RISK MANAGEMENT FRAMEWORK
EXECUTIVE SUMMARY
DusuPay like any other business faces or likely to face challenges/risks when carrying out its operations. The challenges range from system failures, human error to customer complaints on service delivery to which solutions are timely sought to ensure customer satisfaction, which is key to business survival. The company has mechanisms in place to anticipate, identify and manage risks from time to time.
This Policy makes reference to and borrows from the DusuPay Anti money- laundering policy and aims to put in place adequate controls and systems so as to avoid or limit risks of DusuPay being used to facilitate financial criminal activities or otherwise.
Risk Governance
-
- DusuPay has in place a robust organization structure that ensures that both actual and potential risks are contained to minimize the impact on the business.
- At the helm of the structure is the Board of Directors with vast experience in digital finance, Fintech, management and leadership as reflected in the company profile. This level provides oversight to the business including decision making through the different board committee; Finance and Operations that convene on a quarterly basis to which key issues of concern to the business are presented and decisions made.
- At the operational level, there is the CEO who provides direction to the day-to-day operations of the business. The CEO along with the Finance Manager authorizes all decisions related to movement of funds to or from the different accounts of the company.
- Competent teams under the function of Information Technology, Operations, Finance, Marketing & Sales and Human Resource support the CEO. The teams play different roles in the DusuPay business processes
-
Risk Identification
- Given the uncertainty about when the risks associated with the operations of DusuPay will materialize, it becomes key to have the risks proactively identified for awareness and determination of action plans. The mechanisms for identification are customer feedback/complaints, analysis of business reports, system failure alerts, observation and customer satisfaction surveys. The risks identified are but not limited to the following:
- System Failures i.e., downtime, scalability/capacity;
- Customer Complaints leading to reputational risk and customer attrition;
- Breach of partnership terms and conditions giving rise to Legal Risk;
- Non-compliance to regulatory, statutory and best practice requirements;
- Fraud through system compromise/hacking;
- Third Party Risk i.e., interdependencies (Telecoms, Merchants);
- Staff knowledge/skills gaps i.e., reconciliation, settlement;
- Competition.
- Given the uncertainty about when the risks associated with the operations of DusuPay will materialize, it becomes key to have the risks proactively identified for awareness and determination of action plans. The mechanisms for identification are customer feedback/complaints, analysis of business reports, system failure alerts, observation and customer satisfaction surveys. The risks identified are but not limited to the following:
-
Risk Measurement & Assessment
- It is important to have a full picture of the anticipated risks to a business by assessing the probability and impact for better determination of the prevention or recovery strategies. Below is an assessment of the risks to DusuPay based on the Probability and Impact Criteria Matrices that follow;
| Risk Description | Probability of Occurrence | Financial Impact | Non-Financial Impact | Overall Risk Rating |
| 1. System Failures | Customer Attrition | |||
| 2. Customer Complaints | Reputation damage | |||
| 3. Legal Risk | Litigation costs,
Reputation damage |
|||
| 4. Compliance Risk | Sanctions/Fines,
Loss of stakeholder confidence |
|||
| 5. Fraud Risk | Reputation damage | |||
| 6. Third Party Risk | Loss of stakeholder confidence | |||
| 7.Staff Knowledge Gaps | Human Errors | |||
| 8. Competition | Loss of staff to competition |
- Probability Assessment Criteria:
| Scale | Descriptor | Probability of occurrence | Explanation of Historical basis of probabilities |
| 5 | Expected | Above 60% | This is expected to occur in most circumstances. |
| 4 | Highly likely | 40-60% | This will probably occur. |
| 3 | Likely | 20-40% | This might occur at some time in future. |
| 2 | Not Likely | 10-20% | This could occur but doubtful. |
| 1 | Remote | 0-10% | This may occur but only in exceptional circumstances. |
b) Financial & Non-Financial Impact Assessment Criteria:
For Financial Impact; Consideration is on the percentage/amount of loss on income/returns/profitability or cost implication that is likely to be suffered by the business in the event that the risk materializes as reflected in the table below;
| Scale | Descriptor | Financial Impact UGX |
| 5 | Critical | Above 100M |
| 4 | High | 15M to 100M |
| 3 | Moderate | 3M-15M |
| 2 | Low | 500K to 3M |
| 1 | Minor | <500K |
For Non-Financial Impact; Parameters to consider here may include – impact on business processes & systems, reputation, staff, management and compliance requirements.
c) Overall Risk Rating Criteria:
The matrix below for Overall Risk Rating is adopted.
| Overall Risk Rating Scale | Descriptor | Description |
| 1 | Minor | A risk event that, if it occurs will have little or no impact on achieving outcome objectives. |
| 2 | Low | A risk event that, if it occurs will have a minor impact on achieving desired results, to the extent that one or more stated outcome objectives will fall below goals but well above minimum acceptable levels. |
| 3 | Moderate | A risk event that, if it occurs will have a moderate impact on achieving desired results, to the extent that one or more stated outcome objectives will fall well below goals but above minimum acceptable levels. |
| 4 | High | A risk event that, if it occurs will have a significant impact on achieving desired results, to the extent that one or more stated outcome objectives will fall below acceptable levels. |
| 5 | Very High | A risk event that, if it occurs will have a severe impact on achieving desired results, to the extent that one or more of its critical outcome objectives will not be achieved. |
-
Risk Mitigation
- The table below reflects the actions that DusuPay will take to address the risks associated with its operations to prevent or minimize the impact upon occurrence.
-
Description Mitigating Actions By when System Downtime Initially DusuPay will be accessing the escrow account through ABSA Bank. In the event that ABSA Bank is not available for prolonged period, this will result in reconciliation problems.
Assign a dedicated account manager who will proactively provide DusuPay with account statements via email in the event the ABSA Bank platform is down. Framework to be in place before launch. Customer Complaints This could result from failure to reconcile transactions in a timely and accurate manner.
Build a robust customer service module/escalation matrix for handling customer complaints through the Bank’s existing structures. Before Launch Legal Risk; Partnership roles Partnership roles to be aligned with competitive advantage and motivation. Before Launch Compliance; Regulatory restrictions All functionalities to be performed in accordance with all regulatory requirements and best practices from both parties Before Launch Fraud Risk Fraud identification and monitoring mechanisms in place i.e. daily account reconciliation Ongoing Third Party Risk Contract/Service Level Agreement in place to define the terms and conditions of the engagement. Before Launch Staff Knowledge Gaps Staff training gaps identified and the necessary training to be provided. Before Launch
-
Risk Reporting & Monitoring
- For visibility on the operations of DusuPay, there are different reports in place both manual and automated. These are prepared according to need at different frequencies i.e. daily, weekly, monthly, quarterly and annually. The reports are available for use by the different stakeholders.
-
Assumptions
- There will be no regulatory, business strategy or policy changes during this project.
- Existing retail structure will be sufficient to support this relationship.
- The client will keep the contract with ABSA for a period not less than 3 year
-
Data Protection and Retention
- DusuPay as a Data Controller shall comply with its obligations under the Data Protection and Privacy Act, 2019 Laws of Uganda.
-
- DusuPay as a Data Controller shall archive or destroy data after 10 years upon request by the Data Subjects.
-
Risk Classification
- The Risk classification of DusuPay Users will be divided into:
-
-
- Low Risk; these are by and large nationals of a country who are not PEP’s or on any sanction list of any country or from non-restricted countries.
-
-
-
- High Risk; these are foreigners from restricted countries or people that trade with restricted countries or people that deal in high-risk businesses or PEP’s.
-
-
-
- The determination of whether or not one is a Low or High Risk will be determined at on-boarding from the additional information gathered from that individual or from the nature of transactions carried out by the DusuPay User.
-