66 / 98
Vodacom has a
mature risk
management
framework that is
aligned with
the ISO 31000
International Risk
Management
Standard and the
requirements of
South Africa’s
King IV Governance
Code.
Our
principal
risks
We identify the key risks through our
Principal Risks Framework, which
provides the Executive Committee
and Board with a robust assessment
of the principal risks facing the
Company. An embedded enterprise
risk management process supports
the identification of these principal
risks. The risk appetite for each
principal risk is reviewed and
approved by the Board to enable
informed risk-based decision-making.
The Group’s risk heat map (Figure 1)
sets out the top 10 principal risks as
identified through the risk
management process. This is
supported by the risk and speed of
impact report (Figure 2), reflecting
the rate at which the Company will
experience adverse financial impacts
if the risk materialised.
External
Internal
Low
Medium
High
Figure 1: Residual impact vs likelihood
Likelihood
Impact
6
Strategy
7
Technology
Slow
(>12 months)
Rapid
(Between 6 and 12 months)
Very rapid
(<6 months)
Figure 2: Risk and speed of impact
Speed of impact
Risk rating
6
Strategy
7
Technology
3
Regulatory
4
Market
9
Economy
2
Spectrum
5
Political
Key focus areas
Key focus areas
10
Laws
8
Cyber
8
Cyber
62
Vodacom Group Limited
Integrated report for the year ended 31 March 2018
5
Political
10
Laws
2
Spectrum
1
ECA
1
ECA
3
Regulatory
4
Market
9
Economy