Guest : Christelle Marais, Executive Director - Lucidum Consulting and member of
The Institute of Risk Management South Africa
It was with a confusing combination of anger, sadness, guilt and frustration that I
completed my reading of Pieter-Louis Myburgh’s ‘Gangster State’ recently:
Anger – about the disrespectful arrogance with which the dreams of millions were
stolen, while they trustingly looked on.
Sadness – over the blood, sweat and tears that made this country, built a new society
after 1994 and the blood, sweat and tears that will rebuild it again, after the capture.
Guilt – like many of my risk management colleagues, wondering if we could have done
more to prevent the rot (causes) or to uncover what was going on (consequences) as
part of our risk management effort in public and private organisations (because as
‘Gangster State’ suggests: it takes two to tango!).
And then – frustration. Ah, maybe my frustration weighs heaviest on my heart… But
frustration of the kind that would do it all over again, if someone would just listen, if
someone would just take me seriously.
While reading ‘Gangster State’ I was reminded of whistle-blower Harry Markopolos’
book ‘No One Would Listen’ about his investigation into the Madoff investment scandal
and how the US Securities and Exchange Commission failed to heed his warnings.
I was struck deeply by many who warned about what was happening in the Free State,
such as Patrick Lekota, who’s highlighting of concerns went ignored (at best) and
purposely thwarted (at worst); the Goldhawk report, with scathing findings on irregular
loans; the Auditor-General, with many reports on the lack of financial controls and
disregard for legislative compliance; Beatrice Marshoff, trying to appoint MECs that
could do the job, but instructed to appoint Ace Magashule; and Noby Ngombane, whose
efforts to implement oversight of Free State municipalities’ spending may have cost him
While I found the disregard for these warnings alarming, they awoke in me more
familiar feelings: feelings that most risk managers would know all too well.
-Irritation when risk management is treated as ‘compliance’ only.
-Disappointment at not being taken seriously when including real risks in my reports,
when pointing out real causes of those risks and when showing real consequences if
those risks were to materialise.
-Disempowerment when the accountabilities that my risk management framework
seeks to ensure, are negated and not keeping organisational role players to account, are
-Despair when my risk reports are changed, redacted, reduced (or worse, just not
submitted) because they include things that would make my leadership uncomfortable.
-Marginalisation when I realise that I am purposely excluded from key discussions,
because my reason for existence in my organisation may expose things that would
rather be kept hidden.
-Dismay if there is no effort by my leadership to understand what ‘risk appetite’ is and
how the continued disregard of the impact of wrong decisions can destroy us.
But most of all, exasperation when my reports are ‘NOTED’ by my governing body only
to be regarded as having failed to convey the message, when things go wrong.
As I read, I wondered what Madiba and Thabo Mbeki would say about the fact that they
wished away the warnings, tip-toed around the issues and bowed to public and party
pressures (diplomatically trying to keep a fragile governing system stable, but creating
huge future problems for many people, not least of which is the legitimacy of
I reflected back on minister Pravin Gordhan’s question at IRMSA’s 2018 Conference to
risk managers: ‘How did you miss state capture?’ And I felt like asking: ‘How did you not
hear us when we spoke out?’
Perhaps my message today is not so much to risk managers, as it is to leaders in all
spheres of our economy (public, private, non-profit organisations, and civil society); to
these executives, directors, society leaders, political heads and parliament, please
• take risk management seriously;
• understand that operating within ‘risk appetite’-levels when pursuing an ‘ethical
culture’, ‘legitimacy’, ‘good performance’ and ‘effective control’ will help organisations
• enable your risk managers, include them in key decisions; they may be the only ones
able to integrate all risk related information across your entire organisation so that you
can take informed decisions; and
• heed warnings that expose risk of wrongdoing; from the Free State to Steinhoff, it is
clear that organisations can on. To fail in risk management, is to fail our country, its
economy and its people.