Risk management programme

ARM’s well established and proactive risk management processes underscore ARM’s commitment to comprehensive and effective risk management at all levels. ARM recognises that integrating risk management philosophy and practice into its culture is an on-going process which, in order to be effective, must be a continuous, dynamic and developing endeavour that addresses risks and opportunities across the spectrum, from those associated with strategy and its implementation, to operational, legal, social, ethical and reputational risks and opportunities.

The Board tasks the Audit Committee with oversight for risk management. In view of the importance of this function, the Audit Committee has established a management sub-committee, the Management Risk Committee (MRC), to assist it to manage and report on risk management processes and procedures. The MRC is chaired by the Chief Executive Officer and its members include chief executives of divisions, the Financial Director, the Leader: Risk Management and various members of the ARM Steering Committee.

ARM Risk Management has championed integration of risk and assurance processes over many years. This integrated approach not only assists in providing assurance and appropriate corporate governance compliance, but also provides a practical and effective tool for the management of risk within ARM.

Reporting on the implementation, co-ordination and monitoring of ARM’s risk management policy, programme and approved annual Risk Management Plan takes place at operational, divisional and at MRC meetings on a quarterly basis.

The structure of reporting on risk management within ARM has been developed and formalised to ensure that the process remains dynamic, is consistant, comprehensive and allows for constant review and refining.

A Risk and Control Dashboard system provides a focused approach to the monitoring of the control effectiveness of risks and processes in order to ensure that risks are managed within approved levels of tolerance and appetite and so that the process of continuous improvement is facilitated.

The functional reporting areas and objectives, set out below, are as follows:

Risk Register/Enterprise Risk Management (ERM)

Ensures that a robust system of identifying, quantifying, monitoring, managing and reporting risks and opportunities is applied consistently throughout the Company.

The ERM Framework and the Internal Control and Enterprise Risk Management Policy (the ‘ERM Policy’) govern the ERM process and, inter alia, ensure that the external consultants, to whom the internal audit function is outsourced, assist in the facilitation of the following activities at least annually:

• Identifying and recording risks and opportunities;
• Establishing the likelihood of them occurring;
• Ensuring the appropriate controls are in place;
• Assessing the effectiveness of controls;
• Taking appropriate action to reduce the likelihood of loss; and
• Taking appropriate action to mitigate against the possible extent of loss.

A schedule of Principal Risks, Challenges and Opportunities for ARM is included in the Quarterly Risk Managers' Report and reviewed at the MRC and also at Audit Committee meetings. The Quarterly Risk Managers' Report also include specific referance to change in the risk profile and emerging risks.

The internal auditors also periodically review the ERM Framework and the ERM Policy to ensure these remain current and compliant with the terms and spirit of King III as updated from time to time. Corporate Governance continued The internal auditors use the risk registers to ensure the annual Internal audit plan covers the high-risk areas identified. The risk register is regularly updated throughout the Company.

The co-ordinated and integrated approach towards risk management and assurance has enabled ARM to develop and implement a combined assurance model as a natural progression of the ERM Framework. Considerable work has been undertaken during the financial year to identify the extent and relationship between internal and external assurance model to ensure a practical and effective management assurance tool. This process will progressively continue.

Physical risk management

Ensures that physical risk grading, risk improvement and other risk controls are appropriate, and maintains and enhances performance against agreed international risk standards.

While operational management remains accountable for risk manage ment, external consultants assist with identifying risk, rating and benchmarking risk performance, and providing recommendations to improve risk preparedness and to address any potential lossproducing events. This is done by measuring the performance of each operation against ARM’s Balanced Scorecard. The Balanced Scorecard measures the quality of risk management (control effective ness) at individual operations, expressed in rating percentages, and provides a risk profile for each operation.

ARM’s objective is that all its operations achieve an 80% overall performance rating against the international risk management standards contained in the Balanced Scorecard.

ARM also benchmarks its risk preparedness against some 400 mining operations worldwide, rated by International Mining Industry Underwriters (IMIU). The majority of ARM’s operations are rated in the top quartile of worldwide operations rated by IMIU.

Risk financing and insurance

Ensures that ARM's risk financing and insurance programmes are comprehensive and adequately protect the Company against catastrophic risk.

Continuing improvement in ARM’s risk profile as a result of focused risk control initiatives ensure that cost-effective risk financing and insurance programmes are in place to avoid or reduce adverse effects on financial results and Company performance.

Governance and Risk: monitoring new developments

Ensures that the risks arising from new developments in ARM’s operating environment are considered on an on-going basis.

ARM’s risk management department constantly monitors risk issues that stem from new developments, such as non-compliance with changes in corporate governance requirements or codes of practice, to ensure that risk management within ARM remains relevant.

Risk and Control Dashboards are now consistently used at divisional and ARM Audit Committee forums, providing a consistent and measurable management assurance metric on the control effectiveness of a broad spectrum of risks and processes.