David Cullinane (Waterford, Sinn Fein) | Oireachtas source

This review showed there were difficulties around the risk strategy not being defined, inadequate governance and assurance of risk management activities and inadequate risk identification, monitoring and reporting. There was also detail on the rating and implication, grade 2, that the risk strategy or risk appetite of the institute was not well understood and that decision-making may have been suboptimal. The review said that the institute could take on excessive risk to the detriment of the achievement of its long-term strategic goals. It said that irregular review of the risk management framework set up by the governing body did not create a stable risk landscape and that it was without focus from the top in terms of risk management, including maintaining the risk register, overseeing progress of remedial actions and reporting to the governing body. It made an interesting point that insufficient feedback from the governing body and a lack of awareness within the institute of the purpose of the risk register could result in a lack of buy-in. The review also said that without capture of assurance of peak controls, the executive audit committee and governing body were not provided with adequate assurance as to whether risks were adequately managed.

I read the KPMG report, which is heavily redacted for us so it is difficult to get a full capture of its contents, something we discussed this before. Notwithstanding what that report said and the witnesses' view, there was the subsequent review in 2016 by PricewaterhouseCoopers that identified failings in risk management. Is this correct?