1. Introduction
This Statement must be read in conjunction with the Risk Management Policy.
The Company operates across Australia and is head quartered in Gold Coast.
The Company is an advice business with its primary objective to build wealth, both short to long term for its clients through its network of advisers that is consistent with the financial services laws and always in the best interest of the client. It seeks to become successful both brand-wise and financially by attracting the most professional financial planners seeking a home where they can be assisted to run their businesses in a compliant and safe manner.
It does this by word of mouth, that is advisers discussing the benefits of being with this firm of professionals who have their best interest, so long as they have the best interest of the client at heart.
The Company will not tolerate conflicted or poor advice or poor practices from its advisers as anything that could draw a complaint from a client, be it wholesale or retail, will compromise the reputation of the organisation.
At the core of risk management of the advice AFSL is its Approved Product List (APL). The APL of the firm must be consistent with the premises of ‘best interest’ with any potential or actual conflicts being disclosed to the client.
The Company has a Board and a charter that requires three (3) directors who must be appropriately qualified for the role.
This Statement considers the most significant risks to which the Company is exposed, and provides an outline of the approach to managing those risks.
All decisions, strategic plans, business plans and investment plans should be consistent with this Statement.
2. Overview of Risk Appetite
The Company faces a range of risks reflecting its responsibilities to investors and shareholders. These risks include those resulting from its responsibilities in the areas of application monies, investment, security of information, financial stability and day-to-day operational activities.
These risks are managed through detailed processes that emphasise the importance of regulatory standards, professionalism, maintaining high quality staff, and accountability to stakeholders.
The Company is exposed to many serious risks, not the least of which is regulatory risks. Balance sheet risks include the maintenance of adequate deposits and liquidity in line with the Regulations.
In terms of operational issues, the Company has zero appetite for compliance risk and a low tolerance for operational errors or breaches. The Company recognises that it is not possible or necessarily desirable to eliminate some of the risks inherent in its activities. Acceptance of some risk is often necessary to foster innovation within its business practices.
3. Risk Management Framework
The Company’s risk management framework seeks to ensure that there is an effective process in place to manage risk across all its operations. Risk management is integral to all aspects of the Company’s activities and is the responsibility of all staff.
The Board has a particular responsibility to evaluate the risk environment, and through the Managing Director, has put in place appropriate controls and to monitor the effectiveness of those controls.
The risk management culture emphasises appropriate behaviours, analysis and management of risk in all business processes.
Risks are identified, assessed and managed at both an enterprise level (‘top-down’) and business’ operational level (‘bottom-up’).
The MD is appropriately qualified, has direct access to the Board, and has oversight of these processes.
The MD provides a quarterly report to the Board.
4. Coverage
Key Risks are described below:
The following table summarises the Company’s Risk Appetite by Risk.
| Risk | Appetite |
|---|---|
| Operational Risk- Information Technology - Processing | None |
| Operational Risk- Information Technology - Security | None |
| Operational Risk- Information Technology - Ongoing Development | None after production |
| Operational Risk- Internal Fraud and Corruption | None |
| Operational Risk- Operational Fraud | None |
| Operational Risk- Physical Security | None |
| Operational Risk- Compliance | None |
| Operational Risk- Information Management - Privacy | None |
| Investment Risk | Low -must be in line with client profile |
| Market | Low -must be in line with client profile |
| Liquidity | None at the AFSL level |
| Governance | None |
| Outsourcing | Low |
| Strategic Risk | Low |
| Contagion and Reputation | None |
| Statutory Reporting | None |
| Regulatory | None |
| People and Culture- Organisational Behaviour | None |
| People and Culture- Competency | None |
| People and Culture- Risk Knowledge | Low |
| People and Culture- Work Health and Safety | Low |
4.1. Operational Risk
While the Company has no appetite for Operational risk we accept that, despite risk awareness and controls being in place that Operational errors/breaches will occur. The tolerance for specific operational risks is detailed below. Risks are reviewed and analysed in all operational activities, including the development and understanding of cost/benefit to ensure that the benefit of the risk control measures exceeds the costs of those measures.
(i) Information Technology
Information Technology (IT) risks cover both daily operations and on-going enhancements to the Company’s IT systems. These include:
Processing – Prolonged outage of a core system: The Company has a very low appetite for risks to the availability of systems which support its critical business functions including those which relate redemptions and applications. Comprehensive redundancy strategies are in place and systems can easily be accessed anywhere in the world. Even so, and although not ideal, manual workarounds are possible in these two areas.
Security – Cyber-attack on Company systems or networks: The Company has a no tolerance for threats to its assets arising from external malicious attacks. To address this risk, the Company aims for strong internal control processes and has robust technology solutions provided by our vendors.
Development: The implementation of new technologies creates new opportunities, but also new risks. The Company has a low tolerance for IT system-related incidents which are generated by poor change management practices.
(ii) Internal Fraud and Corruption
The Company has no appetite or tolerance for any fraud or corruption perpetrated by its staff or Officers. The Company does not handle client monies and insists that all fees and or commissions payable by the client or institutions are paid directly into the Company’s fees trust account for reconciliation.
The Company takes all allegations of suspected fraud or corruption very seriously and will respond fully and quickly.
(iii) Operational Fraud
The Company has a very low tolerance for Operational Fraud. This includes transaction, internet or any other forms of external based fraud.
The Company implements current industry base technologies and controls to mitigate fraud attempts.
(iv) Physical Security
The Company’s objective is to provide a highly-secure environment for its people and assets by ensuring its physical security measures meet high standards. The Company has no appetite or tolerance for the failure of physical security measures.
(v) Compliance
The Company is committed to a high level of compliance with relevant legislation, regulation, industry codes and standards as well as internal policies and sound corporate governance principles. Identified breaches of compliance will be remedied as soon as practicable as laid out in its Issue and Breach Policy. The Company has no appetite or tolerance for deliberate or purposeful violations of legislative or regulatory requirements.
(vi) Information Management and Statutory Reporting
The Company is committed to ensuring that its information is relevant, accurate, timely, and, properly conserved and managed in accordance with legislative and business requirements. It has a very low tolerance for the compromise of processes governing the use of information, its management and publication.
The Company has no appetite or tolerance for the deliberate misuse of its information.
4.2. Liquidity Risk
The Company has no appetite for its regulatory requirements for Liquidity Risk and monitors its cashflow monthly and reports quarterly to the Board.
4.3. Governance Risk
The Company has no appetite for Governance Risk. The Company ensures substantial structures and guidance is in place and has an appropriately qualified Board.
4.4. Outsourcing Risk
The Company has a very low risk appetite for Outsourcing Risk. The Company is a follower in outsourcing and doesn’t enter into green fields outsourcing arrangements for its core business. The Company will only enter into outsourcing arrangements for core business with substantial and experienced parties, and counterparties which preferably operate within the broader industry with like clients. The Company may outsource where the capability of the party is higher than the Company and will mitigate risks beyond those mitigants of the Company.
The Company recognises that failure to maintain a very low appetite for Outsourcing Risk may result in systemic breakdowns of governance and client funds management in the case of outsourced MDA arrangements.
4.5. Strategic Risk
The Company has a moderate appetite for Strategic Risk. The Company develops and implements strategy within its core competency capabilities only.
The Company’s strategic capability evolves around its staff and Directors but may include its ARs. The Company has a low appetite in increasing strategic risk beyond these capabilities.
The Company recognises that failure to maintain its risk appetite for Strategic Risk may result in failure to deliver it strategic initiatives and objectives which will impact on organisational stability and its reputation in the market place.
4.6. Contagion and Reputation Risk
The Company has no appetite and a very low tolerance for Contagion and Reputation Risk.
The Company has a strong governance framework, policies, procedures, systems, platforms and support schemes to reduce the likelihood and impact of contagion and reputation risk.
The Company recognises that failure to maintain a no appetite position for Contagion and Reputation Risk may result in behaviours which could reduce its ability to meet growth targets.
4.7. Regulatory Risk
The Company has no appetite or tolerance for Regulatory Risk.
The Company has a strong governance framework, policies, procedures, systems and effective monitoring processes and responsibilities to mitigate risk in relation to the oversight and management of its regulatory requirements and the relevant laws affecting the Company.
The Company recognises that failure to maintain a no appetite position for Regulatory Risk may result in outcomes which could reduce its ability to meet growth targets.
5. People and Culture Risk
The Company’s key people and culture risks include:
(i) The Company has a no appetite position for Organisational Behaviour Risk. The Company has a Fit and Proper Policy which is regularly reviewed and includes staff development reviews.
(ii) The Company has low tolerance for Competency Risk. The Company provides training through Kaplan and one on one to maintain key competencies in each position. The Company’s expectation is that all staff will maintain their competencies in their responsibilities and duties of their respective positions. This includes all senior staff.
(iii) The Company has a no appetite or tolerance for insufficient Risk Knowledge of staff in relation to their position. The Company ensures all Job Descriptions include the key risks of each position and reviews these as part of staff development reviews.
(iv) The Company has no appetite for Work Health and Safety Risk. The Company aims to create a safe working environment for all its staff, where people are protected from physical or psychological harm. It does not condone practices or behaviours that lead to staff being harmed while at work.
6. Implementation of the Risk Appetite Statement
Senior staff are responsible for the implementation of, and compliance with, this Statement.
6.1. Communication
The Company’s Risk Appetite Statement is available on request.
6.2. Risk Assessments
ABC has a Risk Register (Reference to the Risk Management Policy) of the business risks it faces in its day-to-day operations and the control framework which is in place to mitigate risks.
This Register takes into account risks from within the Company and external sources and are reviewed at least annually. The Risk Register is also updated when there are key changes in policies, structures or functions.
Risk tolerances are reviewed annually or where there are any material environmental or operational changes.
Risk appetites are reviewed as part of the Strategic Planning process.
All risk performance is monitored by the MD, and where performance varies to the tolerance settings these matters are reported to the Board and action plans to mitigate these risks back to acceptable levels put in place and managed via the monitoring platform.
Senior Managers are delegated responsibility to manage their specific operational risks in a manner which is consistent with this Statement and appropriately escalating any risks outside appetite or agreed tolerance levels.
Senior Managers risk appetite settings for each risk in their Risk Register must also be consistent with this Statement.
6.3. Reporting & Monitoring
This Statement is complemented by other risk management and compliance objects including, Risk Management Policy, Operational Risk Policy, as well as a risk and compliance monitoring platform. Any variations outside of tolerances are managed pursuant to the Issue and Breach Management Policy and reported to the Compliance Committee and where appropriate, to the Board.
Reporting is maintained to provide assurance that the risk appetite is effectively incorporated into management decisions.
Feedback on the implementation of the Company’s Risk Appetite Statement is provided through the Senior Staff and MD.
7. Review
This Risk Appetite Statement is reviewed annually, or whenever there is a significant change to the Company’s operating environment.
This review is coordinated by the MD. Proposed changes to the Risk Appetite Statement are endorsed and approved by the Board.