No. 4/2018 PtillLIC EN11TIES CoRPORATE GovERNANCE Cap.10:31 205. The whistle-blowing procedure must be documented and a copy given to every employee. The procedure must !,>ive examples of the type of misconduct for which employees should use the procedure and set out the level of proof required to sustain an allegation. 206. The risk management committee and management should identify and consider different ways in which the company can respond to the risk identified during the risk assessment process, including(a) avoiding the risks by not starting the activity that creates exposure to the risks; (b) restricting, reducing or mitigating the risks through improvements to the whole environment, such as contingency and business continuity plans. Risk treatment may include methods, procedures, applications, management systems and the use of appropriate resources that reduce the probability or possible severity of the risk; (c) tnmsfening the risk exposure, usually to a third party better able to manage the risks, for example, through insurance or outsourcing; (d) tolerating or accepting the risks where the level of exposure is as low as reasonably practicable or where there are exceptional circumstances; (e) exploiting the risks, where the risks exposure represent potentially missed or poorly realized opportunity; (t) temlinating the activity that gives rose to any intolemblc risks; (g) integrating the risk responses outlined above. lNDEPENDE!'.'T ExTERNAL AUDIT, MErHODOLOGY AND MANDATE Principles 207. A company's financial statements must be audited by independent external auditors who should assess whether the financial statements adequa.tely reflect the company's financial position using the results-based and risk-based approach. 208. External auditors must be independent in that they should have no material relationship vvith the company whose financial statements they audit. 209. External auditors prepare an audit repmt for consumption by the company, the Board, management and shareholders, as the case may be. 210. The external auditors' repmt must indicate whether the financial statements give a true and fair view of the financial position of the company and the results of the operations for the period in question. Recommendations 211. External Auditors are necessary for assessing the soundness of internal financial controls of a company and making recommendations for improvement where required. 212. The external auditors' report should state their responsibility, the scope of work performed and their opinion on the financial statements. 213. The Board and the audit committee should agree on the fees and work plan of the external auditors. 214. The audit committee should recommend to the Board the appointment, retention and replacement of external auditors. 215. In the absence of a Board, external auditors should report to the shareholders at the annual general meeting or at an extraordinary general meeting. 136