Enterprise risk management and compliance

Telkom operates in a volatile and uncertain industry. It is difficult but critical to maintain an appropriate balance between risk and reward. Telkom recognises it needs to take certain risks to achieve sustainable growth and returns, while protecting the group and its stakeholders against avoidable risks.

Telkom’s operating environment is set out on Material aspects of our value-creation process and impacts our risk management.

Our approach to risk and compliance management

Telkom’s governance structures continued to operate within the set mandate across the group.

Our risk and compliance transformation journey

We continued progressing the previously set transformation journey to enhance the group’s risk management approach and framework. Risk transformation recognises risk as a prerequisite to doing business and, as such, integrates risk oversight, governance and management into Telkom’s business activities.

In managing and dealing with the group’s risks, Telkom ensures:

  • Risks and opportunities are transparent and concise prior to any approvals and decision-making is effective
  • Risks that Telkom wants to take in pursuit of value are clear and grounded with facts
  • External factors are considered (i.e. regulatory matters, supplier performance and macro-economic matters)
  • People, processes and technology support the strategy underpinned by governance, risk and compliance requirements
  • Group-wide interdependencies are recognised

Some improvements in FY2020 as part of the journey towards a risk intelligent group included:

  • Developing the risk appetite statement that emphasises the board’s interest in protecting Telkom’s reputation and brand erosion
  • Creating a common risk language across the group, aligned with approved frameworks across risk, compliance and business continuity management
  • Strengthening the move from standalone risk and compliance management processes to integrated day-to-day decision-making in support of value creation
  • Strengthening Telkom’s ability to respond to disasters (i.e. prolonged electricity challenges, effects of storms and floods on the network and epidemic/pandemic crisis management)
  • Business unit assurance forums, which give effect to combined assurance and the implementation of the ERM framework at a business unit level. Telkom continued its practical approach to combined assurance by embedding and combining assurance activities across all lines of defence
  • Protecting the interests of all Telkom’s stakeholders by maintaining sufficient levels of liquidity, strengthening the balance sheet, optimising cash flows and mitigating and monitoring the financial risks to which the group is exposed
Our strategic risks

Our strategic risks, mitigating factors and opportunities are set out as follows.

The group performed a risk assessment to identify strategic risks, which are those that bear the most significant impact on the group’s ability to achieve and realise its strategic objectives. We used a bottom-up and top-down approach to ensure a holistic risk management process.

Business continuity management

Telkom’s business operations have been affected by several significant events, defined as unintended/unplanned occurrences which exposed the company to risks that have either materialised or are imminent and unavoidable. Some of these risks significantly impacted business-as-usual processes and the execution of Telkom’s strategy. The current operating environment is unprecedented in a way that the following related and unrelated significant events collided within the group within a short time horizon. However, it is to be noted that the business continuity processes have been invoked to ensure continuity across the group.

Management of these significant events was done through the established Group Emergency Management structure that reports to the Telkom Group executive committee (exco). The structure’s mandate is to ensure continuity of service delivery through infrastructure, buildings, equipment, processes and human capital to guarantee the implementation and effectiveness of defined emergency management procedures.

During the year we dealt with the following significant events:

COVID-19 outbreak   Power outages1 and load shedding2

The outbreak of COVID-19 interrupted businesses globally. Like any company, we are concerned about the health and safety of employees. We ensured measures were effected to curb the spread of the virus.

Before the outbreak of the pandemic in the country, Telkom proactively designed and implemented measures to mitigate the risk of the COVID-19 impact on our operations with specific focus on the health and safety of employees, continuity of supply and service to customers, supply chain, infrastructure and network, information security and liquidity. Noting that the number one priority is the wellness of our people and our business continuity, Telkom’s response was to ensure that all employees are protected and supported during these extraordinary times. The following measures were immediately put in place:

  • Different scenarios were developed to advise exco on the appropriate response and approach to take in dealing with the pandemic
  • Approximately 80% of employees were empowered to work from home, while frontline staff and field service technicians were provided with protective clothing to enable them to continue to serve customers
  • The adequacy of inventory levels for short-term and medium-term consumption was assessed to ensure stability of operations
  • Ensured continuity in all services related to customers by prioritising critical services and the support that goes with it
  • Cash preservation and maintaining adequate cash balances has become of the utmost importance as a result of the destructive impact of the COVID-19 pandemic on the economy. Therefore, as a priority, Telkom focused on optimising cash flows, maintaining sufficient levels of liquidity, and strengthening the balance sheet to mitigate and monitor the financial risks
  

South Africa is exposed to regular load shedding. This intensified in the last quarter of FY2020 with prolonged stage 4 load shedding, and an unexpected stage 6. Stage 6 load shedding meant disruptive load shedding up to 18 times over a four-day period for four hours at a time.

Power outages pose a threat to our customers, which in turn impacts their ability to do business with Telkom. Load shedding events also cause a threat to our ability to provide uninterrupted services to customers as it results in a spike in battery theft from cell phone towers.

In managing the power outage/load shedding, we ensured that our response plans are adequate and effective across all key areas such as stakeholder management, technical (backup power, alternative power solutions, diesel, water and mobile generators) and resources where all critical resources (i.e. employees) were mapped in a plan. Telkom also developed a model at a group level to manage essential and critical services in the event the organisation is faced with various stages of load shedding thresholds (i.e. stages 4 – 8 and including blackout).
  Extreme weather conditions (floods)
 

KwaZulu-Natal experienced heavy rainfall and tornados between April and December 2019. This caused floods that impacted service delivery in Telkom’s eastern and central regions. The first floods coincided with an Ethekwini Central Municipality district strike that prevented access to manholes and roads in Durban central, affecting fault finding and copper cable repairs. Employees were impacted in their private capacity with house and road flooding and fence and wall collapses.

Resources from other regions were dispatched to assist with service restoration. Although the GEMT monitored the incident, the regions managed the impact back to business as usual.

The GEMT ensured uninterrupted service to hospitals and other essential service providers, rapid deployment of temporary electronic communications networks where required and provision of personal protection equipment for employees in call centres and field service.

1 Power outage is the loss of the electrical power network supply to an end user
2 Load shedding is the action taken to interrupt electricity supply to avoid excessive load on the generating plant.
Risk definition
and impact		     Mitigating
activities		     Opportunities arising
from managing
the risk

Competitive threats

Telkom operates in a rapidly changing technological environment. Pricing and product offerings are under pressure as Telkom strives to remain competitive.

Failure to swiftly respond to competitive threats could negatively impact the group’s market share, revenue growth and profit margins.

The spectrum auction/allocation also gives rise to the risk as it puts pressure on Telkom’s competitiveness.

    
  • Continuously exploring the possibilities of investing in advanced technologies
  • Perpetually reassessing and aligning of go-to-market strategy to ensure relevance
  • Reviewing market performance to inform changes towards customer experience improvement
  • Addressing customer feedback from stakeholder management and competitive/market intelligence studies
  • Focusing on continually introducing new products to attain sustainable competitive advantage
  • Ongoing review of regulations and amendments that might change the market outlook

Key FY2020 activities

  • Launched innovative price-disruptive products to attract subscribers, focusing on growing mobile data and digital voice, including SmartBroadband, SpaceStream Home and Smart, and FreeMe data bundles
  • Identified key market segments on which Telkom Consumer can focus its constrained resources
  • Telkom Plus, a new mobile value-added Services (VAS) aggregation content platform, was launched in December 2019, offering new mobile content services. Services were offered in phases, and later quality content was rolled out. The platform is temporarily used for video and content streaming
    

There are opportunities to increase Telkom’s market share and improve revenue growth and profitability through an increased focus on innovation, adaptation and execution of the strategy.

The IT and digitalisation strategy will leverage Telkom’s capabilities, which in turn will improve the IT enablement challenges and improve competitive advantage.

Working from home has brought an increased opportunity with regard to data consumption for mobile and fixed broadband.
Risk definition
and impact		     Mitigating
activities		     Opportunities arising
from managing
the risk

Customer experience

Customers’ experiences can be compromised by long turnaround times, unreliable networks and systems, and misunderstanding of customers’ needs.

If Telkom does not meet rising customer demands for innovative product offerings, this could place the group’s profit margins at risk and result in lost revenue.

    
  • Improving and crystallising Telkom’s customer value proposition and aligning it with customers’ needs and expectations
  • Addressing customers’ interaction with Telkom by using the customer value proposition and data collected across all customer touchpoints to:
    • Improve training for customer-facing employees
    • Refine processes that improve service delivery
    • Enhance application capabilities
  • Continuous monitoring of customer experience initiatives across the group to ensure synergies across, for instance, network build, business projects, service management support model, and digital applications and systems
  • Upgrading multiple elements across the data centre network and critical hardware to provide appropriate support for customer-centric applications and systems

Key FY2020 activities

  • Implemented the Click system, which optimised the dispatching process, enhanced customer centricity and improved the fault clearance rate
  • Started implementing the revised customer experience strategy, enriched the customer experience lifestyle and convenience
  • Modernising the network in Openserve, which has reduced assurance visits by 42% and reduced redispatch rates by 42%, which has also improved service delivery
  • Network projects are underway to ensure customer experience is improved, including customers in rural areas without network coverage, which are migrated to a fixed-line look-alike product. Customer disputes, billing and escalation queries have reduced
  • Empowering agents resulted in 60% less disputes to the back office
  • Enhanced digital platform for customers to request call-back through any Telkom app, Telkom website and WhatsApp
  • Enabled customers to navigate problem resolution
  • Enhanced IVR (Interactive Voice Response) with self-service capabilities
    

There are opportunities to increase our customer loyalty, retention and satisfaction through intensified cross-selling and up-selling, and improvements in our network availability and stability, which in turn will increase revenue.
Risk definition
and impact		     Mitigating
activities		     Opportunities arising
from managing
the risk

Technology enablement to achieve business objectives

As a minimum, evolving our IT solutions is required to, align with the pace of customers’ constantly evolving needs. Ineffective system architecture and inefficient and costly legacy IT systems pose a risk to the decentralised operating model.

   
  • Developing and implementing an IT operating model, including an IT and digital strategy, and IT governance
  • Reviewing and implementing a technology strategy that is forward-looking and will position the group for the future
  • Developing, implementing and executing on an application decommission roadmap

Key FY2020 activities

  • Developed and successfully implemented the IT operating model
  • Developed the IT and digital strategy, which leverages current capabilities and will improve IT enablement challenges
  • Started executing the IT transformation (operating support system) programme
  • Reviewed and aligned IT governance, and ensured approval of policies, standards and framework
    

Through enhanced technology, there is a concentrated effort towards enhancing end-to-end service delivery. This will strengthen Telkom’s value proposition to shareholders, customers and employees, improve efficiencies and allow Telkom to stay abreast of technology evolution.

Risk definition
and impact		     Mitigating
activities		     Opportunities arising
from managing
the risk

Possible changes in legislation and regulatory requirements

Unexpected changes in regulation, e.g. relating to spectrum (the lifeblood of the mobile industry), may negatively impact revenue growth and financial stability.

Possible non-compliance with laws and regulations could damage Telkom’s reputation and incur penalties.

    
  • Enhancing risk and compliance governance across all business units
  • Regular engagements with internal and key government and regulatory stakeholders including ICASA, Department of Communications and the Competition Commission
  • Continuous employee training on key legislation
  • Monitoring proposed changes in legislation and regulations
  • Ongoing regulatory risk assessments, control identification and compliance monitoring exercises

Key FY2020 activities

  • Created a cross-functional team involving all business units to manage the overall process. The team reports regularly to exco and the board for decision-making and consults with the necessary technical, economic and legal experts
  • Appointed spectrum auction experts to assist in updating our spectrum strategy and prepare for the upcoming spectrum auction (commercial, technical and financial modelling)
    

There is an opportunity to influence some regulations introduced to ensure we derive optimal outcome when engaging with internal and key government stakeholders in matters relating to regulatory changes. By so doing we will realise benefits on our revenue growth and financial stability.

Managing our compliance universe effectively has the benefit of improving our relationship with regulators.
Risk definition
and impact		     Mitigating
activities		     Opportunities arising
from managing
the risk

Information and cybersecurity management

Telkom has processes, controls and a robust information security governance and assurance model in place as certain malicious activities pose a risk to the group. Ineffective management of information and cybersecurity could lead to reputational damage, loss of customers and consequently, revenue loss.

   
  • Monitoring the information security strategy
  • Deploying the information security management system
  • Continuously monitoring operational security management
  • Conducting security assessments across the group to re-examine the information security strategy, and raise awareness on matters regarding information security

Key FY2020 activities

  • The information security management system gained significant traction and was successfully implemented. The technology capability is currently being transitioned to a fully managed service that will provide for both proactive and reactive threat management
    

There are opportunities to ensure threats are handled in an integrated and cost-effective manner to ensure information protection. We can increase customer loyalty by creating customer awareness of how Telkom handles compliance with data regulations and cybersecurity requirements.
Focus areas for FY2021

Having established a strong risk and compliance management governance base over the past two years, our future focus is on equipping the function to continue ensuring that we are a risk intelligent organisation, adding to value creation and reshaping the future of Telkom.

The critical events mentioned here took up much of the risk structure’s time in FY2020. Therefore, some activities such as strategy development and finalisation of risk tolerances were deferred to ensure that Telkom responds to the critical events affecting the group’s sustainability. Our FY2021 efforts will consider the changing environment post COVID-19, and the key focus areas will include:

  • Playing an advisory role by proactively providing necessary information for strategic decision-making
  • Undertaking a predictive analysis or futuristic approach
  • Strengthening opportunity management

COVID-19 has challenged most of the thinking and models the business has applied and put in place to date. In this regard, Telkom has embarked on a programme to proactively reflect on risk and opportunity management post COVID-19. The new normal will likely be a business environment where an economic downturn impact will be with the organisation for a prolonged period, and much learning from COVID-19 might determine the medium to long-term risk mitigation strategies. All our efforts will be more aligned with futuristic thinking to ensure sustainability.

Compliance

The compliance function assists Telkom in ensuring compliance with laws, regulations, rules, standards, policies and guidelines governing operations as documented in business unit-specific compliance risk management plans. Telkom’s compliance framework and group regulatory universe were reviewed and approved. Various laws and regulations were signed off in FY2020 and the compliance risk management plans were updated or developed accordingly.

The telecommunications landscape is influenced by changes under the Electronic Communications Act and regulations and inquiry documents issued by ICASA. Among others, management was informed about the amendments to the JSE Listings Requirements, impact of the Carbon Tax Act and related regulations, the obligations under the Critical Infrastructure Protection Act and the Draft Constitution Eighteenth Amendment Bill which addresses the expropriation of land.

No material or repeated regulatory penalties, sanctions or fines for contraventions of, or non-compliance with, statutory obligations were reported.

Focus areas FY2021
  • Support business in enhancing the risk and compliance conscious culture through training and awareness documentation
  • Maintain a process with other governance support functions for regulatory input on bills before parliament, where applicable to Telkom
  • Enhance focus on privacy and cybercrimes legislation throughout the group to ensure business readiness
  • Conduct an internal maturity level analysis across the business units’ compliance functions