Cap. 10:31 Punuc (e) ENTITIES CoRPORA'I10: GovERNANCE No. 4/2018 report to the audit committee on how management has or will repair deficiencies in the system of govemance and the risk control framework. 253. The external auditors should(a) liaise with intemal audit and risk management committees on the scope and extent of coverage; and (b) report on material weaknesses in financial control and finance management systems, whether from design, implementation or execution perspectives, tlkJ.t result in actual mate1ial financial loss, fraud or material misstatements. 254. Management should-(a) coordinate the management control self-assessment exercise; (b) implement risk management processes; (c) develop a risk management policy and plan, including definitions of risk and risk management, objectives, risk approach, philosophy, responsibilities and ownership for risk management; (d) specify the elements of a control framework according to which the company's control environment can be measured; (e) implement specific risk limits and tolerances aligned with overall risk limits set by the Board; (f) promote accountability to the Board for designing, implementing and monitoting the system and processes of risk management and integrate it into day-to-day activities; (g) maintain a risk register and measure risk management perfommnce against key result indicators (KRis); (h) ensure risk responses are effective and efficient in design and operation; (i) track implementation of responses and analyse and leam from changes; (j) provide the Board with assurance that it has implemented and monitored the risk management plan; (k) demonstrate clear links between risk management and independent assurance. \VmsTLE-BLoWER Poucy ·~· 255. A whistle-blowing system that is independent, trusted and anonymou,<; is key to the effective implementation of an ethical corporate culture and fraud risk management strategy. A whistle-blower provides evidence of a waste of funds or mismanagement. 256. People blow the whistle because they have been unable to approach or to get a response from the company's management through normal lines of reporting and resort to someone else with the information they have. 257. There is a strong connection between corporate govemance and whistleblowing. 258. Whistle-blowing helps to uncover significant risks and, for this reason, procedures should be put in place to encourage honest whistle-blowing whilst at the same time discouraging malicious accusations and allegations from employees against their bosses. Recommendations 259. The board should(a) take measures to manage whistle-blowing in terms of set procedures, proper analysis of reports received and acting to correct the misconduct reported upon; 141