Enterprise risk management and compliance

Telkom continues to execute a solid, flexible and resilient risk and compliance strategy that supports achieving our strategic objectives. Telkom operates in economically, politically, technologically, and socially changing environments. This provides unprecedented opportunities and significant, poorly understood threats. As a result, the Group's strategic intent has become more critical, requiring us to balance risks and rewards and monitor strategic risks constantly.

Telkom considers internal and external contexts when reviewing the Group's risks and opportunities, and considers the adequacy of key controls and existing regulatory framework controls. We monitor the effectiveness of risk and compliance to identify improvement areas, and track risk metrics to ensure significant efforts are made.

Furthermore, maintaining and continuously improving risk management capabilities to strengthen the Group's performance remains important. We use control self-assessment exercises and compliance control validation reviews to determine the effectiveness of our risk and compliance management processes. Annual risk and compliance reviews ensure we meet the King IV¹ requirements

1	King IV Report on Corporate GovernanceTM for South Africa, 2016 (King IV). Copyright and trademarks are owned by the Institute of Directors in South Africa NPC and all of its rights are reserved.

			Our approach to risk and compliance management According to their set mandates, Telkom’s governance structures continued to support risk and compliance management across the Group. There were no material changes during the year.
End-to-end assurance		Board	Oversees risk and compliance across the Group. Provides an integrated approach to governance and management of risk and compliance, supported by a risk and compliance operating model aligned with Telkom’s business model.	Oversight
		Risk and Social and Ethics Committees	Monitor and advise the Board on risk and compliance, laws and regulations.
		Group Exco	Integrates risk and compliance management, systems, and people across the Group.
		Integrated Governance, Risk, Compliance and IT Steering Committees	Assess risks and resulting opportunities within the agreed risk framework. Reduce the impact of regulatory risk by driving compliance awareness for all applicable laws, regulations, and supervisory requirements.	Enablement
		Group risk, compliance, business continuity management	Set policies and standards and provide oversight and control.
		ERM forum	Shares best practices and knowledge and monitors key risks and mitigation plans.
		Business unit assurance forum	Affects the ERM framework through effective risk and compliance management and combined assurance to optimise risk taking.
		Business unit risk and compliance management Business unit management	Implement the risk, compliance and business continuity management policies, standards, and frameworks. Apply and maintain the compliance risk registers, identify mitigating controls, implement action plans and operationalise the business unit assurance forum. All business units’ Excos are accountable for managing risk and compliance within the approved delegation of authority (DoA).

The Board committed the Group to an ERM process aligned to the King IV principles, the COSO (Committee of Sponsoring Organisations) Integrated Enterprise Risk Management Framework, ISO 31000 Risk Management Guidelines, and Control Objectives for Information and Related Technologies (COBIT) Framework. All business units, supporting functions, processes, projects, and other controlled entities are subjected to the ERM framework.

ERM is an independent function within Telkom that sets out to achieve the following key objectives:

• Oversight: All critical risks and opportunities are identified Group-wide and are managed and monitored under a holistic approach consistent with the Risk Committee's approved risk appetite statement
• Ownership and responsibility: The ownership of risk is assigned to management individuals who are responsible for identifying, evaluating, mitigating, and reporting risk exposures
• Assurance: The Board, Risk Committee, Group Exco and management have reasonable assurance that all risks and opportunities are being appropriately managed and/or explored within defined governance levels to bring value to Telkom

The Risk Committee oversees the activities of ERM and is apprised regularly by management. The Committee also oversees management’s activities to ensure the ERM framework is embedded and adhered to. In managing and dealing with the Group's risks, Telkom continues to ensure:

• There is effective risk management, which is key to its sustainability, and underpins the Group's long-term relationship with its customers and other stakeholders
• Risk and opportunity management is clearly and consistently integrated into Telkom’s culture and managed according to best practice
• People, processes, and technology support the strategy, underpinned by governance, risk, and compliance requirements
• Group-wide interdependencies are recognised in enhancing business resiliency by anticipating, observing, and responding to the macro- and micro-environments
• Management’s conscious effort to manage risks ensures the business fulfils its mandate and that there is collaboration among all internal structures
• The importance of an integrated, proactive, and continuous approach, which Telkom leverages to sustain the Group, is appreciated across structures
• Potential reputational risks are managed to ensure that all key stakeholders’ needs and expectations are well comprehended and managed

Business continuity management

Telkom focused on strengthening its business resilience activities. We tested the response plans during loadshedding and extreme weather conditions, such as the floods in FY2023. Loadshedding hours increased significantly in FY2023 due to challenges Eskom faced in meeting the power demand. However, Telkom remained resilient due to adequate and effective response plans that factored in stakeholders, critical resources, and alternative power supply solutions such as lithium batteries, standby and mobile generators.

Telkom remains committed to collaboration principles, maintaining communication services under adverse conditions, and supporting local and national governments should a crisis arise. Telkom continues to ensure that its infrastructure, business processes, and emergency management procedures are flexible enough to protect key stakeholders’ interests, reputation and brand.

Telkom completed a global threats assessment that included a list of 36 threats. There are response plans to address these potential threats, and this assessment is ongoing to ensure minimal impact on Telkom’s objectives.

Certain significant events (listed alongside) occurred in Telkom’s business operations during FY2023. These events are characterised as unintended/unplanned occurrences that expose the Group to risks that have either happened or are imminent and inevitable. These risks significantly affect business-as-usual operations and Telkom’s strategy execution, which might have an immediate and long-term impact on achieving strategic goals.

Disaster management and response structures such as the Group Emergency Management Team and the Regional Emergency Management Teams continue to manage crises effectively, as mandated by the GCEO. In FY2023, the teams managed:

Power outages: Power outages have become common in South Africa. As a result, Telkom had to respond from both a tactical and strategic perspective to keep the lights on and, in the long run, minimise the adverse effects of energy shortages and create efficiencies. Telkom manages this by deploying various response strategies. For example, in response to escalated loadshedding levels, Telkom developed a Groupwide power outage preparedness plan covering all scenarios from Stage 1 to blackout. This plan is continuously deployed and minimises the impact on our business operations.

Nelson Mandela Bay water crisis: Water disruptions affect several suburbs in the Nelson Mandela Bay Municipality due to the ongoing drought and declining levels at the major storage dams. Telkom continues to participate and contribute to the various forums led by the city. As part of the Day Zero Programme in the Eastern Cape province, Telkom identified 55 sites that should be considered for audits and interventions to improve water security. This was achieved by reducing water demand and diversifying the water supply.

Severe weather conditions: The latter part of the year saw severe thunderstorms, record-breaking heavy rainfall and flash floods that damaged national infrastructure. There were no significant incidents that negatively affected Telkom’s infrastructure. Telkom sent employees a communiqué to caution them to practice vigilance and stay safe during expected heavy rains and flooding. We continue participating at the National Disaster Management Forum, where potential disasters are assessed, closely monitored, and mitigated. This approach allows Telkom to improve its threat detection and enhance its response plans proactively.

The Group’s Business Continuity Programme is robust and effective in managing various threats that could disrupt our operations, with identified areas for improvement. We will improve the programme further to ensure the Group’s overall resilience and anti-fragility.

Emerging risks in FY2023

In FY2023, Telkom continued to monitor and assess the identified emerging/external risks and opportunities as and when it was of the view that these might impact the Group.

Our strategic risks¹

Unanticipated events continued to unfold during FY2023, leading to several critical challenges for Telkom to manage speedily to avoid significant exposure for our business. Therefore, Telkom focused on building a resilient culture that can adapt at the speed of change experienced.

1

Macro-economic risks likely to impact Telkom’s growth opportunities, such as economic conditions and the capability to access funds.

2

Strategic risks with the potential to affect Telkom’s business strategy/ objectives. These risks are uncertainties or opportunities that could guide decisionmaking. These are crucial matters that the Board, shareholders, or investors should be concerned about regarding strategic intent

3

Operational risks with the potential to impact critical operations through increased cyberattacks, supply chain disruption and non-compliance.

Telkom identified the risks in the context of its financial and non-financial strategic objectives. The same key risks were tracked in FY2022 and FY2023. Some residual risk ratings increased due to changes in the micro-environment, specifically relating to the negative global economic outlook.

The risk heatmaps alongside reflect the residual risk rating, which considers the mitigation controls in place.

1	The enterprise risk management and compliance report starting details Telkom’s material risks according to the governance requirements contained the JSE Listings Requirements. This report is available online .

1	Unstable and unpredictable regulatory dispensation
2	Market forces and disruption exacerbating competition pressures
3	Inability to attract and retain a suitable, resilient and healthy workforce to service and support the changing ecosystem
4	Increased focus and scrutiny on ESG matters
5	Financial sustainability
6	Macro socio-economic instability

1

Unstable and unpredictable regulatory dispensation

	Risk definition	Mitigating activities and monitoring	Assessment rationale and opportunities arising from managing risks
	Unstable and unpredictable regulatory dispensation influenced by the changing market, customer and technological trends may impact Telkom’s long-term decision-making and investment aspirations. It also creates competitive pressures and unexpected costs that can hamper Telkom’s profitability and sustainability.	Continuous engagement with key government stakeholders Continuously manage our compliance universe effectively to improve our relationship with regulators and ensure we remain compliant Proactively implement new legislation Continuously scan the regulatory environment (including outside of ICT) Empower and support the regulatory and compliance teams Continuously monitor key risk indicators	Regulators are responsible for creating a stable and predictable regulatory environment where all businesses may function. The regulatory system also needs to adapt in previously unexpected ways to the changing economic, social, and technological realities. This unpredictability makes it difficult for regulators to prepare. The above directly drives Telkom’s exposure to competitive pressures and unexpected costs, impacting the Group’s ability to remain relevant. This uncertain regulatory regime continues to challenge Telkom’s approach to investment cycles and patterns, speed of launching new products and services and enhancement of competitive opportunities. Telkom continues to interact to introduce regulatory flexibility, which is particularly important in a sector constantly undergoing significant technological and market changes. Opportunities still exist for the organisation to continue participating in regulatory discussions to influence various legislation to get the best possible result, including the level of the competitive landscape, to which Telkom aspires. Telkom continues to monitor the risk related to ICASA and spectrum licensing. There is an opportunity to work with the regulator to understand the situation and influence some regulatory aspects to strengthen the Group’s position, including a levelled competitive landscape. An opportunity also exists to review the high cost of compliance, whether in terms of infrastructure, technology or people, and the time spent ensuring compliance.

2

Market forces and disruption exacerbating competition pressures

	Risk definition	Mitigating activities and monitoring	Assessment rationale and opportunities arising from managing risks
	Telkom operates in a competitive and rapidly changing market. The increase in technological innovations, accelerated market deregulations, customer expectations, and new entrants in the connectivity space exacerbate this risk. These put pricing and product offerings under pressure as Telkom strives to remain competitive. Failure to swiftly respond to competitive threats could negatively impact the Group’s prospects, including its market share, relevance, revenue growth and profit margins.	Continuously monitor the market and competitive landscape, using artificial intelligence to gain further insights Develop product offerings that appeal to customers and explore upselling opportunities Develop and implement adaptive strategies focused on innovation Investigate strategic partnerships to increase competitive advantage Continuously implement and enhance our employee value proposition to ensure the competition does not poach our critical employees Invest in technology that ensures agile and speedy solution delivery Continuously identify and address operational inefficiencies	The risk remains a strategic priority as products, services and technology are crucial for our transformation and competitiveness. Competitors have aggressively challenged Telkom’s pricing. This may necessitate market research or benchmarking to remain competitive. The new mobile virtual network operators (MVNOs) segment and OTT partners increase competition in IT services and telecommunications (fibre and mobile), amplifying this risk. Telkom focused on business process reengineering and incremental innovation, evolving the customer value proposition and pricing flexibility, fibre investment, and Value Unlock strategies and projects as risk-reduction initiatives. Telkom remains committed to identifying and implementing opportunities as soon as practicable. Refer to unpacking our pivot strategy for more information on Telkom’s strategy.

3

Inability to attract and retain a suitable, resilient and healthy workforce to service and support the changing ecosystem

	Risk definition	Mitigating activities and monitoring	Assessment rationale and opportunities arising from managing risks
	The world is experiencing several changes, such as a shift in how companies work, hybrid working models, customer behaviours, and technology trends. This requires talent that can provide a sustainable competitive advantage. Failure in this regard could result in loss of competitive advantage, increased employee costs and delays in achieving the Group’s strategy.	Continuously implement the culture transformation journey Review and implement the recruitment strategy, which will merge the demands of business while allowing flexibility to the workforce to align with market demand Develop and implement change management processes to keep up with the pace of change and enable a robust environment	Telkom continues to face challenges on talent and employee turnover as people can work anywhere in the world, and the skills of the future are in short supply. The issuance of Section 189 notices and Telkom’s future operating model will exacerbate this risk. Opportunity exists to implement effective internal succession planning and capability development to address the insufficient supply of talent and skills. Furthermore, Telkom and BCX were certified as Top Employers for 2023. This may position the Group towards retaining and attracting external critical skills. Telkom continuously identifies opportunities to improve strategies to attract relevant skills to participate in the digital world and review the retention strategy for critical talent. Refer to human capital chapter for more informatio.

4

Increased focus and scrutiny on ESG matters

	Risk definition	Mitigating activities and monitoring	Assessment rationale and opportunities arising from managing risks
	Increased focus on ESG matters is due to the rapidly heightened importance of sustainability matters in society, increased climate change awareness, social inequality, and corporate misconduct. This might impact Telkom’s financial sustainability and reputation and limit access to opportunities.	Implement the Group ESG Strategy with defined roles and responsibilities Integrate ESG risks into the ERM framework	The risk remains a priority and the ESG Strategy is being executed. Governance structures are formed to drive the implementation (i.e. ESG Impact Council) that will guide, integrate, and develop portfolios for the six defined ESG themes across Telkom. In driving the strategy, several inflight projects will translate Telkom’s intention into actions. Telkom has the chance to innovate aggressively to remain relevant and competitive while contributing to the Group’s and the country’s general sustainability goals. Refer to Unpacking our PIVOT Strategy for more information on Telkom’s ESG Strategy.

5

Financial sustainability

	Risk definition	Mitigating activities and monitoring	Assessment rationale and opportunities arising from managing risks
	Maintaining financial capacity is crucial to sustain or grow operations while building adequate financial resilience to manage unforeseen economic events. This risk is due to: A depressed economic environment Insufficient liquidity and/or cash flow deterioration Inability to generate free cash flow Customers not paying on time Unsustainable leverage ratios	Monitor our sustainable Cost Management Programme Launch new products to drive revenue Continue with cash release initiatives, such as the Supply Chain Finance Programme Maintain adequate debt headroom and disciplined capital allocation with flexible capex investments and secured debt facilities Maintain a sound governance framework that ensures transparent financial and operational frameworks and supportive credit ratios	Financial sustainability is a priority for the Group. Customer retention and experience are key to building a financially sustainable business. The macro-economic instability increased Telkom’s business cost and resulted in decreased profits due to customers constantly seeking cheaper options. Telkom experienced a financial performance gap due to the loadshedding crisis, inflationary pressure, consumer pressure on living expenses due to interest rate hikes, and high energy and fuel prices. These factors continue to strain Telkom’s operations. We have an opportunity to build financial resilience in the face of a demanding trading environment, focusing on several levers: Selling qualifying device receivables to external financial institutions Pursuing cost-cutting measures with long-term benefits Cash preservation Disciplined capital allocation Mitigating financial risks, such as liquidity Growing the business Refer to financial performance for more information.

6

Macro socio-economic instability

		Risk definition	Mitigating activities and monitoring	Assessment rationale and opportunities arising from managing risks
		Telkom is not immune to the critical characteristics introduced by socio-economic matters that influence consumers’ behaviours, preferences, attitudes and quality of life. Therefore, this instability creates uncertainty, particularly where consumers are critical to the Group’s success This volatility affects the levels of profitability and cash generation that are considered acceptable. It also impacts our shareholders’ perspective on the Value Unlock Programme and future growth.	Formulate and implement initiatives and frameworks aligned with the National Development Plan Enforce collaborative efforts with social agents and foster private-public partnerships Strengthen corporate social responsibility initiatives Continue to execute on the development and implementation of the youth employment strategy Continue to invest in advocacy that assists in driving a positive behavioural change	This risk is influenced by macro-environmental factors over which Telkom has no control. However, how we manage our financial stability contributes to managing this risk. The macro-economic instability increased Telkom’s business cost and resulted in decreased profits due to customers constantly seeking cheaper options. Weak global economic conditions, rising inflation and the energy crisis hampered South Africa’s economic growth. Unemployment continues to rise. There are opportunities to offer products and services that improve the country’s economic agenda, and to partner with communities to address unemployment issues, break the digital divide, and grow small to medium businesses. Refer to Unpacking our PIVOT Strategy for more information on our strategy and social and relationship capital for more information on our ESD support and the work of the Telkom Foundation.

 

There are opportunities to partner with communities to address unemployment issues, break the digital divide, and grow small to medium businesses.

Compliance

As an ICT service provider, Telkom is exposed to evolving regulatory and compliance requirements, including growing ESG compliance expectations from stakeholders. We have zero tolerance for regulatory non-compliance, fraud and corruption. We are committed to fulfilling relevant compliance requirements and disclosure and reporting obligations to maintain our reputation.

Group Exco annually reviews and approves the regulatory universe derived from our risk-based approach. Our compliance function reviewed and communicated the compliance management policy and framework through the annual compliance commitment drive. This requires employees to acknowledge the content of the documents and commit to complying with them. Our business units have established compliance functions with the Corporate Centre providing oversight and guidance.

Our compliance plan, with quarterly deliverables, aligns with the ERM Strategy to enhance the Group’s risk and compliance culture. We provide compliance plan progress reports to the various governance structures, including the ERM forum and Integrated Governance Risk and Compliance Committee. The Risk Committee and Board receive a detailed report on the status of the Group’s compliance every quarter.

The stringent compliance regime supports our combined assurance approach through our three lines of defence and regular reporting. The compliance function also reports to the IT governance structures and the economic crimes forum on data privacy, cybersecurity, and potential areas of non-compliance.

We remain committed to reducing, recycling and disposing of waste under the Extended Producer Responsibility Regulations of the National Environmental Waste Management Act for the Electronic and Electric sectors. The compliance function monitors the required reporting.

Telkom has acted to protect the environment further and move towards a climate-resilient economy in line with the Climate Change Bill. In FY2024, we will await the finalisation of the bill and the publishing of supporting regulations. Our environmental, sustainability and tax services divisions implemented controls to ensure ongoing compliance with the Carbon Tax Act requirements in line with the government’s commitment to reduce carbon emissions.

We enhanced our employee health and safety relating to the 2022 Asbestos Abatement Regulation by identifying asbestos-containing material at sites and reducing the risk of human exposure, and by monitoring ongoing adherence to labour relations legislative requirements. Telkom addressed customer protection matters and introduced additional data privacy processes to benefit the customer.

The compliance function monitored the Companies Amendment Act requirements, confirmed control effectiveness with the King IV principles, updated compliance risk registers with amended JSE Listings Requirements, supported Telkom’s commitment to the ESG frameworks and reviewed the impact on business of the Protection of Constitutional Democracy against Terrorist and Related Activities Bill.

Focus areas FY2024
ERM	Compliance
Ensure the integration and co-ordination of all assurance activities within the Group through collaboration with other assurance providers Review the Group’s ERM governance policies and procedures and approved risk tolerance levels to ensure it remains relevant Refine business continuity management strategies across all the domains Continue to foster strong business collaboration by being involved in strategy and business planning and other key project initiatives Create environments to increase ERM capabilities and drive frequent monitoring of ESG-specific risks Review the Group’s strategic risks	The compliance and regulatory horizon for the foreseeable future will demand attention on the following acts before Parliament: The amendments to the Employment Equity Act and Compensation for Occupational Injuries and Diseases Act were reviewed. These bills will impact equity targets for economic sectors and geographical regions as well as compensation for disablement or death caused by occupational injuries. The compliance risk management plans were updated with additional requirements, which will be monitored through control self-assessments Tobacco Products and Electronic Delivery Bill, which seeks to change where people can smoke and to hold employers accountable to protect non-smokers from tobacco smoke exposure at the workplace The impact of the Taxations Laws Amendment Act and Tax Administration Laws Amendment Act will be assessed to ensure Telkom has adequate controls in place to mitigate the risk of additional requirements