Combined assurance

Telkom’s combined assurance approach integrates assurance and risk management activities across the group, in line with the combined assurance framework. The framework outlines the minimum requirements for achieving the combined assurance mandate, embeds a consistent approach to combined assurance, and provides a co-ordinated approach, accountability and direction to all assurance activities. The three lines of defence are aimed at improving and monitoring governance, risk management and internal controls across the group.

The combined assurance model incorporates and optimises all assurance services and functions so that these holistically enable an effective control environment, support the integrity of information used for internal decision-making by management, the board and its committees, and support the integrity of Telkom’s external reports.

The board, through the audit and risk committees, oversees the combined assurance model’s implementation. It oversees that the scope of combined assurance is informed by the risks and opportunities that materially affect the group’s ability to create value. Telkom business units and other functional areas are responsible for implementing and reporting on the combined assurance principles in line with the framework.

Telkom Group Internal Audit (TGIA), with Telkom ERM, are responsible for co-ordinating the group’s combined assurance efforts. They co-ordinate their assurance activities with other assurance providers, including external auditors, to ensure that Telkom’s significant risks are adequately addressed.

The audit committee has reviewed the effectiveness of these combined assurance activities, and is satisfied with the current arrangements.

Our regulators (for example, ICASA and the Competition Commission) may institute reviews to gain assurance that Telkom complies with regulation and applicable laws. Such reviews may be considered as an additional defence layer for the board. There were no such reviews during FY2020.

The combined assurance framework is outlined in the diagram below.

  Group exco         Board/audit and
risk committees		      
           


Internal audit

The TGIA’s mandate, as defined in the internal audit charter, is to provide independent and objective assurance and consulting services designed to add value and improve Telkom’s operations. TGIA uses a systematic, disciplined approach to evaluate and improve the effectiveness of governance, risk management and internal control processes within Telkom and its subsidiaries. This helps Telkom accomplish its objectives.

TGIA provides assurance to the group’s stakeholders by:

  • Assessing and making appropriate recommendations to improve Telkom’s governance processes
  • Evaluating the effectiveness of, and contributing to, risk management process improvements
  • Evaluating the adequacy and effectiveness of internal controls

TGIA subscribes to a risk-based audit methodology in developing an annual audit plan which aligns to the group’s most significant risks. It considers internal and external opportunities and challenges in the respective operating environments. TGIA engages with other assurance providers to consider opportunities for combined assurance. The audit plan aims to support business units in achieving their strategic objectives, and to fulfil the role of assurance provider to oversight committees.

The audit committee approves the audit plan annually. TGIA revises the plan on a quarterly basis to remain relevant and align with key business priorities and a changing business and risk environment.

In FY2020, TGIA executed its plan for the year, focusing its coverage on the key risks affecting the group. Further to this, emphasis was also placed on improving the internal processes and methodologies in line with its quality assurance activities improvement programme. In planning the internal audit for FY2021, TGIA considered all group strategic risks and business aggregated risks to ensure the audit plan aligns to the group’s significant risks. TGIA included specific reviews on the FY2021 plan that will be performed with other assurance providers to implement the combined assurance framework.

To ensure the function’s independence and accomplishment of its internal audit responsibilities, the Chief Audit Executive functionally reports to the audit committee chairperson, and administratively to the GCFO. The Chief Audit Executive attends audit and risk committee meetings, and is a standard invitee to group exco meetings or other committee meetings comprising mostly senior executives. This structure promotes the independence of internal audit and allows it to form judgements objectively.

TGIA is subjected to an external quality assurance review at least once every five years. TGIA’s achieved a “generally conforms” rating to the International Professional Practices Framework of the Institute of Internal Auditors based on its external quality review in FY2017. TGIA conducts ongoing internal quality assessments.