Risk Register Template South Africa

Standard Operating Procedure: South African Regulatory-Aligned Risk Register Implementation

Document ID: SOP-TR-ZA-RR-042
Effective Date: October 24, 2023
Version: 2.1.0
Review Cadence: Annual / Post-Regulatory Amendment

---

1. Executive Summary & Purpose

This Standard Operating Procedure (SOP) defines the institutional framework for establishing, maintaining, and auditing a Risk Register tailored to the South African regulatory landscape. The purpose is to ensure systematic identification, quantitative assessment, and mitigation of operational, financial, and legal risks in strict compliance with the Companies Act (No. 71 of 2008), King IV Report on Corporate Governance, POPIA (Protection of Personal Information Act No. 4 of 2013), and OHS Act (Occupational Health and Safety Act No. 85 of 1993). Adherence to this protocol is mandatory for all capital projects and operational divisions.

---

2. Scope & Prerequisites

2.1 Scope

Applies to all legal entities, joint ventures, and operational subsidiaries operating within the Republic of South Africa under the governance of Template Registry.

2.2 Prerequisites & Tooling

• Software Environment: Microsoft Excel 365, Google Sheets Enterprise, or ISO 31000-certified GRC (Governance, Risk, and Compliance) platforms (e.g., Archer, ServiceNow).
• Mandatory Data Inputs:
  • National Treasury Practice Notes (where applicable).
  • Current Broad-Based Black Economic Empowerment (B-BBEE) scorecard metrics.
  • Information Regulator POPIA Compliance Framework.
• PPE/Physical Access: Not applicable (administrative engineering control).

---

3. Roles & Responsibilities (RACI Matrix)

---

4. Step-by-Step Procedure

Phase 1: Context Establishment & Taxonomy Definition

• 1.1 Define the internal and external parameters of the South African operating environment, including provincial labor dynamics, load-shedding/grid instability impacts, and municipal infrastructure constraints.
• 1.2 Establish the Risk Evaluation Matrix scale (Likelihood: 1-5; Impact: 1-5) calibrated to ZAR financial thresholds (e.g., Low: <R100,000; Critical: >R10,000,000).
• 1.3 Map risk categories to local statutes:
  • Legal/Regulatory: Companies Act & POPIA.
  • Health, Safety & Environment: OHS Act & Mine Health and Safety Act (MHSA) if applicable.
  • Socio-Economic: B-BBEE codes and Employment Equity Act (EEA).

Phase 2: Risk Identification & Data Ingestion

• 2.1 Conduct quarterly risk-identification workshops with Departmental Risk Owners.
• 2.2 Populate the Risk Register template with unmitigated risk statements using the standard format: Condition -> Event -> Consequence.
• 2.3 Explicitly identify cross-border or foreign exchange (FX) exposure relative to ZAR volatility against USD, EUR, and GBP.
• 2.4 Document cyber-security and data sovereignty risks specific to cross-border data transfer limitations under POPIA Section 72.

Phase 3: Quantitative Assessment & Prioritization

• 3.1 Calculate Inherent Risk Score: $\text{Inherent Risk} = \text{Likelihood (L)} \times \text{Impact (I)}$.
• 3.2 Evaluate velocity—the speed at which the risk can impact the organization’s solvency or operational continuity.
• 3.3 Apply risk treatment strategies: Treat, Tolerate, Transfer, or Terminate.
• 3.4 Assign measurable mitigation actions with hard deadlines and designated resource allocations.

Phase 4: Residual Risk Calculation & Monitoring

• 4.1 Recalculate Residual Risk Score post-implementation of controls: $\text{Residual Risk} = \text{Revised Likelihood} \times \text{Revised Impact}$.
• 4.2 Establish automated triggers for high-residual risks to escalate directly to the Risk and Audit Committee.
• 4.3 Archive historical risk iterations in the immutable Template Registry repository for audit trail verification.

---

5. Quality Assurance & Pro-Tips

5.1 Best Practices

• Dynamic Grid Stability Factor: Always model a minimum of 24 to 72 hours of continuous power disruption (Stage 4-8 load shedding scenarios) into operational and supply chain risk impacts.
• POPIA Audit Trails: Ensure risk register entries handling personal identifiable information (PII) mask specific data fields to prevent secondary compliance breaches during peer reviews.
• B-BBEE Alignment: Review procurement risk items bi-annually against shifting codes to avoid sudden drops in preferential procurement scoring.

5.2 Common Pitfalls to Avoid

• Static Stagnation: Treating the risk register as a static compliance document rather than a dynamic operational dashboard.
• Vague Ownership: Assigning risk accountability to generalized departments rather than named individuals (e.g., assigning ownership to "IT" instead of "Head of Information Security").
• Ignoring Localized Labour Dynamics: Failing to account for annual wage negotiations, protected strikes under the Labour Relations Act (LRA), and community unrest vectors.

5.3 Metric Thresholds

• Review SLA: 100% of open high and critical risks must be reviewed every 30 calendar days.
• Closure Rate: Minimum 85% implementation rate of designated mitigation actions prior to quarter-end reporting.

---

6. Frequently Asked Questions (FAQ)

Q1: How do we handle currency volatility risks within standard ZAR financial impact bands?
A: All foreign-denominated liabilities or procurement costs must be converted to ZAR using the daily closing rate provided by the South African Reserve Bank (SARB) on the date of risk assessment. Threshold bands should be adjusted annually to account for baseline inflation (CPI).

Q2: What is the mandatory legal retention period for historical risk registers under South African law?
A: In accordance with the Companies Act (No. 71 of 2008) and King IV governance guidelines, risk registers, mitigation logs, and associated audit trails must be retained for a minimum period of seven (7) years to satisfy statutory and tax audit requirements.

Q3: How should occupational health risks under the OHS Act integrate with enterprise risk registers?
A: Safety incidents and hazard logs generated under OHS Act Section 8 (General duties of employers to their employees) must feed directly into the enterprise register as sub-tier operational risks if their potential severity reaches category 4 or 5 financial/operational impact.