Enterprise risk management and compliance
Telkom continues to operate in a rapidly changing market, characterised by a volatile technological environment in an uncertain industry, which forces it to constantly balance risks and rewards and closely monitor risks which might impact its strategic objectives.
Telkom’s operating environment (as set out on the world we operate in) impacts its risk management.
Telkom’s governance structures continued to support risk and compliance management across the Group, in accordance with their set mandate.
We progressed further on the transformation journey to enhance the Group’s risk management approach and framework. This requires an understanding of the ongoing impact of COVID-19 on the economy and society, and the risks and opportunities created within our operating environment and Telkom’s role in addressing these.
The Risk Committee oversees the activities of enterprisewide risk management and is apprised on a regular basis by management. The Committee also oversees management’s activities in ensuring that the ERM framework is embedded and adhered to. The Group adopts the principles outlined in the risk appetite and tolerance framework of assessing and understanding the amount and type of risks the Group is willing to take as part of discussions and decisions to be made. These are the most critical integrators of ERM and business management.
In managing and dealing with the Group’s risks, Telkom ensures:
- Risk and opportunity management is clearly and consistently integrated into Telkom’s culture
- An integrated approach of dealing with risk across the lines of defence is followed (Risk and compliance focus areas for FY2022 and Combined assurance)
- Risks and opportunities are managed in accordance with best practice
- It anticipates, observes and responds to the macro- and micro-environments
- People, processes and technology support the strategy underpinned by governance, risk and compliance requirements
- Group-wide interdependencies are recognised
In FY2021 Telkom experienced COVID-19 as an unforeseen and unusual event where an emergency management team was established to adequately manage and reduce the risk for the Group.
- Improved the Group’s risk and compliance culture
- Senior leadership demonstrated and took accountability for any matters of governance, risk and compliance
- Embarked on exploring predictive analysis and a futuristic approach for risk management
- Strengthened opportunity management and collaboration across the Group
management
Refer to natural capital for further information on climate change.
Describe the organisation’s process for identifying and assessing climate-related risks
Our risks associated with climate change are integrated into Telkom’s risk identification and management processes, and assurance processes. The Group’s risk management approach is based on a Board-approved ERM methodology and philosophy to ensure adequate and effective risk management.
Regulatory, reputational and physical risks are identified and assessed on an annual basis and are considered three to six years into the future.
Describe how processes for identifying, assessing, and managing climate-related risks are integrated into the organisation’s overall risk management
The ERM framework is used to identify, assess, monitor and report on the Group’s complex risks and opportunities including risks related to climate change. Group Exco is responsible for integrating risk and compliance management. Using the ERM framework, the Board is committed to aligning Telkom’s risk management to good corporate governance and best practice standards.
Telkom has business continuity plans in place aimed at reducing the likelihood and the impact of business continuity risks should they materialise. It further ensures continuous improvement of the competency and capability of the Group’s business continuity management.
The Disaster Management Act, 57 of 2002 specifically requires Telkom to maintain communication services during adverse conditions and to support local and national government should a crisis arise. Telkom needs to ensure that its infrastructure, business processes and emergency management procedures have the resilience required to safeguard the interests of its key stakeholders, reputation and brand.
Telkom established a crisis management structure for COVID-19, the Group Emergency Management Team, which reports to Group Exco.
It has defined terms of reference, processes, structures, roles and responsibilities and covers all Telkom operations and business units.ERM endeavours to identify and assess emerging/external risks and opportunities that may impact the Group.
COVID-19 induced an economic crisis which exacerbated the already existing societal inequalities, deepened uneven development at several geographical scales and transformed consumer behaviour. A resultant lack of cohesive societies will mean that political stability and efforts put into economic growth, business development and competitive sustainability are threatened. Therefore, we closely observe the macro-environment, as it informs the micro-environment.
Climate variability and change have the potential to threaten the infrastructure, integrity and productivity of Telkom’s business, which in turn will increase the number and severity of disruptions. In addition, extreme or unusual weather might impact the sector on a micro or macro level. Refer to the natural capital section.
We acknowledge that the Group’s performance is not only measured by the ability to derive value for shareholders, but also by the level of the Group’s accountability for societal matters (i.e. the environment, people and society at large).
Power outages1 and load shedding2
Load shedding continued in FY2021. Power outages pose a threat to our customers, impacting their ability to do business with Telkom. Outages resulting from increased battery theft from cell phone towers also threaten our ability to provide uninterrupted services.
Telkom’s response plans are adequate and effective across all key areas such as stakeholder management, technical (backup power, alternative power solutions, diesel, water and mobile generators) and critical resources. At Group level, Telkom has a model in place to manage essential and critical services across the various load shedding thresholds (i.e. stages 4 to 8 and including blackout).
In FY2021 the standby/backup generators installed at various equipment sites assisted in ensuring there were minimal disruptions to operations and service delivery to customers. As a result, there were no significant impacts on the business operations.
Our strategic risks, mitigating factors and opportunities are set out on the following pages. The Group reviewed strategic risks, which are those that bear the most significant impact on the Group’s ability to achieve and realise its strategic objectives. We used a bottom-up and top-down approach to ensure a holistic risk management process.
It was imperative to review the strategic risks Telkom might be faced with in pursuit of value. Changes that gave rise to this review were to ensure that there is clear alignment with the strategy and the considerations of the COVID-19 pandemic across the Group.
Due to COVID-19 exposure, it was equally important to recognise and ensure that as we manage the strategic risks, we take cognisance of the financial sustainability; Telkom’s ability to attract and retain suitable, resilient and healthy employees; and manage supplier risks. These risks had the potential to impact the achievement of the strategic goals for the organisation.
The risks discussed below, separately or in combination, could have a material adverse effect on the implementation of our strategy:
| 1 | Power outage is the loss of the electrical power network supply to an end user. |
| 2 | Load shedding is the action taken to interrupt electricity supply to avoid excessive load on the generating plant. |
FY2020
FY2021
Telkom handled the immediate consequences of COVID-19 and adopted various measures to slow down the contagion across the Group. The pandemic provided Telkom with the opportunity to optimally test its business continuity plans and responses. The following measures and actions were put in place:
Limiting employee exposure
- Reorganised work arrangements to allow 80% of employees to work from home, including field technicians who were dispatched from home
- Provided COVID-19 PPE to employees, including masks, face shields, sanitisers and hazmat suits where necessary
- Provided measures to limit, control and monitor employee movement into the office buildings where necessary
Supporting employees
- Identified high-risk employees (employees with comorbidities and those 60 years and above), implemented special measures to ensure heightened protection and repurposed employees (refer to Human capital)
- Daily temperature screening for employees working at the office and those travelling to customer sites
- Continuous education and awareness regarding PPE usage, symptoms, processes and working from home, among others, and established a Telkom COVID-19 helpline for screening, testing and counselling
- Continuous engagement with organised labour to ensure alignment
Supply chain risk management
- Conducted an impact analysis to assess the adequacy of current inventory levels for short and medium-term consumption
- Mapped Telkom’s high-risk supplier footprint, conducted an impact analysis and closely monitored highly impacted geographies; also met with strategic suppliers to ensure higher priority during the pandemic
- Identified single-source suppliers and accelerated the qualification of new suppliers for alternative supply sources
- Reviewed suppliers’ business continuity plans and conducted supplier risk self-assessments of readiness in terms of gazetted protocols and conducted reviews to address non-compliance
- Conducted financial monitoring of ESD companies
Building readiness
- Identified facilities or buildings that could be occupied and ensured they were COVID-19 ready and complied with 30% occupancy
- Appointed compliance officers for each site
- Regular building audits by the occupational health and safety team to ensure COVID-19 compliance before employees were reintroduced; and continuous safety, health and environment compliance audits on people and buildings
- Introduced deep-cleaning protocols for buildings and facilities
Risk definition
Government enacts legislation that can potentially impact Telkom’s regulatory environment. This might result in possible non-compliance with laws and regulations, cause reputational damage and threaten the financial sustainability of the Group.
Regulations are categorised as follows:
- Regulations required to operate the business (i.e. spectrum, infrastructure, B-BBEE and competition regulation)
- Customer-related regulations (i.e. Regulation of Interception of Communications and Provision of Communication-Related Information Act, 70 of 2002 (RICA), Protection of Personal Information Act, 4 of 2013 (POPIA), Promotion of Access to Information Act, 2 of 2000 and General Data Protection Regulation
Mitigating activities and monitoring
- - Continuous engagement with internal and key government stakeholders
- Managing our compliance universe effectively to improve our relationship with regulators and ensure we remain compliant
- Proactive implementation of any new legislation
- Continuous scanning of any regulation (including outside of telecommunications) that might have an impact on Telkom’s sustainability
This external risk is one of the highest risk factors for Telkom’s future success. The regulatory model remains a concern and poses significant risks to growth in the industry. There are significant delays in the finalisation of spectrum and network sharing agreements, which puts pressure on the sector.
Compliance to regulation will remain a priority due to the influence of various external regulatory forces. The compliance office continues to support line management through the execution of the compliance plan.
Opportunities still exist to influence some regulations to ensure we derive an optimal outcome, realising benefits on our revenue growth and financial stability. Also, to ensure that the competitive landscape is levelled across the industry.
Risk definition
Telkom operates in a rapidly changing market and technological environment. Pricing and product offerings are constantly under pressure as Telkom strives to remain competitive. This is exacerbated by new entrants in the connectivity space.
Failure to swiftly respond to competitive threats and market changes could negatively impact the Group’s market share, revenue growth and profit margins. The anticipated spectrum auction contributes to this risk, as it puts pressure on Telkom’s competitiveness.
Mitigating activities and monitoring
- Continuous monitoring of the market and competitive landscape, using intelligence to gain further insights
- Developing product offerings that are appealing to customers and exploring upselling opportunities
- Developing and implementing adaptive strategies that are focused on innovation
- Implementing strategy to remain competitive
This risk remains very high, as it is exacerbated by wireless open-access network (WOAN) and spectrum auction uncertainty, as well as the impact of COVID-19 on consumers and the economy.
Although COVID-19 has placed Telkom under pressure, opportunities still exist for Telkom to increase market share and improve revenue growth and profitability. This can be done through an increased focus on innovation, adaptation and executing the digital and innovation strategies.
Failure to deliver innovative solutions, could negatively impact the Group's market share, relevancy, revenue growth and profit margins.
Incomplete business technology transformation means that although the business is transformed at the top, processes and resources at the bottom still require updating to drive innovation, efficiency and agility. Legacy platforms inhibit agile and speedy solution delivery.
- Execution of the digital strategy is under way, with notable achievements in Yep!
- Developing and implementing an innovation framework that will ensure Telkom remains innovative and competitive and enhance valueadded offerings to capitalise on price pressures
- Enhancing customer-facing processes to improve time to market
The risk remains a priority on the Group’s strategic agenda, as products, services and technology are key to transforming the Telkom business and competitiveness in the market.
There is an opportunity for the Group to deploy more innovative products, services and technology that will inspire customer confidence.
The upsurge in online activities (i.e. work from home, expansion of e-commerce footprints, etc.) increases the possibility of cyberattacks, which could lead to unstable systems, loss of customers and, consequently, reputational damage as well as data and revenue loss.
The external risk of proliferation in the digital space, Internet of Things and software of networks poses a risk of an exponential increase in cyberattacks or even cyberwar. The risk is heightened by:
- Limited user awareness of new attack strategies
- Ineffective security operations
- Poor security operational governance
- Limited threat hunting capability
- Ensuring that cyber-related risks are mitigated, and all business-critical/ sensitive data is protected in line with relevant regulations
- Ensuring that all the relevant mitigating measures (i.e. backups, installations of anti-virus software, employees’ awareness, infrastructure security) are in place and continuously monitored to assess Telkom’s vulnerabilities and opportunities to secure it against cyber-related risks
- Continuously monitoring the information security strategy and operational security management
- Conducting security assessments across the Group to re-examine information security
- Ensuring that there are collaborations between related parties to resolve some of the common threats in the industry (i.e. cloud providers, operators and device vendors, etc.)
There are opportunities for information security investment aimed at growing business and ensuring that customer trust and loyalty are increased.
There are also opportunities to continuously deploy processes designed to contribute to driving business growth, strengthening customer trust and generating new competitive advantages.
Risk definition
Customer experience can be compromised due to customer perceptions and related feelings caused by the cumulative effects of the quality of services offered, possible data breaches and product prices.
The inability to meet the rising demands for innovative product offerings might exacerbate the risk, which could result in lost revenue, brand erosion and reputational damage.
Mitigating activities and monitoring
- Continuously improving and crystallising Telkom’s customer value proposition
- Enhancing customer-facing processes to improve quality and reduce our time to market for new products
- Launching new products to attain sustainable competitive advantage
- Improving customer service by accelerating the digital platform over and above providing the network
- Improving our effectiveness in resolving service queries at the first instance across all Group touchpoints
- Developing and implementing data enhancement initiatives to ensure that customer data is always protected
The risk remains a priority for the Group, as customer retention and customers experiences are key aspects of building a financially sustainable business.
There are opportunities to increase our customer loyalty, retention and satisfaction, and increase revenue in turn, through:
- Developing and implementing data protection initiatives to safely create, process, transfer, delete and dispose of customer data
- Ensuring that there are noticeable improvements in our network availability and stability
Another opportunity is in targeted and customer-centric offerings, which are aligned to industries susceptible to disruption. This could grow revenue andaccelerate industry transformation.
Maintaining financial capacity to sustain or grow operations, while simultaneously building adequate financial resilience to manage unforeseen economic events. This risk can be due to:
- Insufficient liquidity and/or cash flow deterioration
- Inadequacy of management of forex
- Impact of interest rate
- Customers’ inability to pay on time
- Unsustainable leverage ratios
- Technology evolution contributing to the rapid decline in fixed-voice usage
- Regulatory uncertainty, for example, spectrum auction
- Tough competitive environment
- Continuously monitoring Telkom’s sustainable Cost Management programme
- Launching new products to drive revenue
- Continuing with cash release initiatives – for example, the Supply Chain Finance programme
- Maintaining adequate debt headroom and disciplined capital allocation with flexible capex investments, and secured adequate debt facilities
- Maintaining a sound governance framework in ensuring transparent financial and operational frameworks and supportive credit ratios
The risk has improved due to a relentless focus on the Cost Management programme, and reflected in resilient Group revenue. We have seen significant mobile growth, despite some business units being negatively impacted by the national lockdown with customers under severe financial pressure.
There is an opportunity to continue to build financial resilience in the face of a tough trading environment, focusing on several levers:
- Sustainable cost management
- Cash preservation
- Disciplined capital allocation
- Mitigating financial risks
Telkom’s ability to attract and retain suitable scarce expertise for its strategy execution and to compete in a market that requires new skills (Internet of Things, cloud and information security). This risk is driven by the following key factors:
- Alignment of skills needed to execute the business strategy
- Ability to build workforce resilience (engaged and productive for the future)
- Telkom's ability to protect the health of employees
- Telkom's ability to address issues of gender parity
- Employee engagement and support
- A recruitment strategy that will merge the demands of business while allowing flexibility to the workforce to align with market demand (i.e. adoption of a people-centric approach)
- Developing and executing workforce strategies that support the business strategy
- Aligning learning objectives to Telkom’s strategic objectives
- Recognising and leveraging talent as a strategic asset, with continuous skills gap analyses to be able to deal with the current and future business requirements
- Compliance with employee-related statutory requirements
- Developing and implementing change management processes to keep up with the pace of change and enable a robust environment
- Continuously supporting employees through Occupational Health and Safety and Psychological Containment programmes
The risk is continually being managed.
The uncertainty of the third and fourth COVID-19 waves exacerbates concerns regarding the emotional and psychological stability of employees while trying to deal with the effects of the pandemic.
The opportunity remains for Telkom to ensure that employees are supported from an occupational health and safety perspective to ensure they remain productive.
There is opportunity for Telkom to review its recruitment strategy to remain relevant and be able to compete with the global market for talent.
Telkom’s exposure to internal and external supplier-related risks has a potential to disrupt the business and cause revenue loss and reputational damage.
Internal risks are caused by:
- Inadequate planning
- No contingency plans in case of a disaster
- Increase in supplier bargaining power
External risks are caused by:
- Geopolitics (USA versus China)
- Suppliers’ financial or management stability
- Suppliers’ physical location and regulatory compliance pressures
- Unexpected customer demands
- Environmental circumstances that are caused by other systems such as economic, social and climate issues
- Implementation of a clearly defined supply chain strategy that considers supplier quality, diversification, risks, opportunities and liabilities
- Developing and implementing policies and processes to manage the supply chain across the Group
- Continuously conducting a comprehensive business impact analysis to get a clear understanding of exposure post the COVID-19 pandemic
- Reducing the supply concentration
- Creating collaboration platforms and a communication framework that have the potential to assist with cost management and error reduction and foster collaboration in matters like security and logistics
The risk has increased in priority driven by the impact of COVID-19 on supply chains and the concentration risk in the industry.
Opportunities remain to be innovative and efficient in contract management and in managing ESD (enterprise and supplier development) financial stability/ viability to ensure continuity.
Compliance with laws and regulations applicable to Telkom’s operations is critical, as non-compliance may have potential serious consequences. An enhanced compliance policy and compliance framework govern the Group’s dedicated compliance function. These documents form the basis for the Employee Regulatory and Legal Compliance Commitment programme where employees commit to uphold the stated compliance requirements, with an annual renewal of the commitment statement.
Management is charged with the responsibility for implementing the compliance framework and processes. Reports on compliance risk are provided to the Risk Committee quarterly, which reports back to the Board at least once a quarter. Telkom management has reported no material critical non-compliance issues, repeated regulatory penalties, sanctions or fines for contraventions with statutory obligations to date.
The challenging and “business unusual” operating environment of FY2021 created high visibility for compliance. It required decisive compliance and business continuity management actions as reflected in the numerous changes and directions issued in the Disaster Management Act, 57 of 2002. Compliance and business continuity management employees integrated their activities by keeping business units updated with regulatory changes affecting their business.
Key legislation addressed was the Protection of Personal Information Act, 4 of 2013 (POPIA) to ensure readiness towards complying with the eight conditions for the lawful processing of personal information. The focus was supported by a Group-wide POPIA e-learning course. Management met the compliance requirements under COVID-19 regulations and directions for essential services providers under both the Electronic Communications and Transactions Act, 25 of 2002 and Disaster Management Act, 57 of 2002.
In February 2021, the Constitutional Court found sections of the RICA unconstitutional, as it fails to provide adequate safeguards to protect the right to privacy, as buttressed by the rights of access to courts, freedom of expression and the media, and legal privilege. However, the Court suspended its declaration of invalidity for three years in order to allow Parliament adequate time to proceed with its investigations and develop suitable remedial legislation.
Compliance requirements under the Payment Card Industry Data Security Standard remain on the radar especially during the COVID-19 pandemic, when a sudden and dramatic increase in online activity was almost immediately matched by steep rises in cybercrime, fraud and cyberattacks.
The compliance focus areas included privacy matters, customer-related challenges and electronic communication trends.