COMPLIANCE ASSESSMENT AND TRACKING TOOL (CAT-T ) MANUAL FOR THE COMPLETION OF THE BENCHMARKING QUESTIONNAIRE

COMPLIANCE ASSESSMENT AND TRACKING TOOL (CAT-T ) MANUAL FOR THE COMPLETION OF THE BENCHMARKING QUESTIONNAIRE

Frequently Asked Questions The PASSWORD to enter the data on the database is exp2011 Q1: How long will it take me to complete the survey? A1: If you ensure that you have all the information available before you start to complete the questionnaire, it should take you about 2 to a maximum of 3 hours. We therefore recommend that you peruse the questionnaire and collect all the information before you commence with the capturing. For ease of reference, the questionnaire is attached in PDF format. However, please note that the submission of your survey responses can ONLY be done through the link. No paper based copies will be accepted. Q2. Can I leave the survey and resume it later? A2: Yes, but please take note of the following requirements: If you accessed the survey through a web link - then If you exit the survey early, you must come back to the same computer and use the same browser in order to pick up and finish. NOTE: Cookies must be enabled. The cookie placed by us tracks the page where a respondent exited. If the respondent's browser is set to dump cookies each time it is closed, the cookie will be refreshed. A new or blank survey will open every time the survey is accessed. If you accessed the survey through an e-mail invitation: The URL of this option remembers where the person last clicked the [Next] or [Done] button. It does not use cookies. EX: Those who receive the invitation can begin the survey from their work computers, leave the survey early, and then re-access the link to finish on a home computer. Or they can simply access the same work computer to finish later. The URL will take the respondent to the last completed page no matter what computer is used.

NOTE: The Email Invitation option allows only ONE response due to the way the tracking system works. Q3. The progress bar does not update the percentage completion as I complete questions. A3. The progress bar calculates progress on the number of pages and not number of questions.

1) Selection of industry, super-sector, sector and sub-sector Please use the table below to select the industry, super-sector, sector and sub-sector that are applicable to your organisation. INDUSTRY SUPERSECTOR SECTOR SUBSECTOR DEFINITION Oil & Gas Oil & Gas Oil & Gas Producers Exploration and production Companies engaged in the exploration for and drilling, production, refining and supply of oil and gas products. Integrated oil & gas Integrated oil and gas companies engaged in the exploration for and drilling, production, refining, distribution and retail sales of oil and gas products. Oil Equipment, Services & Distribution Oil equipment & services Suppliers of equipment and services to oil fields and offshore platforms, such as drilling, exploration, seismic-information services and platform construction. Pipelines Operators of pipelines carrying oil, gas or other forms of fuel. Excludes pipeline operators that derive the majority of their revenues from direct sales to end users, which are classified under Gas Distribution. Alternative Energy Renewable energy equipment Alternative fuels Companies that develop or manufacture renewable energy equipment utilizing sources such as solar, wind, tidal, geothermal, hydro and waves. Companies that produce alternative fuels such as ethanol, methanol, hydrogen and bio-fuels that are mainly used to power vehicles, and companies that are involved in the production of vehicle fuel cells and/or the development of alternative fuelling infrastructure. Basic materials Chemicals Chemicals Commodity chemicals Producers and distributors of simple chemical products that are primarily used to formulate more complex chemicals or products, including plastics and rubber in their raw form, fiberglass and synthetic fibers. Speciality chemicals Producers and distributors of finished chemicals for industries or end users, including dyes, cellular polymers, coatings, special plastics and other chemicals

for specialized applications. Includes makers of colourings, flavours and fragrances, fertilizers, pesticides, chemicals used to make drugs, paint in its pigment form and glass in its unfinished form. Excludes producers of paint and glass products used for construction, which are classified under Building Materials & Fixtures. Basic resources Forestry & paper Forestry Owners and operators of timber tracts, forest tree nurseries and sawmills. Excludes providers of finished wood products such as wooden beams, which are classified under Building Materials & Fixtures. Paper Producers, converters, merchants and distributors of all grades of paper. Excludes makers of printed forms, which are classified under Business Support Services, and manufacturers of paper items such as cups and napkins, which are classified under Nondurable Household Industrial metals and mining Aluminium Nonferrous metals Iron & steel Products. Companies that mine or process bauxite or manufacture and distribute aluminium bars, rods and other products for use by other industries. Excludes manufacturers of finished aluminium products, such as siding, which are categorized according to the type of end product. Producers and traders of metals and primary metal products other than iron, aluminium and steel. Excludes companies that make finished products, which are categorized according to the type of end product. Manufacturers and stockholders of primary iron and steel products such as pipes, wires, sheets and bars, encompassing all processes from smelting in blast

furnaces to rolling mills and foundries. Includes companies that primarily mine iron ores. Mining Coal Companies engaged in the exploration for or mining of coal. Diamonds and Companies engaged in the exploration for and Industrials Construction and materials Industrial goods & services Construction and materials gemstones General mining Gold mining Platinum & precious metals Building materials & fixtures Heavy construction production of diamonds and other gemstones. Companies engaged in the exploration, extraction or refining of minerals not defined elsewhere within the Mining sector Prospectors for and extractors or refiners of goldbearing ores Companies engaged in the exploration for and production of platinum, silver and other precious metals not defined elsewhere Producers of materials used in the construction and refurbishment of buildings and structures, including cement and other aggregates, wooden beams and frames, paint, glass, roofing and flooring materials other than carpets. Includes producers of bathroom and kitchen fixtures, plumbing supplies and central airconditioning and heating equipment. Excludes producers of raw lumber, which are classified under Forestry. Companies engaged in the construction of commercial buildings, infrastructure such as roads and bridges, residential apartment buildings, and providers of services to construction companies, such as architects, masons, plumbers and electrical contractors. Aerospace & defence Aerospace Manufacturers, assemblers and distributors of aircraft and aircraft parts primarily used in commercial or private air transport. Excludes

manufacturers of communications satellites, which are classified under Telecommunications Equipment. Defence Producers of components and equipment for the defence industry, including military aircraft, radar equipment and weapons. General industrials Containers & packaging Makers and distributors of cardboard, bags, boxes, cans, drums, bottles and jars and glass used for packaging. Electronic & electrical equipment Industrial engineering Diversified industrials Electrical components & equipment Electronic equipment Commercial vehicles and trucks Industrial machinery Industrial companies engaged in three or more classes of business within the Industrial industry that differ substantially from each other. Makers and distributors of electrical parts for finished products, such as printed circuit boards for radios, televisions and other consumer electronics. Includes makers of cables, wires, ceramics, transistors, electric adapters and security cameras. Manufacturers and distributors of electronic products used in different industries. Includes makers of lasers, smart cards, bar scanners, fingerprinting equipment and other electronic factory equipment. Manufacturers and distributors of commercial vehicles and heavy agricultural and construction machinery, including rail cars, tractors, bulldozers, cranes, buses and industrial lawn mowers. Includes non-military shipbuilders, such as builders of cruise ships and ferries. Designers, manufacturers, distributors and installers of industrial machinery and factory equipment, such as machine tools, lathes, presses and assembly line equipment. Includes makers of pollution control equipment, castings, pressings, welded shapes,

structural steelwork, compressors, pumps, bearings, elevators and escalators. Industrial transportation Delivery services Operators of mail and package delivery services for commercial and consumer use. Includes courier and logistic services primarily involving air transportation. Marine transportation Providers of on-water transportation for commercial markets, such as container shipping. Excludes ports, which are classified under Transportation Services, and shipbuilders, which are classified under Commercial Vehicles & Trucks. Railroads Providers of industrial railway transportation and railway lines. Excludes passenger railway companies, which are classified under Travel & Tourism, and manufacturers of rail cars, which are classified under Commercial Vehicles & Trucks. Support services Transportation services Trucking Business support services Companies providing services to the Industrial Transportation sector, including companies that manage airports, train depots, roads, bridges, tunnels, ports, and providers of logistic services to shippers of goods. Includes companies that provide aircraft and vehicle maintenance services. Companies that provide commercial trucking services. Excludes road and tunnel operators, which are classified under Transportation Services, and vehicle rental and taxi companies, which are classified under Travel & Tourism. Providers of nonfinancial services to a wide range of industrial enterprises and governments. Includes providers of printing services,

management consultants, office cleaning services, and companies that install, service and monitor alarm and security systems. Business training & Providers of business or management training courses employment agencies Financial administration Industrial suppliers Waste & disposal services and employment services. Providers of computerized transaction processing, data communication and information services, including payroll, bill payment and employee benefit services. Distributors and wholesalers of diversified products and equipment primarily used in the commercial and industrial sectors. Includes builders merchants. Providers of pollution control and environmental services for the management, recovery and disposal of solid and hazardous waste materials, such as landfills and recycling centres. Excludes manufacturers of industrial air and water filtration equipment, which are classified under Industrial Machinery. Consumer goods Automobiles & parts Automobiles & parts Automobiles Makers of motorcycles and passenger vehicles, including cars, sport utility vehicles (SUVs) and light trucks. Excludes makers of heavy trucks, which are classified under Commercial Vehicles & Trucks, and makers of recreational vehicles (RVs and ATVs), which are classified under Recreational Products. Auto parts Manufacturers and distributors of new and replacement parts for motorcycles and automobiles, such as engines, carburettors and batteries. Excludes producers of tires, which are classified under Tires. Tires Manufacturers, distributors and retreaders of automobile, truck and motorcycle tires. Food & beverage Beverages Brewers Manufacturers and shippers of cider or malt products such as beer, ale and stout.

Distillers & Vintners Producers, distillers, vintners, blenders and shippers of wine and spirits such as whisky, brandy, rum, gin or liqueurs. Soft drinks Manufacturers, bottlers and distributors of nonalcoholic beverages, such as soda, fruit juices, tea, coffee and bottled water. Food producers Farming & fishing Companies that grow crops or raise livestock, operate fisheries or own non-tobacco plantations. Includes manufacturers of livestock feeds and seeds and other agricultural products but excludes manufacturers of fertilizers or pesticides, which are classified under Specialty Chemicals. Food products Food producers, including meatpacking, snacks, fruits, vegetables, dairy products and frozen seafood. Includes producers of pet food and manufacturers of dietary supplements, vitamins and related items. Excludes producers of fruit juices, tea, coffee, bottled water and other non-alcoholic beverages, which are Personal & household goods Household goods & home construction Durable household products Non-durable household products Furnishings Home construction classified under Soft Drinks. Manufacturers and distributors of domestic appliances, lighting, hand tools and power tools, hardware, cutlery, tableware, garden equipment, luggage, towels and linens. Producers and distributors of pens, paper goods, batteries, light bulbs, tissues, toilet paper and cleaning products such as soaps and polishes. Manufacturers and distributors of furniture, including chairs, tables, desks, carpeting, wallpaper and office furniture. Constructors of residential homes, including manufacturers of mobile and prefabricated homes intended for use in one place.

Leisure goods Consumer electronics Manufacturers and distributors of consumer electronics, such as TVs, VCRs, DVD players, audio equipment, cable boxes, calculators and camcorders. Recreational products Manufacturers and distributors of recreational equipment. Includes musical instruments, photographic equipment and supplies, RVs, ATVs and marine recreational vehicles such as yachts, Health care Health care Health care equipment & services Toys dinghies and speedboats. Manufacturers and distributors of toys and video/computer games, including such toys and games as playing cards, board games, stuffed animals and dolls. Personal goods Clothing & accessories Manufacturers and distributors of all types of clothing, jewellery, watches or textiles. Includes sportswear, sunglasses, eyeglass frames, leather clothing and goods, and processors of hides and skins. Footwear Manufacturers and distributors of shoes, boots, sandals, sneakers and other types of footwear. Personal products Makers and distributors of cosmetics, toiletries and personal-care and hygiene products, including deodorants, soaps, toothpaste, perfumes, diapers, shampoos, razors and feminine-hygiene products. Includes makers of contraceptives other than oral contraceptives, which are classified under Pharmaceuticals. Tobacco Tobacco Manufacturers and distributors of cigarettes, cigars and Health care providers other tobacco products. Includes tobacco plantations. Owners and operators of health maintenance organizations, hospitals, clinics, dentists, opticians, nursing homes, rehabilitation and retirement centres. Excludes veterinary services, which are classified

under Specialized Consumer Services. Medical equipment Manufacturers and distributors of medical devices such as MRI scanners, prosthetics, pacemakers, X-ray machines and other non-disposable medical devices. Medical supplies Manufacturers and distributors of medical supplies used by health care providers and the general public. Includes makers of contact lenses, eyeglass lenses, bandages and other disposable medical supplies. Pharmaceuticals & biotechnology Biotechnology Companies engaged in research into and development of biological substances for the purposes of drug discovery and diagnostic development, and which derive the majority of their revenue from either the sale or licensing of these drugs and diagnostic tools. Pharmaceuticals Manufacturers of prescription or over-the-counter drugs, such as aspirin, cold remedies and birth control pills. Includes vaccine producers but excludes vitamin producers, which are classified under Food Products. Consumer services Retail Food & drug retailers Drug retailers Operators of pharmacies, including wholesalers and Food retailers & wholesalers distributors catering to these businesses. Supermarkets, food-oriented convenience stores and other food retailers and distributors. Includes retailers of dietary supplements and vitamins. General retailers Apparel retailers Retailers and wholesalers specializing mainly in clothing, shoes, jewellery, sunglasses and other accessories. Broadline retailers Home improvement retailers Specialised consumer Retail outlets and wholesalers offering a wide variety of products including both hard goods and soft goods. Retailers and wholesalers concentrating on the sale of home improvement products, including garden equipment, carpets, wallpaper, paint, home furniture, blinds and curtains, and building materials. Providers of consumer services such as auction houses,

services day-care centres, dry cleaners, schools, consumer rental companies, veterinary clinics, hair salons and providers of funeral, lawn-maintenance, consumerstorage, heating and cooling installation and plumbing services. Speciality retailers Retailers and wholesalers concentrating on a single class of goods, such as electronics, books, automotive parts or closeouts. Includes automobile dealerships, video rental stores, dollar stores, duty-free shops and automotive fuel stations not owned by oil companies. Media Media Broadcasting & entertainment Producers, operators and broadcasters of radio, television, music and filmed entertainment. Excludes movie theaters, which are classified under Recreational Services. Media agencies Companies providing advertising, public relations and marketing services. Includes billboard providers and telemarketers. Publishing Publishers of information via printed or electronic media. Travel & leisure Travel & leisure Airlines Companies providing primarily passenger air transport. Excludes airports, which are classified under Transportation Services. Gambling Hotels Recreational services Restaurant & bars Providers of gambling and casino facilities. Includes online casinos, racetracks and the manufacturers of pachinko machines and casino and lottery equipment. Operators and managers of hotels, motels, lodges, resorts, spas and campgrounds. Providers of leisure facilities and services, including fitness centres, cruise lines, movie theatres and sports teams. Operators of restaurants, fast-food facilities, coffee shops and bars. Includes integrated brewery

companies and catering companies. Travel & tourism Companies providing travel and tourism related services, including travel agents, online travel reservation services, automobile rental firms and companies that primarily provide passenger transportation, such as buses, taxis, passenger rail and ferry companies. Telecommunications Telecommunications Fixed line telecommunications Fixed line telecommunications Providers of fixed-line telephone services, including regional and long distance. Includes companies that primarily provide telephone services through the internet. Excludes companies whose primary business is Internet access, which are classified under Internet. Mobile telecommunications Mobile telecommunications Providers of mobile telephone services, including cellular, satellite and paging services. Includes wireless tower companies that own, operate and lease mobile site towers to multiple wireless service providers. Utilities Utilities Electricity Conventional electricity Companies generating and distributing electricity through the burning of fossil fuels such as coal, petroleum and natural gas, and through nuclear energy. Gas, water & multi utilities Alternative electricity Gas distribution Multi utilities Water Companies generating and distributing electricity from a renewable source. Includes companies that produce solar, water, wind and geothermal electricity. Distributors of gas to end users. Excludes providers of natural gas as a commodity, which are classified under the Oil & Gas industry. Utility companies with significant presence in more than one utility. Companies providing water to end users, including water treatment plants. Financials Banks Banks Retail Banking in which banking institutions execute transactions directly with consumers, rather than

corporations or other banks. Services offered include: savings and transactional accounts, mortgages, personal loans, debit cards, credit cards, and so forth Private banking Banking services (deposit taking and payments), discretionary asset management, brokerage, limited tax advisory services and some basic concierge-type services, offered by a single designated relationship manager Corporate banking Banking in which banking institutions execute transactions with and for corporations. Services offered include: savings and transactional accounts, property finance, working capital loans, international banking, etc. Sometimes linked to Investment Banking. Investment banking The principal businesses of most large investment banks include an (a) investment banking business managed by the Investment Banking Division, which focuses on capital raising and M&A transactions for corporate clients and capital raising for government clients; (b) sales and trading business managed by the Trading Division, which provides investing, intermediating, and risk-management services to institutional investor clients, performs research, and also participates in non-client-related investing activities; and (c) asset management business managed by the Asset Management Division, which is responsible for managing money for individual and institutional investing clients. See also asset management below Insurance Nonlife insurance Full line insurance Insurance companies with life, health, property & casualty and reinsurance interests, no one of which predominates. Insurance brokers long Insurance brokers and agencies.

term Insurance brokers Insurance brokers and agencies. short term Insurance brokers long Insurance brokers and agencies. and short term Property & casualty insurance Companies engaged principally in accident, fire, automotive, marine, malpractice and other classes of nonlife insurance. Reinsurance Companies engaged principally in reinsurance. Life insurance Life insurance Companies engaged principally in life and health Real estate Real estate investment & services Real estate investment trusts Real estate holding & development Real estate services Industrial & office REITS Retail REITS Residential REITs insurance. Companies that invest directly or indirectly in real estate through development, investment or ownership. Excludes real estate investment trusts and similar entities, which are classified as Real Estate Investment Trusts. Companies that provide services to real estate companies but do not own the properties themselves. Includes agencies, brokers, leasing companies, management companies and advisory services. Excludes real estate investment trusts and similar entities, which are classified as Real Estate Investment Trusts. Real estate investment trusts or corporations (REITs) or listed property trusts (LPTs) that primarily invest in office, industrial and flex properties. Real estate investment trusts or corporations (REITs) or listed property trusts (LPTs) that primarily invest in retail properties. Includes malls, shopping centres, strip centres and factory outlets. Real estate investment trusts or corporations (REITs) or listed property trusts (LPTs) that primarily invest in

residential home properties. Includes apartment buildings and residential communities. Diversified REITs Real estate investment trusts or corporations (REITs) or listed property trusts (LPTs) that invest in a variety of property types without a concentration on any single type. Speciality REITs Real estate investment trusts or corporations (REITs) or listed property trusts (LPTs) that invest in self-storage properties, properties in the health care industry such as hospitals, assisted living facilities and health care laboratories, and other specialized properties such as auto dealership facilities, timber properties and net lease properties. Mortgage REITs Real estate investment trusts or corporations (REITs) or listed property trusts (LPTs) that are directly involved in lending money to real estate owners and operators or indirectly through the purchase of mortgages or Hotel & Lodging REITs mortgage backed securities. Real estate investment trusts or corporations (REITs) or listed property trusts (LPTs) that primarily invest in hotels or lodging properties. Financial services Asset management Asset managers Companies that provide custodial, trustee and other related fiduciary services. Includes mutual fund management companies. Investment managers Linked Investment Services Providers (LISPS) Companies that enable investment in a wide range of collective investment schemes, such as unit trust funds, via one source. Effectively an investment administration and product packaging business, a Lisp also offers access to traditional life insurance products such as endowments, retirement annuities,

preservation funds and living annuities to cater for the full range of investment needs. Financial services Equity investment instruments Non-equity investment instruments Technology Technology Software & computer services Medical schemes Pension fund administrators Consumer finance Speciality finance Investment services Mortgage finance Equity investment instruments Non-equity investment instruments Computer services Credit card companies and providers of personal finance services such as personal loans and check cashing companies. Companies engaged in financial activities not specified elsewhere. Includes companies not classified under Equity Investment Instruments or Nonequity Investment Instruments engaged primarily in owning stakes in a diversified range of companies. Companies providing a range of specialized financial services, including securities brokers and dealers, online brokers and security or commodity exchanges. Companies that provide mortgages, mortgage insurance and other related services. Corporate closed-ended investment entities identified under distinguishing legislation, such as investment trusts and venture capital trusts. Non-corporate, open-ended investment instruments such as open-ended investment companies and funds, unit trusts, ETFs and currency funds and split capital trusts. Companies that provide consulting services to other businesses relating to information technology. Includes providers of computer system design, systems integration, network and systems operations, data management and storage, repair services and

technical support. Internet Companies providing Internet-related services, such as Internet access providers and search engines and providers of Web site design, Web hosting, domainname registration and e-mail services. Software Publishers and distributors of computer software for home or corporate use. Excludes computer game producers, which are classified under Toys. Technology hardware & equipment Computer hardware Manufacturers and distributors of computers, servers, mainframes, workstations and other computer hardware and subsystems, such as mass-storage drives, mice, keyboards and printers. Electronic office Manufacturers and distributors of electronic office equipment Semiconductors Telecommunications equipment Government Government National government Government departments Provincial government Provincial government Local government Municipalities equipment, including photocopiers and fax machines. Producers and distributors of semiconductors and other integrated chips, including other products related to the semiconductor industry, such as semiconductor capital equipment and motherboards. Excludes makers of printed circuit boards, which are classified under Electrical Components & Equipment. Makers and distributors of high-technology communication products, including satellites, mobile telephones, fibre optics, switching devices, local and wide-area networks, teleconferencing equipment and connectivity devices for computers, including hubs and routers.

Parastatals / state owned entities (SOE s) Education Education Basic education Higher education Universities Technikons (if separate from a university)

TERMS AND DEFINITIONS FOR COMPLETING THE QUESTIONNAIRE ACT An act refers to the act, amendment acts and relevant regulations ADMINISTRATIVE REPORTING Administrative reporting is the reporting relationships within the organization s management structure that facilitates the day-to-date operations of the internal audit function and can include: Budgeting and management accounting Human resource administrative, including personnel evaluation and compensation Internal communications and information flows Administration of organization s policies and procedures ASSURABLE UNITS These are areas that give rise to risk and that should be subject to assurance, e.g. certain geographic areas, laws and regulations, IT applications, etc. ASSURANCE SERVICES An objective examination of evidence for the purpose of providing an independent assessment on risk management, control, or governance processes for the organization. Examples may include financial, performance, compliance, system security, and due diligence engagements. AUDIT COMMITTEE An audit committee assists the board of directors in discharging its responsibilities with respect to the accounting policies, internal controls, and financial reporting of the entity. ASSURANCE COMPONENTS Planning -- Events include all activities prior to the start of fieldwork including risk assessments, budgeting, scheduling, audit program creation, engagement letter approval, etc. Fieldwork -- Events include all activities once the "audit" has begun, the audit program is being implemented, and the internal audit function is working to achieve the direct objectives of the engagement. Reporting -- Reporting begins once fieldwork has ended, development of the initial report begins, and continues until the report is issued. Follow-up -- consists of procedures performed to ensure audit recommendations and findings are resolved as outlined by management.

BACHELOR'S DEGREE 4-year post-secondary schooling BALANCED SCORECARD Measures the effectiveness of the compliance function, i.e. the level of residual risk is lowered through the successful application of controls through people, reporting framework, process and systems BOARD A board is an organization s governing body, such as a board of directors, supervisory board, head of an agency or legislative body, board of governors or trustees of a non-profit organization, or any other designated body of the organization, including the audit committee, to whom the chief audit executive may functionally report. CHARTER The charter of the compliance function is a formal written document that defines the activity s purpose, authority, and responsibility. As examples, the charter should (a) establish the compliance function s position within the organization; (b) authorize access to records, personnel, and physical properties relevant to the performance of engagements; and (c) define the scope of compliance activities. CHIEF AUDIT EXECUTIVE Head, top, or lead position within the organization responsible for audit-related activities, including internal audit CODE OF ETHICS The purpose of a Code of Ethics is to promote an ethical culture in the global profession of compliance risk management. COMPLIANCE Conformity and adherence to policies, plans, procedures, laws, regulations, contracts, or other requirements COMPLIANCE PROCESSES Includes risk assessment, planning, and audit methodologies. COMPLIANCE PROGRAMME A plan of activities to be undertaken by the compliance function over a defined period, foor example, review of specific policies and procedures, a compliance risk assessment, routine monitoring. The compliance programme should be risk based. COMPLIANCE RISK

The current and prospective risk of damage to the organisation s business model or objectives, reputation and financial soundness arising from non-adherence with regulatory requirements and expectations of key stakeholders such as customers, employees, and society as a whole. Compliance risk therefore not only exposes the organisation to fines, civil claims, loss of authorisation to operate and an inability to enforce contracts, but also to reputational damage. COMPLIANCE (REGULATORY RISK) UNIVERSE A list of all the acts and/or regulatory requirements that an organization has to comply with (can include business units, locations, offices, processes, product lines, etc. for the organization / subsidiary you are completing this questionnaire for. CONSULTING SERVICES Advisory and related client service activities, the nature and scope of which are agreed with the client and which are intended to add value and improve the organization s governance, risk management, and control processes without the internal auditor assuming management responsibility. Examples include counselling, advising, facilitating, and training. CONTROL ENVIRONMENT The attitude and actions of the board and management regarding the significance of control within the organization play an important role. The control environment provides the discipline and structure for the achievement of the primary objectives of the system of internal control. As examples, the control environment includes the following elements: Integrity and ethical values Management s philosophy and operating style Organizational structure Assignment of authority and responsibility Human resource policies and practices Competence of personnel CONTROL SELF-ASSESSMENT CSA is a process through which internal control effectiveness is examined and assessed. The objective is to provide reasonable assurance that all business objectives will be met. CO-SOURCING Working with external professionals to meet requirements for the organization s audit plan and obtaining value-added solutions from a cooperative effort. DECENTRALISED COMPLIANCE STRUCTURE / FUNCTION Typically found in large organisations that have a number of subsidiaries, clusters, divisions, business units or regions, where a compliance champion or officer is appointed for each of these areas. This person then reports to the Head of Compliance and/or business management.

DIRECTORS / GENERAL MANAGERS / SENIOR MANAGERS Managerial positions within the compliance function. ENTERPRISE RISK MANAGEMENT (ERM) A continuous process that establishes risk management objectives and develops tolerances and limits for all the enterprise s significant risks. EXPENSES Total expenses as they appear on the annual financial statements. Should include cost of goods sold, if applicable. Should be total expenses prior to any discontinued operations, income taxes, and extraordinary items. Total operating and direct expenses. Cost of sales, selling, general and administrative expenses, and any other expenses deducted from revenue to arrive at "operating" income. Does not include "extraordinary" items or income taxes. For non-business entities, total annual expenditure budget. FISCAL YEAR-END A continuous 12-month time interval used for financial reporting; the period starts on any date on or after January 1 and ends one year later. FULL TIME EQUIVALENTS Base is 2,000 hours per FTE Include part-time employees Include contractors if this is a significant component of your business, operations, and industry and would make your organization more consistent with others FUNCTIONAL REPORTING The functional reporting line ensures independence and authority over the management and oversight of the internal audit function. As examples, the governing authority would: Approve compliance charter Approve annual risk assessment and compliance coverage plan Approval all decisions regarding the appointment or removal of the Head of Compliance (HoC) Approval the annual compensation and salary adjustment of the HoC Receive communications on the results of internal audit activities and other matters as deemed necessary by the HoC with or without organization management present GOVERNANCE The combination of processes and structures implemented by the board in order to inform, direct, manage, and monitor the activities of the organization toward the achievement of its objectives.

HEAD OF COMPLIANCE Head, top, or lead position within the organization responsible for compliance-related activities INDEPENDENCE Independence is the extent to which mechanisms have been put in place to minimise or avoid potential conflicts of interest that may exist, such as dominance by a strong chief executive or large shareowner. The decisions made, and internal processes established should be objective and not allow for undue influences. MAJOR COMPLIANCE FINDING A systemic failure of controls designed to manage significant risks within a process, project, or organization. OTHER ASSURANCE PROVIDERS Includes external audit, internal audit, legal function, risk management, etc. OUTSOURCING Hiring external professionals to meet requirements for the organization s audit plan and obtaining value-added solutions from an outside source. REGULATORY REQUIREMENTS The statutory, regulatory and supervisory requirements plus industry codes and best practice guidelines (collectively) REGULATORY RISK The risk that the organisation might be exposed to should it not comply with applicable regulatory requirements or excludes provisions of relevant regulatory requirements from its operational prcedures REPUTATIONAL RISK The risk that the organisation might be exposed to negative publicity due to the contravention of applicable regulatory requirements by the organisation itself or by its staff members during the conduct of business REVENUES Total revenues as it appears on annual financial statements. Gross revenues less any returns, allowances, or discounts. The sources of income that a government collects and receives into its treasury and appropriates for the payment of its expenses. The income of a government from all sources appropriated for the payment of the public expenses.

Money received from taxation, fees, fines, inter-governmental grants or transfers, securities sales, mineral rights, and resource rights, plus any sales that are made. For governmental bodies with subset entities (e.g., Department of Energy), revenues would be defined as the budget authorized by a government entity to a commercial entity for the management and operation of a government-owned facility or operation RISK ASSESSMENT Assessment of organizational threats and opportunities to ensure proper controls are in place to minimize the risks to the organization s success and achievement of its objectives. RISK CATEGORIES Groupings of risks and events to ensure all possible outcomes, events, or risks are captured during the risk management process. For example, COSO outlines four universal risk categories: strategic, operational, reporting, and compliance. RISK MANAGEMENT A process to identity, assess, manage, and control potential events or situations to provide reasonable assurance regarding the achievement of the organization s objectives. RISK MANAGEMENT FRAMEWORK The organisation s approach to the management of all categories of risk, including policy and structure (people, systems and process) SOURCED STAFF (CONTRACTORS) Purchased staff from a service provider, consultant, resource firm, or other provider of employment assistance. These staff are not permanent staff of the organization. As an example, these can be staff that have been hired to perform specific internal audit projects. STAKEHOLDERS Stakeholders include the oversight committee, executive management, external government bodies and regulators, board of directors, and the external auditors.