Currently viewing: Strategic risk management / Next: Fair and responsible remuneration

Strategic risk management

Risk-based leadership with the Board at its apex is fundamental to Datatec’s approach to its operations. In line with the King IV Code, the Board governs risk in a way that supports the organisation in setting and achieving its strategic objectives.

Our risk management process

The Group’s risk management process has three key steps:

Identify key risks – key risks are threats that have the ability to adversely affect the Group’s ability to achieve its objectives and successfully execute its strategies. These are documented in risk registers

Implement controls to mitigate risk – monitor through continuous review

Obtain assurance that controls are effective – combined assurance programme. Adapt and improve controls where necessary

How do we identify risks?

Our risks are identified as threats that can impact the Group’s ability to deliver its objectives and its strategy. Our risks are regularly reviewed in the context of our operating environment.

How do we respond to our risks?

Our risks are assessed and prioritised. The relationship between the impact and likelihood of risks is recorded in risk registers. Key risk responses are identified and reviewed to ensure that our process continually improves and evolves.

Risk oversight

RISK MANAGEMENT FRAMEWORK

Organisation

Datatec Board

Datatec Group Audit, Risk and Compliance Committee

Divisional audit, risk and compliance committees

Chief Risk Officers forum

Datatec and divisional Chief Risk Officers

Finance and IT staff, compliance officers

Policy and procedures

Risk policy

Risk management procedures

Deliverables

Risk registers

Risk maps

Assurance plans

Assurance and guidance

Internal audit

Organisation

Policy and procedures

Deliverables

Assurance and guidance

Board

The Board determines the level of risk tolerance and limits of risk appetite are set as part of the strategic direction of the Group
The Board is ultimately responsible for the governance of risk

Divisional Chief Risk Officers

Ensure divisional risk procedures are in accordance with and support the Group’s risk management framework
Oversee management’s response to matters identified as requiring improvement

ARCC

Monitors risk management activities at the Group and subsidiary level on an ongoing basis

Group Chief Risk Officer

Ensures that the risk management framework is operating effectively in the divisions

Divisions – divisional boards and executive committees

Regularly review strategic and emerging risks and identify and prioritise high-risk areas on risk maps based on impact and likelihood
Analyse high-risk areas to identify potential root causes
Identify mitigating controls and associated monitoring/assurance activities for each high-risk area

The Board is responsible for approving Datatec’s risk appetite and when the risk tolerance is exceeded, it is management’s responsibility to take action.

Datatec’s aim is for the risk register to be a management tool driving the following two critical areas:

Business-driven goals via strategic planning; and
Compliance-driven goals via risk managers and internal audit.

Refer to our operating context for details of our key risks.