRiskThe possibility of an event occurring that will have an impact on theachievement of objectives. Risk is measured in terms of impact and likelihood.Risk management4A process to identify, asses, manage and control potential events or situation toprovide reasonable assurance regarding the achievement of the organization’sobjectives.5Enterprise RiskThe culture, capabilities and practices, integrated with strategy-setting and itsManagementexecution that organizations rely on to manage risk in creating, preserving, andrealizing value.64Institute of Internal Auditors: International Practices FrameworkIbid6Committee of Sponsoring Organizations of the Treadway Commission (COSO) (2016). Enterprise risk management. Aligningrisk with strategy and performance (Public Exposure Draft)5Government of Jamaica – Enterprise Risk Management Policy 2019Page 14

2.2.Mission, Vision, Core Values and ERM Principles2.2.1.Mission, Vision and Core ValuesThe mission and vision of the GoJ should provide a high level indication of its risk ‘appetite’ in termsof the acceptable type and amount of risk the government will pursue to achieve its objectives. Theyhelp to establish boundaries and focus on how decisions may affect strategy. The GoJ’s strategy isaligned with its mission, vision, and core values to realize its objectives.The Head of Entity or Board and senior management have overall responsibility for the organization,including the approval and oversight of management’s implementation of the GoJ’s ERM strategy andgovernance framework. The Head of Entity or Board and senior management should set the ‘tone atthe top’ and oversee management’s role in fostering and maintaining a robust risk-awareness culture.2.2.2.ERM PrinciplesThe Framework is established on the following overarching ERM principles, which should guidedecision-making throughout the organization. Individually, each principle is equally important, andtaken as a whole, they form GoJ’s risk management philosophy. They sit alongside the operationalprinciples described in the ERM User Guide: GoJ will establish a strong and supportive tone that is communicated from the top of theorganization in support of an ethical risk-awareness culture; Management will define and establish the organization’s risk appetite in the context ofcreating, preserving and realizing value for its stakeholders; Management will ensure effective ERM practices are embedded at the strategic andoperational levels of the organization; and MDAs and public bodies will prioritize risks in order to inform decision-making and optimizeallocation of resources.2.3.Risk AppetiteAn effective risk governance framework includes a strong risk culture, a well-developed risk appetite7articulated through a Risk Appetite Statement (RAS), and defined roles and resp

To establish the Government's framework for effective risk management, the Cabinet by way of Decision #23/18 approved an enterprise-wide approach to risk management. This Enterprise Risk Management (ERM) Policy (the "Policy") sets the structure and tone for ERM within public entities.