• Establishing the context includes determining key objectives, key stakeholders and their interests, and considering all external and internal factors (from cultural and perceptual to regulatory and global)
• Identifying the risk entails establishing both source and cause, and evaluating all possible consequences
• Analysing risk – what does this mean for our objectives?
• Risk evaluation encompasses determining the risk rating (by severity, exposure and frequency) using standard Implats tables, identifying controls (existing or new) and prioritising risks
• Treating risk requires considering all options to establish the most appropriate response for every risk identified (avoid, change probability of exposure and/or frequency, transfer, retain)

Ongoing review ensures the risk plan remains relevant.  Factors that may affect consequences and the likelihood of an outcome, and the factors that affect the suitability or cost of treatment options may change.  Implats therefore repeats the risk management cycle regularly.  All information is captured into a group risk repository system, feeding into the group risk profile.  Risk reports are presented to the appropriate bodies and escalated as required, culminating with the Board Audit and Risk Committee and the Board.

The Board has ultimate responsibility for establishing a framework for internal controls, including appropriate risk management and good corporate governance frameworks and systems.

Implats has established key controls that focus on critical risk areas identified by line management, facilitated by risk management, assessed and evaluated by the internal audit function.  Every critical risk and control, as well as any associated tasks, have a designated line management ‘owner’. The controls are designed to provide a cost-effective assurance that Implats’ assets are safeguarded and that liabilities and working capital are efficiently managed.  Established organisation policies, procedures, standards, guidelines, structures and delegation frameworks provide appropriate levels of direction, accountability and segregation of responsibility, which facilitate shelf-checking and monitoring mechanisms.  Internal audit, in partnership with senior management, monitors these control and risk management procedures.