MTN Group Limited Integrated Report for the year ended 31 December 2015

Risk management

Risk management, compliance and corporate governance committee chairman’s report

The role of the committee is to oversee risk management, compliance and corporate governance across MTN Group’s 22 operations and jurisdictions and make recommendations in this regard to the board for consideration and approval.

Among its responsibilities (more details of which are on 51), the committee assists the board in ensuring that the risk profile of the Group is acceptable and is within the Group’s risk appetite, its assets are protected, and that the Company is compliant with legislative and regulatory requirements. It also assists the board in ensuring that MTN’s identification and management of risks is comprehensive, timely and relevant.

While regulatory risk was considered one of the Group’s top risks in both 2014 and 2015 (see the top risk table on 24), the events of 2015 showed that closer monitoring of compliance with laws across all markets was necessary.

Indeed, the imposition by the Nigerian regulator in October 2015 of a significant fine on MTN Nigeria put regulatory risk and compliance at MTN under the spotlight. It provided the committee with an opportunity to review the robustness of its structures and improve management processes and training on compliance and regulation throughout the Group.

We noted the deleterious consequences of some aspects of some Group policies, recognising that the drive for revenue growth must not be at the expense of compliance with rules and regulations.

It also led to the creation of a more formalised MTN Group compliance function, which will ensure adherence to laws and regulations in each operation and facilitate the unhindered flow of information between operations and the Group, particularly in matters regarding legal compliance and risk. In this way, we put structural safeguards in place, making the Group better able to monitor compliance timeously throughout its operations.

The executive committee and the board approved the new compliance operating model and structure in February 2016. For more details, see 54.

Apart from the focus on compliance prompted by the Nigerian fine, the committee’s work in 2015 involved monitoring the rollout of Project Next! (MTN’s back office transformation programme), IT and treasury governance as well as close attention to business continuity management and crisis risk management. In particular, the committee provided advice to management during the Ebola crisis and in war-torn countries like Syria, Yemen and Afghanistan.

We worked to implement a plan to develop a sustainable, manageable and effective capability to respond to business disruption, such as that which arose during industrial action in South Africa.

While the Ebola outbreak continued in early 2015, MTN’s operations in Liberia and Guinea-Conakry continued unhindered. Several MTN opcos were impacted by adverse security situations, yet employees ensured that services remained operational except for some isolated closures of service centres. In the instances of outages impacting towers, opcos called on disaster recovery and business continuity plans to implement re-routing to make up for site failures. Continuing work in this regard remains a priority.

In 2016, the committee will focus on:

implementing an integrated approach to compliance, governance, reputation and ethics management, including more rigorous training at board and opco level on these;
aligning the objectives of operations to ensure a balance between financial performance and risk management, compliance and ethical business practices;
enhancing business continuity activities to ensure readiness as and when the need arises amid a deteriorating security situation in some markets;
improving information security practices; and
monitoring the rollout of Project Next! and the benefits realised by each operational unit.

MTN is committed to sound risk management, compliance, governance and internal controls to facilitate the delivery of the Group strategy. The committee will continue to ensure robust and relevant structures, processes and systems are in place to enable the close monitoring of risk and compliance across operations.

Peter Mageza
2 March 2016

Our risk management process

The careful management of risk is critical for the MTN Group to achieve its strategy, which is driven through board-approved strategic priorities, which are constantly monitored.

The MTN board understands and takes accountability for all risks and delegates the responsibility for overseeing the effectiveness of risk management to the board’s audit committee, the risk management, compliance and corporate governance committee, the remuneration and human resources committee as well as the social and ethics committee.

We use a combined assurance methodology, details of which are set out below. For details of our top risks, ( 24).

Aligning risk management and corporate governance

MTN’s risk management frameworks guide the operation of our business units, which are primarily responsible for risk management. In recent years, the Group has faced challenges implementing the risk management framework consistently across all operations.

In 2015, we commissioned an independent assessment of the quality of work performed by BRM, to benchmark the BRM function in relation to world-class best practice, to assess the maturity of the BRM function and to design a future state together with a roadmap for transforming the BRM function.

The assessment indicated the overall maturity level of the function to be “evolving”. Subsequently, management implemented a three-year plan to improve the maturity level to “established”. For MTN, an “established” level means that pertinent risks and material issues are effectively managed to meet stakeholder expectations to both protect and enhance value.

We set up working groups to drive the implementation of the roadmap. These focus on:

Revising BRM’s current purpose;
Defining a new BRM operating model (inclusive of a new skills set);
Enhancing processes, incorporating revised methodologies, reporting lines, quality assurance, and knowledge sharing;
Implementing a new technology tool; and
Integration and change management of the function.

Critical success factors will include, among others:

The right tone at the top, both at the Group level and all operating units and entities;
Clear measures of success and regular and robust monitoring of performance; and
Strong relationships at all levels of the business.

Business continuity management (BCM) and crisis risk management (CRM)

Some of the major events which occurred in the past year highlighted gaps in our Group-wide BCM programme. To ensure that these gaps are addressed, we initiated a Group-wide BCM project to revamp and streamline our BCM approach and ensure that the Group has an effective structure to respond to disruptions in our business.

Our BCM approach leverages on industry best practice and standards, including ISO 22301 standards for BCM and the Business Continuity Institute Good Practice Guidelines, and ensures that we put in place adequate measures to protect our business brand and reputation and comply with statutory, regulatory and contractual obligations.

We enhanced and supported our BCM programme by introducing a Group-wide crisis management programme, which aims to improve our capability to respond to and manage crisis events across the MTN Group.

Insurance and risk transfer

The MTN insurance programme is built around the close connection between risk management and insurance using an annual assessment of risk management at each operating company.

To achieve this, there is a strong commitment to the risk management assessment process, improving operational management’s adoption of risk management best practices and to reduce risks across the entire insurance programme.

MTN has an insurance programme in place that covers perils such as physical/material damage, business interruption, political risk, public liability, directors’ and officers’ liability, crime and professional indemnity. The limits of indemnity for these covers have been structured so that MTN has adequate cover for its risks, but also gets maximum value from the programme and that premium spend is efficient. We also believe that risk retention and self-insurance are necessary to keep premiums at reasonable levels and show commitment towards risk management. MTN’s retention levels differ from policy to policy, guided by the nature of the risk being transferred.

MTN has a cell captive structure in place to support the insurance programme. In 2015, we continued to build the captive’s capacity for additional risks which may best reside within it.

This includes financial lines (fidelity guarantee, professional indemnity, and directors’ and officers’ liability) cover for Iran, Sudan and Syria which are uninsurable due to sanction constraints and/or political violence. We have no political violence cover in place for Syria and Sudan and no political risk cover in place for Syria, Sudan or South Sudan. Other operations that are not covered under this placement are South Africa, Botswana, Cyprus and Swaziland, as risk is perceived as low in these countries. Afghanistan is covered under a Multilateral Investment Guarantee Agency placement and Iran is covered under an Export Credit Insurance Guarantee Agency.

Information and technology governance

MTN acknowledges information and technology as integral strategic assets to the business in delivering a bold new Digital World to its customers. MTN’s commitment to sound governance is supported by the ongoing activities and efforts in embedding the King III Code of Corporate Governance principles and recommendations, with specific focus on technology governance through the establishment of various responsibilities, processes and supporting governance structures.

The Group information security function monitors the rollout of the security framework as per the deployment plan. Compliance to the framework will be independently assessed. Further, a new cyber strategy is being developed to ensure threats and vulnerabilities are proactively managed.

Adequate effort at all levels and proper risk management practices will continue to ensure that technology governance is fully integrated across all MTN operations and that current and emerging information security risks, such as cyber security and data privacy, are proactively addressed.

Fraud risk management

MTN Group’s fraud risk management strategy continues to evolve to meet the dynamic shifts in international fraud risk trends. Historically, MTN has been focused on fraud detection and response, however greater emphasis is now being placed on proactive fraud prevention strategies. The significant components of MTN’s fraud prevention strategy are the effective integration of fraud risk management within a combined assurance environment, the rollout of the MTN Group ethics framework and greater organisational fraud awareness.

Thirteen MTN operations have dedicated forensic personnel. The rest of the operations are supported through the local internal audit and enterprise risk management functions or the Group fraud risk management function.

The majority of identified fraud incidents are reported via internal channels with employees preferring to report potential fraud incidents directly to the investigation team. However, MTN continues to provide employees and relevant stakeholders with access to an anonymous reporting facility managed by Deloitte. All whistle-blowing reports received are investigated and feedback is provided to the Group’s audit and risk committee structures to ensure that independent governance is maintained.

The MTN Group’s current top fraud risks are:

Procure-to-pay associated fraud risks;
Products and services-related fraud risks (including distribution channels);
Financial services-related fraud risks; and
Cyber crime and confidential information leakage.

Internal audit

The MTN Group and all its subsidiaries embrace the principles of King III and recognise the significant opportunities that present themselves to companies that do so.

Internal audit’s role is that of an objective and independent value-adding assurance provider that embraces a risk-based auditing approach, in line with King III, to the Group’s exco and board. It considers the risks that may hamper the achievement of strategic priorities and further determines the effectiveness of MTN’s systems of internal control and risk management.

MTN’s internal audit has adopted a combined assurance model as a co-ordinated approach to all assurance activities. MTN has dedicated teams that perform internal audits across the Group. The internal audit function is being transformed in line with the recommendations of the evaluation that was undertaken during the year. At a Group level, internal audit reports functionally to the audit committee and administratively to the Group president and CEO. Internal audit coverage is extended to all operations and high-risk processes in line with the internal audit methodology.

In 2015, more than 201 370 hours were spent on internal audit.