Risk understanding in the South African payments industry: A comparative analysis

Abstract

Despite risk understanding being an important element of organisational risk culture, various aspects of risk understanding have yet to be explored. One such aspect is the extent to which organisations and regulators within the same industry share an understanding of the risk inherent in that industry. This qualitative study explored the differences and similarities in risk understanding between the statutory regulator of the South African National Payment System (NPS) and regulated entities within its ambit. Directed by a literature-based codebook, this study employed document analysis to assess policy documents issued by the regulator between 2016 and 2019 as well as risk documentation issued by regulated entities under the auspices of the industry’s management body, for the same period. The results were then compared. Findings indicate that the nature of the risk, which includes the envisaged outcomes and their severity, the probability of occurrence of the risk, and the ease or difficulty of mitigating it are the main components for assessing an understanding of risk. Evaluation of policy and risk documents using these themes indicates that the regulator and regulated entities differ in their understanding of risks inherent in the NPS. Whereas the regulator is most concerned with negative consequences for the achievement of its policy objectives, resulting from systemic risk, regulated entities are primarily concerned with adverse consequences for their business operations. Neither the regulator nor the regulated entities consistently articulate the severity or probability of risks. Both the regulator and the regulated entities, however, regard regulation to be the most effective control with which to mitigate risks. This study offers a practical perspective to the regulator and regulated entities in the South African NPS on the extent to which they share an understanding of risk. For risk scholars, it provides a novel framework with which to assess risk understanding.