200. The risk management committee should ensure that –
(a) risk frameworks or risk methodologies are implemented to increase the probability of
identifying unpredictable risks;
(b) a systematic, documented, and formal risk assessment exercise is conducted at least
once a year;
(c) it receives and reviews a register of the company’s key risks;
(d) management regularly considers and implements appropriate risk responses which should be captured in the risk register;
(e) management demonstrates to the committee the risk responses which provide for the
identification and execution of opportunities to boost company’s performance;
(f) processes are in place for the timely and complete disclosure to the shareholders of
information on principal risks which is relevant, accurate and accessible, together with
the Board’s views on the effectiveness of the risk management processes;
(g) it receives assurance from the chief risk officer and chief audit executive regarding
the effectiveness of the risk management processes, including ensuring that the risk
management plan is integrated with the daily activities of the company;
(h) it reviews arrangements in terms of which the company’s employees may, in
confidence, raise concerns about possible improprieties in financial reporting and
other matters as more fully set out in this Code; and
(i) as part of the management team, a chief risk officer is appointed with sufficient
authority, stature, competence, resources and independence and reports functionally
to the risk committee and administratively to the chief executive officer and whose
removal from office must be approved by the Board and fully disclosed to the
shareholders.

201. The risk management committee should, at least once a year, set the levels and limits of the
company’s risk tolerance and risk appetite and more regularly review these levels or limits
during periods of increased uncertainty or adverse changes in the business environment.

202. In setting the risk tolerance levels and limits, the risk management committee should –
(a) consider risk factors in the external and internal business environment;
(b) measure these levels or limits quantitatively and qualitatively;
(c) use these levels or limits to set the parameters for the development of the company’s
business strategy; and
(d) disclose in the integrated report whether the risk appetite exceeds or deviates
materially from the limits of the company’s risk tolerance.

203. In evaluating and ranking risks, the risk management committee should be guided by the nature and size of the risk and its impact and likelihood of occurrence.

• According to the NATIONAL CODE ON CORPORATE GOVERNANCE ZIMBABWE