Cap. 10:31 PuBuc ENnTtES CoRPORATE GovERNANCE (b) No. 4/2018 using other methods to identify and assess risks such as financial and envirmm1ental audits and hazard and operability studies. 200. The risk management committee should ensure that--(a) risk fmmeworks or risk methodologies are implemented to increase the probability of identifying unpredictable risks; (b) a systematic, documented, and formal risk assessment exercise is conducted at least once a year; (c) it receives and reviews a register of the company's key risks; (d) management regularly considers and implements appropriate risk responses which should be captured in the risk register; (e) management demonstmtes to the committee the risk responses which provide for the identification and execution of opportunities to boost the company's perform..'lnce; (f) processes are in place for the timely and complete disclosure to the shareholders of infmmation on principal risk which is relevant, accurate and accessible, together with the Board's views on the effectiveness of the risk management processes; (g) it receives assurance from the chief risk officer and chief audit executive regarding the eiTectiveness of the risk management processes, including ensuring that the risk management plan is integrated with the daily activities of the company; (h) it reviews anangcmcnts in term<; of'vvhich the company's employees may, in confidence, raise concerns about possible improprieties in financial reporting and other matters as more fully set out in this Code; (i) as part of the management team, a chief risk oftic(~r is appointed with sufficient authority, stature, competence, resources and independence and reports functionally to the risk committee and administratively to the chief executive officer and \Vhose removal from office must be approved by the Board and fully disclosed to the shareholders. 201. The risk management committee should, at least once a year, set the levels and limits of the company's risk tolerance and risk appetite and more regularly revie\v these levels or limits during periods of increased uncertainty or adverse changes in the business environment. 202. In setting the risk tolemncc levels and limits, the risk management committee should(a) consider risk factors in the extemal and intemal business environment; (b) measure these levels or limits quantitatively and qualitatively; (c) use these levels or limits to set the parameters for the development of the company's business strategy; (d) disclose in the integrated report whether the risk appetite exceeds or deviates materially from the limits of the company's risk tolerance. 203. In evaluating and ranking risks, the risk management committee should be guided by the nature and size of the risk and its impact and likelihood of occurrence. 204. The risk management committee should ensure that in addition to the control measures introduced by "SPAMSOAP labels" (Segregation of duties, Physical controls, Authorisation and approval, Management c:ontrols, Supervisory controls, Organisation as a control, Arithmetical and accounting controls, Personnel control), and depending on the demands of the company's business, additional minimum control measures such as establishing a whistle-blowing function and an audit committee which opemtes separately from the tisk committee are implemented. 135