No. 4/2018 PuBLIC E:-.:TITIES CoRPoRATE GovERNANCE Cap.l0:31 (b) details of the range and type of risk control measures which may be put in place to prevent or mitigate the identified risks; (c) details of how the risk management policy and plan is reviewed from time to time to take account of changes in the control environment of the company's business. 192. The Board should receive assurances regarding the effectiveness of the risk lTh'lnagemeut processes. 193. The nature and extent of internal controls of a company depend on its size and complexity and arc informed by a cost benefit analysis. Recommendations 194. The Board should(a) determine the levels of risk tolerance and the nature and extent of significant tisks it is willing to embrace in achieving its strategic objectires; (b) determine whether or not it is desirable to establish a risk management committee to assist it in carrying out its 1isk related responsibilities or in fonnulating such conunittee's terms of reference or reviewing and monitoring the committee's perfmmance; (c) formulate, implement and revic\\' the company's lisk management policy and plan; (d) integrate the company's risk policy and plan into the day to day activities of the company. 195. The Board should ensure that processes are established to foster the complete, timely. relevant, accurate and accessible risk disclosures to the shareholders. 196. The Board may, if deemed desirable, appoint a risk management committee to assist it in the discharge of its duties and responsibilities in respect of risk management. 197. The risk management committee's responsibility should be clearly set out in its terms of reference, which must deal with the scope of its mandate, its composition, roles and duties and include provisions to the effect that(a) the risk management committee comprises executive and non-executive directors, with the latter being in the rnajority, who should all be persons with adequate risk management skills and experience; (b) the risk management committee may supplement its risk management skills and experience by inviting independent management experts and senior management personnel responsible for the various aspects of risk management to attend its meeting; (c) the risk management committee should be composed of at least three Board members and should meet every quarter of the company's financial year, preferably before every quarterly Board meeting. 198. The Board should evaluate the risk management committee's performance in terms of its mandate and effectiveness. 199. The risk management committee should, as its main ftmction, consider the risk management policy and plan of the company and monitor, evaluate and reconunend an1endments to the risk management processes, procedures, policies and implementation strategies, including- (a) identifying key pdncipal risks through appropriate risk assessment, survey and mapping strategies and procedures which may use data analysis, business indicators, market information, loss control, scenalio plamting and p01tfolio analysis, threats to various income streams, critical business processes and dependencies of the business, sustainability dimensions of the business and expectations of stakeholders; and 134