Strategic review

Risk management

Effective risk management is fundamental to our business activities and supports our strategic goals.

 

By identifying and proactively addressing risks and opportunities, we aim to generate sustained value for stakeholders while protecting our business operations, reputation and the well-being of our employees. Tiger Brands recognises that risk in business is a complex and diverse concept, and that many parts of the group focus on managing risk exposures. Our intention is that these parts work together in a consistent and integrated manner to manage and reduce risk appropriately. Ultimately, the function of risk management is to help Tiger Brands achieve its objectives and ensure a safer, healthier work environment for employees while preserving assets and earnings for the benefit of all stakeholders.

Approach

Tiger Brands effectively identifies, manages and reports on risk across the organisation. Risk management activities are embedded in daily operations through processes, resources and structures. The group has adopted an enterprise-wide approach, meaning that every identified material risk is included in a structured and systematic process of risk management.

Risk appetite and tolerance

Risk appetite – the level of risk management is prepared to absorb before mitigating actions are implemented – has been determined by setting exposure limits at three tiers:

Tier 1:
Any calculated risk exposure that requires no further management mitigation, ie does not present a catastrophic threat to Tiger Brands

Tier 2:
A threshold zone where any risk exposure that exceeds our risk appetite, but remains within the risk tolerance, may be acceptable but management must make a conscious decision about risk tolerance versus risk mitigation

Tier 3:
All exposure above our risk tolerance will be considered a significant risk and must be supported by a comprehensive mitigation plan and timeline for implementation

Risk appetite and tolerance


Exposure limits are determined after assessing residual risk. The risk appetite, tolerance and velocity (time taken to feel the impact of a risk after it materialises) of the group is set by the risk and sustainability committee and approved by the board annually.

This process complements existing risk management processes and aims to ensure Tiger Brands effectively identifies, manages and reports on risk across all operations and all territories. The underlying reporting structure starts at site level and rolls up into the relevant business unit, followed by divisional consolidation to culminate in risk reporting at group level.

Governance

Governance

The board of directors is ultimately responsible for oversight of the group's risk management processes. The risk and sustainability committee assists the board by ensuring that the risk management process complies with the relevant standards and governance requirements in all the group's operating territories. Senior management in each division and business unit is responsible for managing risks in its area. Oversight of risk management at divisional level rests with the relevant executive committees. Divisional and business unit risk registers are updated quarterly and the risk and sustainability committee meets three times a year.

To prioritise risks, each risk is evaluated in terms of likelihood and impact on an inherent (actual impact) and residual (after mitigating action) basis. The heat maps alongside reflect the significant inherent and residual risks for Tiger Brands.

The Tiger Brands combined assurance model ensures that the committee evaluates and approves the level of assurance provided for all group risks.

R1 – Threats to employee security
R2 – Food safety and product quality
R3 – Occupational health and safety
R4 – Cyber crime and information security
R5 – Business continuity vulnerabilities
R6 – Operating environment
R7 – Data and information risk
R8 – Earnings contribution from associates
R9 – Fraud, theft, crime and corruption
R10 – Ageing infrastructure

The future state of group risks represents the executive committee's view based on information available at the time of compiling this report. The group risk profile is reviewed quarterly and may be revised after considering changes to the local and macroeconomic environment, crime, political developments, legislative and regulatory changes, socio-economic challenges and technological advancements. The Tiger Brands risk management process is therefore not a static view of risks facing the organisation.

Significant risks

Significant exposures are determined by analysing business unit risks, divisional risks and group risks. The score for each risk is determined by multiplying the likelihood of the risk occurring with its impact on Tiger Brands. A risk is regarded as significant when its score exceeds the risk tolerance set by the board. The link between risks and material issues is complex, but we have noted how key risks relate to material matters below.

The following risks are regarded as significant to Tiger Brands:

Key risk   Material issues
1 Employee security   Human resources and skills Human resources and skills  

We have zero compromise on employee safety and security. Safety procedures aligned with the global OHSAS 18001 standard are embedded across all our manufacturing facilities, with restricted access controls at all production facilities.

Ongoing risk assessments are focused on reviewing the strategy to reduce the safety risk to employees in certain businesses. A tailored response was developed from detailed risk assessments across these businesses. Partnerships have been established with law enforcement to combat crime and armed escorts are in place for high-risk routes. Our response is detailed in the sustainability report.

2 Food safety and product quality   Food security Food security Safety and quality Safety and quality

Tiger Brands is committed to producing quality products that are aligned with our superior brand equity. Good manufacturing practice (GMP) standards and the food safety system certification 22000 (FSSC 22000) have also been revised and implemented across the group. Our manufacturing, group legal and regulatory compliance functions collaborate effectively to ensure our products comply with all regulatory standards and meet consumer preferences.

Further improving quality-related processes, controls and practices was a major focus in FY18. Group quality standards have been established and this function has been centralised. Quality self-assessments have been standardised for all manufacturing sites and a supplier quality management process (including supplier qualification) is also being implemented.

Tiger Brands has partnered with Stellenbosch University to remain at the forefront of scientific developments and trends, with a memorandum of understanding signed to establish a Centre for Food Safety.

Refer to the sustainability report for an update on quality and food safety.

3 Occupational health and safety   Human resources and skills Human resources and skills Safety and quality Safety and quality

A comprehensive safety programme has been implemented across Tiger Brands. Each site is subject to self-audits and annual independent safety audits. A dedicated group security manager is responsible for continuous improvement on security measures and a group occupational health risk manager was appointed in FY18 to drive group-wide awareness of the occupational health framework. To further strengthen the environment, integrated safety, health and environment systems will be benchmarked to improve the group risk outlook.

Our safety and health performance for the review period is on Our people page, with more detail in the sustainability report.

4 Cybercrime and information security   Business continuity Business continuity

Increasing interconnectivity, globalisation and ‘commercialisation’ of cybercrime are driving greater frequency and severity of cyber incidents, including data breaches. Group IT monitors the cyber security landscape continuously with a view to implementing the latest security practices and revising existing controls to safeguard the group against cybercrime. A two-year remediation plan has been designed in partnership with an external security specialist provider to ensure that we prioritise high-risk areas as well as quick wins to enhance our security posture.

5 Business continuity   Business continuity Business continuity

Complete business-continuity plans are already in place for high-priority packaging and raw materials across the business. The roll-out of a formal business-continuity management process for the group’s manufacturing facilities is on track, ensuring a systematic and consistent approach. This risk is managed with appropriate group insurance cover, reviewed annually, and disaster-recovery plans that include replicating core business applications and services, with maintenance and support service agreements in place with key vendors.

The Western Cape water-supply risk has been reduced after recent rainfalls improved dam levels. Borehole water applications continue to be explored for sites in areas where the water table is high. Work has been undertaken to scope the feasibility of fit-for-purpose solutions for water recovery and water-treatment systems at various operations. Risk, control and environmental audits are performed by an external specialist annually. Results are used to improve business-continuity planning and disaster-recovery processes.

Our energy strategies are detailed in the sustainability report.

6 Operating environment   Weak macro economy and job creation Weak macro economy and job creation People People
      Effectively executing our strategy Effectively executing our strategy  Innovation
      Food security Food security  

As outlined in Our operating environment page, our operating environment continues to be intensely challenging. We are focusing on significant opportunities for efficiency improvements that have been identified in developing our new operating model. These will enable us to channel scarce resources to activities with the greatest impact.

7 Data and information risk   Business continuity Business continuity

Suboptimal information management disciplines could lead to inconsistent and poor data quality that could compromise decisions and give rise to privacy/identity management and information security risks. Increased regulation will also place additional demand on our system capabilities and IT teams. There are substantial regulatory changes pending (cyber crime bill, IFRS 5, money laundering (FICA), protection of personal information (POPI), general data protection rules (GDPR)) that could materially impact on our strategic execution if unmanaged.

We have a robust process for ensuring all new initiatives consider security testing as part of the project. This helps strengthen our technology control environment for data security. A new information classification policy is the basis for better understanding how we handle different classes of information in the organisation. This is being driven as part of the POPI project. A gap assessment is also under way to identify key risk areas and implementation plans for POPI compliance. A holistic approach to data and information management is being established to ensure there is a defined group strategy. This includes ownership of the data and information held by Tiger Brands.

8 Earnings contribution from associates    

Our earnings are affected by income from associates, predominantly Oceana which accounted for 57% of total earnings from associates of R731 million in FY18. Oceana has significantly diversified its portfolio in recent years to reduce the level of reliance on fishing rights in South Africa and neighbouring countries, as the risk of these rights being allocated on increasingly stringent empowerment credentials has risen materially.

For all our associates, exchange rate volatility can materially impact their contribution to Tiger Brands. The performance of our associate companies is summarised also on Operational review page with further information in the company’s annual financial statements (www.tigerbrands.com).

9 Fraud, theft, corruption and crime   Business continuity Business continuity

Internal controls are continuously reviewed to guard against fraud and crime through employee awareness campaigns, strict access control at all facilities, and working with local police in investigating syndicated crime.

Our people are annually required to acknowledge compliance with key group policies on anti-bribery and corruption, ethics, and gifts and entertainment. The Tiger Brands ethics line is available to all employees, suppliers, customers and consumers to confidentially report unethical business practices without fear or victimisation. The ethics committee independently validates the effective finalisation of all reports.

More detail appears in the sustainability report.

10 Ageing infrastructure   Food security Food security Safety and quality Safety and quality
      Security of supply Security of supply Business continuity Business continuity

To address efficiency and capacity, we have dispersed R720 million in capital expenditure over the year and plan for a further R2 billion in FY19. This includes investments in Davita in the exports segment, our beverages division and breakfast, which are planned for completion in FY19. Upgrades to the Germiston Enterprise factory have been completed and the Polokwane factory upgrades are under way.

Manufacturing optimisation studies are ongoing. Standards for facilities are being developed, including personal and food safety requirements, with planned completion by the end of FY19. Manufacturing excellence customs and practices (MECP) is being rolled out at all manufacturing facilities and was completed in FY18. Where possible, sustainability is considered for these projects to reduce our environmental impact, improve a safe production environment and address any potential health risks such as ergonomics.