The risk management approach which was in practice before the establishment of an internal audit team, referred to as Governance and Assurance (G&A) was fragmented across all business units and as such there was no standardised methodology for Risk Management.