Enterprise risk management 
and compliance Telkom has a solid, flexible, innovative and resilient risk and compliance strategy that ensures we achieve our strategic objectives.
Telkom continues to operate in evolving economic, political, technological and social conditions. This environment offers unprecedented opportunities and significant, as yet insufficiently understood, threats. Therefore, the Group's strategic intent becomes even more critical and requires us to constantly balance risks and rewards and monitor strategic risks. It is also worth mentioning that the efficacy of both risk and compliance is monitored to find opportunities for improvement. Risk metrics are in place to monitor risk management by measuring the coverage of risk identification and management. Compliance monitoring activities include control self-assessment exercises in conjunction with management and compliance control validation reviews to determine effectiveness. In ensuring compliance with the prescripts of the King Code, risk and compliance are subject to annual reviews. Telkom reviewed its strategic risks to align with the current realities, including the current impact of our operating environment as set out below.
Telkom's governance structures continued to support risk and compliance management across the Group, according to their set mandates. There were no material changes during the year.
End-to-end assurance |
Board | Oversees risk and compliance across the Group. Provides an integrated approach to governance and management of risk and compliance, supported by a risk and compliance operating model aligned to Telkom's business model. |  |
||||
| Risk and Social and Ethics Committees | Monitor and advise the Board on matters regarding risk and compliance, laws and regulations. | Oversight
|
|||||
| Group Exco | Integrates risk and compliance management, systems and people across the Group. | ||||||
| Integrated Governance, Risk, Compliance and IT Governance Committees | Assess risks and resulting opportunities within the agreed risk framework. Reduce the impact of regulatory risk by driving compliance awareness for all applicable laws, regulations and supervisory requirements. | Enablement |
|||||
| Group risk, compliance, business continuity management and insurance | Set policies and standards and provide oversight and control. | ||||||
| ERM forum | Shares best practices and knowledge, and monitors key risks and mitigating plans. | ||||||
| Business unit assurance forum | Affects the ERM framework through effective risk and compliance management and combined assurance to optimise risk-taking. | ||||||
| Business unit risk and compliance management | Implement the risk, compliance and business continuity management policies, standards and frameworks. Apply and maintain the compliance risk registers, identify mitigating controls, implement action plans and operationalise the business unit assurance forum. All business units' Excos are accountable for managing risk and compliance within the approved delegation of authority (DoA). | ||||||
| Business unit management |  |
The Risk Committee oversees the activities of enterprise risk management (ERM) and is apprised regularly by management. The Committee also oversees management's activities in ensuring that the ERM framework is embedded and adhered to. When assessing and understanding the amount and type of risks the Group is willing to take, it adopts the principles outlined in the risk appetite and tolerance framework into its discussions and decisions. These are the most critical integrators of ERM and business management.
In managing and dealing with the Group's risks, Telkom ensures:
We made the following key improvements as part of the journey towards becoming a risk-intelligent group:
We also finalised the work-from-home policy and the hybrid model to embrace the new ways of working. This will assist in managing and reducing the risk of COVID-19.
Telkom continues to strengthen the Group's business resilience. We tested the response plans continuously during the social unrest, COVID-19 pandemic, power outages and extreme weather experienced in FY2022. Telkom's response plans remain adequate and effective across key areas such as stakeholder management, critical resources, and technical resources such as back-up power, alternative power solutions, diesel, water and mobile generators.
Telkom's COVID-19 crisis management structure, namely the Group Emergency Management Team (which reports to Group Exco) continued to ensure the business's resilience during the pandemic.
Telkom remains committed to collaboration principles, maintaining communication services during adverse conditions and supporting local and national government should a crisis arise. Telkom continued to ensure that its infrastructure, business processes and emergency management procedures have the flexibility required to safeguard the interests of our key stakeholders, reputation and brand.
ERM endeavours to identify and assess emerging/external risks and opportunities that may impact the Group and to ensure our exposure is minimised.
Potential emerging risk
Description
More COVID-19 waves
The risk of further COVID-19 waves, and the lack of understanding its associated impact, created uncertainty. Although COVID-19 appears to be moving towards endemic, some consequences still necessitate further assessment and response strategies to be put in place for the long term. The business landscape will face greater uncertainty in the post-COVID period, including the ongoing impact of COVID-19 on global supply chains.
Lack of social cohesion
Social cohesion remains a critical driver of long-term prosperity and competitiveness. Lack of cohesive societies threatens political stability, efforts put on economic growth, business development and competitive sustainability. Telkom's ability to enable the communities will be hindered. In this global and multicultural world, Telkom will be challenged to respect the diversity of our people, partner with communities and to break the digital divide.
Global dominant players entering African markets
Current global players, such as Google and Amazon, have traditionally limited footprint and inroads into South Africa. As opportunities in Europe are limited, there may be a drive to grow their presence in Africa. It would be difficult to compete purely on price. Business conditions in most African economies have improved significantly in the last 15 years, resulting in the development of new value chains that are based on telecommunications platforms, agribusiness and energy.
Redefining the societal compact
The risk of commercialised/urban economies vs. industrialised/rural economies to achieve a green and circular economy, which is aimed at reducing societal dependencies (reuse, repair, refurbishment, leasing, cascading, capacity sharing or ‘dematerialisation'). Challenges towards a new social compact might have an impact on the way Telkom conducts business that takes into account green initiatives for the benefit of stakeholders.
The next pandemic/ health risks
The world may experience another pandemic. At a micro-level, it is important to create an anti-fragile environment by building the right capabilities that can respond to some of the health risks with minimal impact, where possible, to safeguard Telkom's sustainability. There is reliance on human capital which exacerbates the risk.
Our strategic risks1
Unanticipated events continued to unfold during the year under review, leading to several critical challenges for Telkom to manage speedily to avoid significant exposure to our business. Therefore, Telkom focused on building a resilient culture that can adapt at the speed of change experienced.
The Group's strategic risks were reviewed based on these three dimensions:
The risks were identified in the context of Telkom's financial and non-financial strategic objectives. Some of the risks mentioned in the previous financial year were reduced to an operational level and controlled by the various governance structures. The Board subcommittees continue to oversee them. The risk heatmap below reflects the residual risk rating, which considers the mitigation controls in place.
1. |
Changing legislative and regulatory environment | |
2. |
Changing market and competitive environment | |
3. |
Inability to deliver innovative solutions timeously | |
| 4. |
Increase in cyberattacks | |
5. |
Compromised customer experience | |
6. |
Financial sustainability | |
7. |
Inability to attract and retain a suitable, resilient and healthy workforce to execute Telkom's strategy | |
8. |
Supplier chain risks |
1. |
Unstable and unpredictable regulatory dispensation | |
2. |
Market forces and disruption exacerbating competition pressures | |
3. |
Inability to attract and retain a suitable, resilient and healthy workforce to service and support the changing ecosystem | |
| 4. |
Increased impact of ESG matters | |
5. |
Financial sustainability | |
6. |
Macro socio-economic instability |
In line with the global risk landscape, Telkom's risk landscape is changing quickly, and this is driven by two main factors, one man-made and one natural. On the one hand, societies and working processes are becoming increasingly digital and therefore more vulnerable to a loss or misuse of data. At the same time, climate change is altering the occurrence, severity and frequency of natural catastrophes. Both trends will require the telecommunications sector to adapt accordingly.
| 1 | The enterprise and risk management report details Telkom's material risks according to the governance requirements contained in paragraph 8.63(s) of the JSE Listings Requirements. This report is available online at www.telkom.co.za/ir. |
Unstable and unpredictable regulatory dispensation influenced by the changing market, customer and technological trends may impact Telkom's long-term decision-making and investment aspirations.
It also creates competitive pressures and unexpected costs that can hamper Telkom's profitability and sustainability.
In our environment, legislation emerges and changes continuously with increasing requirements that might impact long-term decisionmaking and investment aspirations. Telkom continues to proactively manage this risk to reduce the exposure.
Opportunities exist to influence some regulations to ensure we derive an optimal outcome, including a level competitive landscape.
An opportunity also exists to review the significant cost of compliance, whether in terms of infrastructure, technology or people, and the time spent ensuring compliance.
Telkom operates in a competitive and rapidly changing market. The increase in technological innovations, accelerated market deregulations, customer expectations, and new entrants in the connectivity space exacerbate this risk. These put pricing and product offerings under pressure as Telkom strives to remain competitive.
Failure to swiftly respond to competitive threats could negatively impact the Group's prospects, including its market share, relevancy, revenue growth and profit margins.
The risk remains a strategic priority as products, services and technology are crucial for our transformation and to be competitive.
Telkom needs to understand customer needs and continuously review the market to inform changes.
Business process re-engineering, network augmentation and incremental innovation remain critical for staying relevant and agile and meeting our customers' needs.
Refer to Our strategy review for more information on Telkom's Strategy.
The world is experiencing several changes, such as a shift in the way companies work, hybrid working models, customer behaviours, technology trends, etc. This requires talent that can provide a sustainable competitive advantage.
Failing in this regard might result in the loss of our competitive advantage, an increase in employee costs and delays in achieving the Group's Strategy.
Telkom's employee strategy addresses this risk. It focuses on transitioning employees to a hybrid way of working and creating an environment that gives employees the right level of growth, experience and opportunities
Opportunities exist to improve strategies to attract relevant skills to participate in the digital world and review the retention strategy of critical talent.
Refer to Human capital of the human capital chapter for more information.
Increased focus on ESG matters is due to the rapid heightened importance of sustainability matters in society, an increase in climate change awareness, social inequality, and corporate misconduct. This might impact Telkom's financial sustainability and reputation and create limitations in accessing opportunities.
Telkom defined an ESG Strategy that is practical, measurable and can be implemented. It includes and builds on the current initiatives in flight, such as energy and water efficiencies.
The opportunity exists for Telkom to execute the ESG Strategy to contribute to the sustainability agenda.
Refer to Our strategy review for more information on Telkom's ESG Strategy
Maintaining financial capacity is crucial to sustain or grow operations while building adequate financial resilience to manage unforeseen economic events. This risk can be due to:
This risk is a priority for the Group. Customer retention and customers' experiences are key aspects of building a financially sustainable business.
We have an opportunity to build financial resilience in the face of a demanding trading environment, focusing on several levers:
Refer to Group Chief Financial Officer's report for more information on the financial performance
Telkom is not immune to the critical characteristics introduced by socio-economic matters that influence consumers' behaviours, preferences, attitudes and quality of life. Therefore, this instability creates uncertainty, particularly where consumers are critical to the Group's success.
This volatility affects the levels of profitability and cash generation that are considered acceptable. It also impacts our shareholders' perspective around the Value Unlock Programme and future growth.
This risk is outside of Telkom's control. However, how we manage our financial stability contributes to managing this risk.
Despite the macro socio-economic risks, there are opportunities. The global market continues to grow. This indicates an opportunity to offer products and services that improve the country's economic agenda. There are opportunities to partner with communities to address unemployment issues, break the digital divide, and grow small to medium businesses.
Refer to Our strategy review for more information on our strategy, and Social and relationship capital for more information on our ESD support and the work of the Telkom Foundation.
Compliance
Telkom is subject to various legislative obligations. This is due to the increase in volume and complexity of regulations in past years. ERM Compliance delegates the implementation of the approved compliance policy and framework to management. Management is the first line of defence and owns the business and regulatory risks. Compliance maintains and improves Corporate Centre oversight and provides guidance for compliance activities as a second line of defence.
The compliance risk status is reported to the Risk Committee on a quarterly basis. The Committee reports to the Board, confirming that value-added corporate governance is achieved and highlights the seriousness of addressing the risk of noncompliance leading to penalties, fines or sanctions.
Two personal information breaches that affected four data subjects were reported to the Information Regulator. No material/ critical non-compliance issues, repeated regulatory penalties, sanctions or fines for contraventions with statutory obligations were reported by Telkom.
The proper treatment of personal information is important to our customers and employees. They are concerned about cyberthreats and social media exposure as the digital transformation journey unfolds. Telkom dedicated resources toward readiness for compliance with the Protection of Personal Information Act; preparing for obligations under the Cybercrimes Act; and dealing with exposure under the Films and Publications Amendment Act regarding distribution of online content, including social media. There is still a focus on the Payment Card Industry Data Security Standard due to the increase in e-commerce and online transactions since the pandemic started.
Telkom participated in workshops directed by the Department of Cooperative Governance and Traditional Affairs following the comprehensive assessment of national legislation. This was to inform the proper application of section 2(1)(b) of the Disaster Management Act for disaster occurrences that can be dealt with effectively under other national legislation.
The compliance focus areas included ESG matters and challenges in cyber trends
The ERM Strategy is based on four key strategic themes:
The themes represent the envisaged impact that the ERM community aims to have in executing and delivering the overall
Telkom Strategy. Therefore, we implement the strategy to advance the maturity of the risk and compliance capabilities.
It will assist the Board and Exco in successfully enhancing and protecting the Group's value.
The ERM strategic plan (FY2022 to FY2025) represents a strategic document that will be monitored and reviewed annually to ensure the second line of defence work matures. It will also ensure that enterprise risk management across Telkom meets all the requirements of external and internal risk and compliance processes. We will review the ERM strategic intent annually to ensure it aligns with Telkom's strategic objectives.
1 |
Integration: Ensuring the integration and co-ordination of all assurance activities within the Group through collaboration with other assurance providers. | ||
2 |
Accurate data: POPIA readiness highlighted the importance of data integrity. We strengthened the governance environment by appointing Data Stewards who will monitor data accuracy and provide input to the Data Governance Office towards the improvement of data quality. | ||
3 |
Consumer rights: As more consumers use their consumer and personal information protection rights, they will demand transparency as they transact electronically. This will support the importance of moving towards improved data accuracy. | ||
4 |
Employee rights: With many employees working from home, all policies must be updated. This will ensure compliance with laws and regulations, such as working hours and paid sick leave. | ||
5 |
Upcoming legislative changes will require the compliance risk registers to be updated and management to provide updated or additional control measures to mitigate the risk of non-compliance. | ||
6 |
We expect Parliament to focus on the various Bills and amendment Acts in the pipeline that will have a bearing on Telkom, including the amendment Bills for: National Road Traffic, Compensation for Occupational Injuries and Diseases, Disaster Management, Employment Equity, Occupational Health and Safety, Constitution, and Films and Publications that will require management's attention. | ||
7 |
Cyber issues: Cyberthreats, cyberattacks and data breaches can potentially impact Telkom's service levels. This can lead to client dissatisfaction, reputational damage, business disruption and loss of revenue. We continued with our focus on cybersecurity and business continuity plans to protect us and our customers against the unauthorised exploitation of systems, networks, devices and data. |