Our principal risks

Each year, the Vodacom Board reviews the critical strategic risks facing the company and approves the Group’s risk appetite. The Board considers business risks when setting strategies, approving budgets and monitoring progress against budgets. The executive team regularly reviews the risk management processes to improve the identification, assessment and monitoring of risk, to ensure that we are responsive to the ever-changing business environment.

This year, we enhanced our approach of identifying, assessing and reporting on risks by introducing the concept of ‘principal risks’. These are the top 10 risks that have the most significant impact on Vodacom’s ability to achieve its strategic objectives in the long-term (‘macro risks’), and in the short- to medium-term (‘tactical sub-risks’). We have also created an enhanced risk appetite framework and risk appetite statements for each of the 10 principal risks.

Figure 1     Outlines the heatmap of Vodacom’s current principal risks.

Figure 2     Shows the speed of impact of the risk in relation to the risk ranking (as per figure 1).

Risk rating (Figure 1)

We have introduced an analysis of speed of impact, reflecting the rate at which the company will experience adverse financial impacts if the risk materialised.

Risk and speed of impact (Figure 2)

Our Strategies


Principal risk   Context   Mitigating actions   Strategic Objective
1 Access to spectrum

Speed of impact:

Slow
>12 months		   A failure to secure access to additional spectrum, needed to deliver cost-effective expansion of our radio access network (RAN), would significantly impact our ability to increase capacity and deliver future system capabilities. Key challenges include: proposed policy changes relating to spectrum licence; non-renewal of existing licences; and increasing competition for access to spectrum.  
  • We maintain constructive relations with government and regulators, and strive to work collaboratively with them to find solutions that are in the collective interest of business, government and society.
  • We ensure that our spectrum strategy is in line with regulatory and market developments.
  • As data demand continues to grow exponentially we entered into a commercial agreement to roam on the data network of our partners, and to identify and acquire entities which have access to spectrum, e.g. SNT in Tanzania.
  

2 Cyber threat

Speed of impact:

Very rapid
<6 months		   An external cyber-attack, insider threat or supplier breach (malicious or accidental) could result in service interruption and/or the breach of confidential data, with resulting negative impacts on customers, revenues and reputation, and potential costs associated with fraud and/or extortion.  
  • We have a global risk-based security strategy, and a global security function that develops and implements relevant policies and processes.
  • Security controls are implemented centrally. In local markets, we have a continuous improvement programme to mitigate against changing risks.
  • We manage the risk of malicious attacks on our infrastructure through our cyber intelligence centre that provides continuous proactive monitoring of our Group infrastructure, responds to incidents and manages recovery from those incidents.
  • We apply layers of security control to all applications and infrastructure that store or transmit confidential personal and business voice and data traffic.
  • We have an assurance programme that incorporates both internal and external reviews of third parties that hold data on our behalf.
  

3 Customer data misuse or leakage

Speed of impact:

Very rapid
<6 months		   Respect for privacy is essential for maintaining customer trust. Customer data is also an important strategic asset for Vodacom. Failure to strategically manage customer privacy and ensure data integrity will have significant negative reputational implications, reduce the value of our data assets and result in regulatory non-compliance. This could result in substantial fines, reputational damage and a negative impact on customer NPS.  
  • We process personal data honestly, ethically, with integrity and consistent with applicable laws and with the Vodafone Global Privacy Framework.
  • We are responding to privacy requirements through an enterprise project across all areas in the business.
  • We monitor and enforce compliance with regulations and our internal policies, and provide regular security and privacy awareness training to relevant employees.
  • Our legal and regulatory affairs teams engage with key stakeholders to ensure that we implement the necessary controls.
  • We ensure compliance with privacy requirements as stipulated by data protection legislations.
  
4 Technology failure

Speed of impact:

Very rapid
<6 months		   Our customer value proposition is based on the reliable availability of our high-quality network. A major failure in critical network or IT assets – for example, through natural disasters, insufficient preventative maintenance, or malicious attack – would have a profound impact on our customers, revenues and reputation.  
  • We invest significantly in maintaining and upgrading our network on an ongoing basis, and ensuring availability of adequate redundancy capabilities where feasible.
  • Business continuity, disaster recovery and resilience policy requirements are built into our network and IT infrastructure.
  • We are self-providing transmission links on critical routes in our networks to reduce reliance on external parties.
  • Comprehensive insurance policies are in place.
  

5 Failure to deliver on customer experience

Speed of impact:

Rapid
6-12 months		   Failure to deliver a differentiated and superior experience to our customers in-store, online and/or over the phone, could diminish our brand and reputation, impacting revenue growth. Associated risks include: a failure to provide highquality customer service through our call centres, online portals and complaints’ handling; not providing customers with fair, easy-tounderstand tariffs; not preventing or managing roaming or bill shocks.  
  • We have prioritised the customer experience as a key component of our strategy, and we have implemented a CARE programme (Connectivity, Always in control, Rewarding loyalty, Easy access) to ensure that our customers are always top-of-mind when designing products and services.
  • We are implementing IT transformation initiatives as the vehicle for delivering a great customer experience, high-quality, reliable systems, improving our time-tomarket and enabling best-in-class digital capabilities.
  • We communicate with our customers clearly and transparently, particularly with regard to tariffs and roaming costs, and we provide a leading customer experience through our MyVodacom app and online channels.
  • We track and monitor our performance in delivering a superior customer experience through various metrics, the most important being our net promoter score (NPS).
  


6 Unstable economic and market conditions

Speed of impact:

Rapid
6-12 months		   Volatile macroeconomic conditions – such as fluctuating foreign exchange, inflation and interest rates – could weaken consumer and enterprise spend, reduce customer revenue, and impact negatively on operating costs and capital expenditure.  
  • We closely monitor macroeconomic conditions within our key markets.
  • We include contingencies in our business plans to provide for the negative operational impacts that could arise from lower economic growth, and changes in interest, inflation and exchange rates.
  • We implement hedging instruments to compensate for extreme fluctuations in interest and exchange rates.
  • We have implemented a global cost-savings programme to combat the effects of inflationary pressure on costs.
  • We continue to optimise our cost of financing and increase maturity levels of debt.
  
7 Adverse political measures and regulatory pressures

Speed of impact:

Slow
>12 months		   Stringent regulatory or legislative requirements could necessitate significant changes to current business practices, impacting our profitability, growth and services in our operating countries. Recent significant regulatory and policy changes include: recommended retail and wholesale price control on roaming; recommended changes to ICT policies, JSE Listings Requirements, customer registration requirements and BBBEE compliance in South Africa.  
  • We engage constructively with governments, regulators, tax authorities and other stakeholders, nationally and internationally, through written submissions and formal hearings on legislative and regulatory changes.
  • We have established specialist regulatory and government relations teams, and where appropriate, we engage advisers and legal counsel to obtain legal opinion.
  • We have access to best practice and international debate through Vodafone.
  
8 Failure to deliver on new services and strategy

Speed of impact:

Slow
>12 months		   Failure to deliver on new services or Vodacom’s new strategy will negatively affect the future growth of the organisation. Key associated risks include: inability to access required infrastructure; inability to access quality content at reasonable prices and to forge effective content partnerships, failure to deliver on fibre rollout plan; failure to compete effectively on ‘converged products’.  
  • We have policies, procedures and organisational measures in place to ensure that we maintain a sustainable competitive position, defending our leadership position in mobile and growing fixed income in areas with growing convergence.
  • We are driving competitive next generation access (NGA) coverage through wholesale access and our own investments, securing access to content, and developing our ability to grow scale in fixed-line services quickly.
  • The Board is updated quarterly on the progress on strategic objectives to ensure that the necessary action plans are implemented.
  



9 Non-compliance with laws and regulations

Speed of impact:

Rapid
6 – 12 months		   A breach of regulatory requirements could expose Vodacom to significant financial and reputational damage.  
  • We have subject matter experts in legal and regulatory teams at a local and global level who manage risk across the Group. Our compliance team monitors all high-risk policies, and tracks and reports on remedial actions for non-compliance or partial compliance.
  • We maintain a policy of zero-tolerance towards bribery by any employee or third party operating on our behalf, and we run employee training and awareness programmes aimed at reinforcing an ethical culture across the organisation.
  • We have robust, proportionate, risk-based controls to prevent, detect and report money-laundering and terrorist financing. Our reliance on third parties is mitigated by training and monitoring.
  
10 Litigation

Speed of impact:

Slow
>12 months		   A failure to obtain favourable results during litigation could lead to financial loss and/or negative publicity.  
  • We have policies and processes in place to ensure that we have robust contracts with our partners, staff and customers, and that we comply with all contractual agreements and legislation.
  
Principal risk
1 Access to spectrum

Speed of impact:

Slow
>12 months
Context
A failure to secure access to additional spectrum, needed to deliver cost-effective expansion of our radio access network (RAN), would significantly impact our ability to increase capacity and deliver future system capabilities. Key challenges include: proposed policy changes relating to spectrum licence; non-renewal of existing licences; and increasing competition for access to spectrum.
Mitigating actions
  • We maintain constructive relations with government and regulators, and strive to work collaboratively with them to find solutions that are in the collective interest of business, government and society.
  • We ensure that our spectrum strategy is in line with regulatory and market developments.
  • As data demand continues to grow exponentially we entered into a commercial agreement to roam on the data network of our partners, and to identify and acquire entities which have access to spectrum, e.g. SNT in Tanzania.
Strategic Objective
   
Principal risk
2 Cyber threat

Speed of impact:

Very rapid
6 months
Context
An external cyber-attack, insider threat or supplier breach (malicious or accidental) could result in service interruption and/or the breach of confidential data, with resulting negative impacts on customers, revenues and reputation, and potential costs associated with fraud and/or extortion.
Mitigating actions
  • We have a global risk-based security strategy, and a global security function that develops and implements relevant policies and processes.
  • Security controls are implemented centrally. In local markets, we have a continuous improvement programme to mitigate against changing risks.
  • We manage the risk of malicious attacks on our infrastructure through our cyber intelligence centre that provides continuous proactive monitoring of our Group infrastructure, responds to incidents and manages recovery from those incidents.
  • We apply layers of security control to all applications and infrastructure that store or transmit confidential personal and business voice and data traffic.
  • We have an assurance programme that incorporates both internal and external reviews of third parties that hold data on our behalf.
Strategic Objective
   
Principal risk
3 Customer data misuse or leakage

Speed of impact:

Very rapid
<6 months
Context
Respect for privacy is essential for maintaining customer trust. Customer data is also an important strategic asset for Vodacom. Failure to strategically manage customer privacy and ensure data integrity will have significant negative reputational implications, reduce the value of our data assets and result in regulatory non-compliance. This could result in substantial fines, reputational damage and a negative impact on customer NPS.
Mitigating actions
  • We process personal data honestly, ethically, with integrity and consistent with applicable laws and with the Vodafone Global Privacy Framework.
  • We are responding to privacy requirements through an enterprise project across all areas in the business.
  • We monitor and enforce compliance with regulations and our internal policies, and provide regular security and privacy awareness training to relevant employees.
  • Our legal and regulatory affairs teams engage with key stakeholders to ensure that we implement the necessary controls.
  • We ensure compliance with privacy requirements as stipulated by data protection legislations.
Strategic Objective
   
Principal risk
4 Technology failure

Speed of impact:

Very rapid
6 months
Context
Our customer value proposition is based on the reliable availability of our high-quality network. A major failure in critical network or IT assets – for example, through natural disasters, insufficient preventative maintenance, or malicious attack – would have a profound impact on our customers, revenues and reputation.
Mitigating actions
  • We invest significantly in maintaining and upgrading our network on an ongoing basis, and ensuring availability of adequate redundancy capabilities where feasible.
  • Business continuity, disaster recovery and resilience policy requirements are built into our network and IT infrastructure.
  • We are self-providing transmission links on critical routes in our networks to reduce reliance on external parties.
  • Comprehensive insurance policies are in place.
Strategic Objective
   
Principal risk
5 Failure to deliver on customer experience

Speed of impact:

Rapid
6-12 months
Context
Failure to deliver a differentiated and superior experience to our customers in-store, online and/or over the phone, could diminish our brand and reputation, impacting revenue growth. Associated risks include: a failure to provide highquality customer service through our call centres, online portals and complaints’ handling; not providing customers with fair, easy-tounderstand tariffs; not preventing or managing roaming or bill shocks.
Mitigating actions
  • We have prioritised the customer experience as a key component of our strategy, and we have implemented a CARE programme (Connectivity, Always in control, Rewarding loyalty, Easy access) to ensure that our customers are always top-of-mind when designing products and services.
  • We are implementing IT transformation initiatives as the vehicle for delivering a great customer experience, high-quality, reliable systems, improving our time-tomarket and enabling best-in-class digital capabilities.
  • We communicate with our customers clearly and transparently, particularly with regard to tariffs and roaming costs, and we provide a leading customer experience through our MyVodacom app and online channels.
  • We track and monitor our performance in delivering a superior customer experience through various metrics, the most important being our net promoter score (NPS).
Strategic Objective
    
Principal risk
6 Unstable economic and market conditions

Speed of impact:

Rapid
6-12 months
Context
Volatile macroeconomic conditions – such as fluctuating foreign exchange, inflation and interest rates – could weaken consumer and enterprise spend, reduce customer revenue, and impact negatively on operating costs and capital expenditure.
Mitigating actions
  • We closely monitor macroeconomic conditions within our key markets.
  • We include contingencies in our business plans to provide for the negative operational impacts that could arise from lower economic growth, and changes in interest, inflation and exchange rates.
  • We implement hedging instruments to compensate for extreme fluctuations in interest and exchange rates.
  • We have implemented a global cost-savings programme to combat the effects of inflationary pressure on costs.
  • We continue to optimise our cost of financing and increase maturity levels of debt.
Strategic Objective
   
Principal risk
7 Adverse political measures and regulatory pressures

Speed of impact:

Slow
>12 months
Context
Stringent regulatory or legislative requirements could necessitate significant changes to current business practices, impacting our profitability, growth and services in our operating countries. Recent significant regulatory and policy changes include: recommended retail and wholesale price control on roaming; recommended changes to ICT policies, JSE Listings Requirements, customer registration requirements and BBBEE compliance in South Africa.
Mitigating actions
  • We engage constructively with governments, regulators, tax authorities and other stakeholders, nationally and internationally, through written submissions and formal hearings on legislative and regulatory changes.
  • We have established specialist regulatory and government relations teams, and where appropriate, we engage advisers and legal counsel to obtain legal opinion.
  • We have access to best practice and international debate through Vodafone.
Strategic Objective
   
Principal risk
8 Failure to deliver on new services and strategy

Speed of impact:

Slow
>12 months
Context
Failure to deliver on new services or Vodacom’s new strategy will negatively affect the future growth of the organisation. Key associated risks include: inability to access required infrastructure; inability to access quality content at reasonable prices and to forge effective content partnerships, failure to deliver on fibre rollout plan; failure to compete effectively on ‘converged products’.
Mitigating actions
  • We have policies, procedures and organisational measures in place to ensure that we maintain a sustainable competitive position, defending our leadership position in mobile and growing fixed income in areas with growing convergence.
  • We are driving competitive next generation access (NGA) coverage through wholesale access and our own investments, securing access to content, and developing our ability to grow scale in fixed-line services quickly.
  • The Board is updated quarterly on the progress on strategic objectives to ensure that the necessary action plans are implemented.
Strategic Objective
    
Principal risk
9 Non-compliance with laws and regulations

Speed of impact:

Rapid
6 – 12 months
Context
A breach of regulatory requirements could expose Vodacom to significant financial and reputational damage.
Mitigating actions
  • We have subject matter experts in legal and regulatory teams at a local and global level who manage risk across the Group. Our compliance team monitors all high-risk policies, and tracks and reports on remedial actions for non-compliance or partial compliance.
  • We maintain a policy of zero-tolerance towards bribery by any employee or third party operating on our behalf, and we run employee training and awareness programmes aimed at reinforcing an ethical culture across the organisation.
  • We have robust, proportionate, risk-based controls to prevent, detect and report money-laundering and terrorist financing. Our reliance on third parties is mitigated by training and monitoring.
Strategic Objective
Principal risk
10 Litigation

Speed of impact:

Slow
>12 months
Context
A failure to obtain favourable results during litigation could lead to financial loss and/or negative publicity.
Mitigating actions
  • We have policies and processes in place to ensure that we have robust contracts with our partners, staff and customers, and that we comply with all contractual agreements and legislation.
Strategic Objective