Risk management practices by South African universities: An annual report disclosure analysis

This paper assesses risk management practices at South African universities by analyzing the extent of risk management disclosure recommended by King IV and the level of risk governance maturity. This study was motivated by #Feesmustfall disruptions, which pointed to the lack of effective risk management, preparedness for volatility and increased scrutiny by stakeholders. A qualitative content analysis using a risk disclosure checklist was conducted on 18 annual reports and analyzed using an exploratory research design. The results revealed that over 80% of the sampled South African universities have disclosed most of their risk management practices, showing an improved disclosure due to King IV's "apply and explain" philosophy as introduced in 2016. However, there were areas of improvement identified, such as: defining and approval of risk appetites and tolerance; development and implementation of business continuity plans; confirming the unpreparedness for volatility; annual revision of policies; and integration of risk management into the culture and daily activities of the university. This paper builds upon previous studies that highlighted a lack of detailed disclosures in South African organizations' annual reports. This study also provides interesting insights into the impact of social events on organizational practices and supports the notion that legislative accounting practices should echo stakeholders and societal expectations.