253. The external auditors should –
(a) liaise with Internal audit and risk management committees on the scope and extent of
coverage; and
(b) report on material weaknesses in financial control and finance management systems, whether from design, implementation or execution perspectives, that result in actual material financial loss, fraud or material misstatements.

254. Management should –
(a) coordinate the management control self-assessment exercise;
(b) implement risk management processes;
(c) develop a risk management policy and plan, including definitions of risk and risk management, objectives, risk approach, philosophy, responsibilities and ownership for risk management;
(d) specify the elements of a control framework according to which the company’s control environment can be measured;
(e) implement specific risk limits and tolerances aligned with overall risk limits set by the
Board;
(f) promote accountability to the Board for designing, implementing and monitoring the system and processes of risk management and integrate it into day -to-day activities;
(g) maintain a risk register and measure risk management performance against key result indicators (KRIs);
(h) ensure risk responses are effective and efficient in design and operation;
(i) track implementation of responses and analyse and learn from changes;
(j) provide the Board with assurance that it has implemented and monitored the risk management plan; and
(k) demonstrate clear links between risk management and independent assurance.

• According to the NATIONAL CODE ON CORPORATE GOVERNANCE ZIMBABWE