The Main Board holds the ultimate responsibility for managing Corporate Risks, which are significant risks that span multiple entities within an organization and do not fit neatly into any single department. While the Main Board is responsible for ensuring these risks are identified and managed, it does not design or directly enforce control measures. Instead, it expects the relevant business areas to implement and monitor suitable controls. These departments, where the risks might manifest, operate controls on behalf of the Main Board. Additionally, these controls must be regularly tested and evaluated by Internal Audit and through Control Risk Self Assessment (CRSA) to ensure proper deployment .

Corporate Risks are significant risks that impact multiple areas within an organization and do not fit neatly into a single department or function. Unlike operational or departmental risks, which are typically managed within specific entities, Corporate Risks require oversight from the Main Board because they span across various functions. They involve coordinating controls from different sectors to be effectively mitigated and are few in number but have major implications if they occur. Examples include significant corporate fraud or strategy failures .

The absence of a well-communicated strategy is a Corporate Risk because it can lead to misaligned efforts, lack of direction, and inadequate response to market changes, potentially resulting in strategic drift. If adverse variances are not reported timely to the Board, it hampers the organization's ability to take remedial actions. As strategies are medium-term frameworks, failing to update them as the business environment evolves renders them obsolete, reducing their usefulness. Consequently, these gaps can lead to missed opportunities, financial losses, and diminish competitiveness .

A Corporate Risk Profile is pivotal for centralizing and effectively managing significant risks that impact multiple organizational areas. It functions as a comprehensive repository of all identified Corporate Risks, ensuring that the Main Board maintains oversight and that these risks are not overlooked or mismanaged. The profile facilitates coordinated governance by allowing for the distribution of control responsibilities across relevant business areas. This centralized approach benefits the organization by enabling strategic alignment, ensuring that mitigating efforts are harmonious and that all critical risks are monitored and managed in a unified manner, which enhances overall organizational resilience .

Regular testing and evaluation of controls over Corporate Risks are necessary to ensure that these controls are functioning as intended to mitigate significant risks that could impact the organization. This process helps to detect any weaknesses or failures in the controls that could lead to vulnerabilities. Internal Audit is primarily responsible for this task, testing each control related to Corporate Risks annually despite their limited resources. This ensures that even infrequent but critical controls receive adequate attention. In addition, Control Risk Self Assessment (CRSA) involves managers in the evaluation of these controls, promoting continuous operational oversight .

Risk Management teams are responsible for identifying Corporate Risks, determining where these risks might manifest within the organization, and assessing the adequacy of existing controls. They play a crucial role in the first three stages of managing Corporate Risks: identifying the risks, anticipating where the risks might occur, and evaluating the controls already in place to mitigate those risks. Subsequently, these teams must collaborate with Internal Audit to ensure these controls are regularly tested and evaluated, thereby supporting a comprehensive approach to risk management .

Control Risk Self Assessment (CRSA) is a process where managers of entities periodically test whether the controls in place continue to function effectively. This is crucial for managing Corporate Risks because it ensures that controls are being actively monitored within the entities where risks might surface. It provides a layer of oversight and accountability, ensuring that the deployed controls are correctly mitigating risks. CRSA complements the independent testing conducted by Internal Audit, ensuring comprehensive risk management by involving both the risk-owning departments and independent audit verification .

Assigning responsibility for Corporate Risks is challenging because these risks typically span multiple entities within an organization and do not fit neatly into any one manager’s domain. These risks require oversight from several senior executives rather than being assigned to a single entity. This can be effectively addressed by maintaining a centralized Corporate Risk Profile managed by the Main Board, with control responsibilities distributed across relevant business areas. Each area must have suitable controls in place for risks pertinent to their operations, and these controls should be regularly tested by both internal audit processes and Control Risk Self Assessments to ensure comprehensive oversight .

Internal Audit plays a critical role in the risk management of organizations by independently testing and evaluating the controls established to mitigate Corporate Risks. This includes making exceptions to their usual audit cycle to ensure that all controls related to Corporate Risks are tested annually. This diligence helps to confirm the effectiveness and proper deployment of controls, ensuring that the organization can reliably mitigate and respond to significant risks. Internal Audit’s involvement complements the Control Risk Self Assessment processes conducted by managers, providing a thorough evaluation from both internal and independent perspectives .

Risk Management and Internal Audit collaborate closely to manage Corporate Risks effectively. Risk Management is responsible for identifying Corporate Risks, analyzing potential impact areas within the organization, and assessing existing controls' adequacy. Internal Audit complements this by providing an independent verification of these controls through regular testing and assessment, ensuring that control measures remain effective over time. This synergy ensures a robust risk management framework, as Risk Management focuses on risk identification and prevention, while Internal Audit ensures control reliability and compliance through continuous evaluation .