190. The Board must ensure that –
(a) risk assessments are performed on a continuous basis;
(b) a framework or methodology is established to increase the likelihood of anticipating
unpredictable risks;
(c) management considers and implements appropriate risk responses; and
(d) risk monitoring is carried out continuously by the risk committee and management.

191. The company’s risk management policy and plan should cover –
(a) how risks are timeously identified and evaluated including methods and procedures
on how management responds to them;
(b) details of the range and type of risk control measures which may be put in place to
prevent or mitigate the identified risks; and
(c) details of how the risk management policy and plan is reviewed from time to time to take account of changes in the control environment of the company’s business.

192. The Board should receive assurances regarding the effectiveness of the risk management
processes.

193. The nature and extent of internal controls of a company depend on its size and complexity
and are informed by a cost benefit analysis.

• According to the NATIONAL CODE ON CORPORATE GOVERNANCE ZIMBABWE