Ombud Council AR 2026

PART C: GOVERNANCE

Table 13: Principal Risks and Mitigation

Residual Risk Rating (as at Q4 2025/26)

Strategic Priority Risk Description

Key Mitigations

Conservative spending approach from Sept 2025; monthly cashflow projections; retention of prior year surplus as contingency; engagement with NT and FSCA to align levy approval timelines. Fully capacitated lean structure (8 / 8 posts filled); crisis succession planning; competitive remuneration; cross-training. ISO 27001aligned controls; multi-factor authentication; annual penetration testing.

Insufficient cash flow (liquidity risk) due to timing of levy receipts Loss of key skills and competencies (key person risk)

Low (Closed out due to fully effective controls implemented)

Medium (Within Appetite)

1. Maintain a well governed and effective Ombud Council

Cyber incident or compromise of information

Low (Within Appetite)

N/A. Risk closed out earlier in the year due to effective controls implemented.

Non-compliance to financial management policies

Risk Closed.

Non-compliance incident

Medium (Within Appetite)

Integrated GRC reporting; quarterly compliance reports to ARC; mandatory staff training.

2. Promote consumer

High (Within Tolerance – accepted) Risk materialised and subsequently closed out

Not delivering baseline study on consumer awareness

Participation in FSCA researcher panel; RFP issued in Q3; project deferred to FY2026/27 with Board approval. Ongoing engagement with NT technical task team; consultations on Financial Ombud System Amendment Bill.

awareness and usage of ombud system 3. Ombud system reform

Unexpected changes in mandate or delivery expectations

Low (Within Appetite)

• Integrated Risk Profile Evolution throughout the year (2025/26): • Quarter 1: Two risks breached risk appetite; one of these risks (liquidity) also breached risk tolerance. • Quarter 2: Liquidity risk reduced to breach of appetite only; key person risk mitigated to medium; financial mismanagement risk closed out. • Quarter 3: Liquidity risk remained in breach of appetite; consumer awareness baseline study moved into breach of appetite (accepted). • Quarter 4: All risks brought within risk appetite, except the baseline study which was brought within tolerance but remained outside of risk appetite (formally deferred to the following financial year). Liquidity risk closed out at year end. Risk related to baseline study materialised at year end and therefore subsequently closed out. No risks breached the Council’s risk bearing capacity at any point during the year.

• Integrated Risk Response Plans and Progress The Board approved formal risk response plans for all risks that breached appetite or tolerance. Notable progress includes: • Liquidity risk: The Council formally implemented a conservative expenditure management plan from 1 September 2025, pausing all non‑committed consumer awareness projects and other non committed expenditure. Levy payments began flowing from the FSCA by 31 January 2026, stabilising the cash position. The Council retained the prior year’s cash surplus of R18.6 million as a contingency fund with National Treasury approval. • Key person risk: All eight funded posts on the lean organisational structure were filled. A crisis succession plan to ensure continuity in the event of departure of any Exco members was developed.

Ombud Council 2025/26 Annual Report

52