annual report 2009
RISK MANAGEMENT
Risk review
The primary identified risks to the group are listed below, with their management strategies to contend with them being stated.
Customer base retention
Risk
Retaining our existing customers and attracting new customers.
How we manage this risk
- the establishment of a customer relationship management department with the specific objective of maximising customer value and duration of relationship by creating an unbeatable customer experience over all legs of the relationship life cycle.
Supply chain
Risk
The inability to provide our customers with the desired merchandise at the right price and time as a result of deficiencies in the management process of the supply chain.
How we manage this risk
- considering all possible occurring events and factors that can cause a disruption in our supply chain;
- examining possible scenarios from past experience and analysing changing market forces;
- creating solutions culminating in improved stock turn and customer satisfaction;
- implementing changes in the supply chain methodically within appropriate and achievable time frames; and
- continuing significant support for our local apparel supplier base in order to ensure sustained merchandise manufacture and supply.
Further detail is provided in the Group Logistics section of this report.
Fashion trends
Risk
The misreading of fashion trends by the merchandise teams.
How we manage this risk
- development and retention of talented merchandise teams who keep abreast of global fashion trends;
- extensive input from international fashion fairs, consultants, the internet as well as local fashion research;
- based in the southern hemisphere, benefiting from the knowledge of the forthcoming season’s successful trends in the northern hemisphere; and
- utilising advanced systems to ensure that purchasing volumes are correct.
Information technology (IT)
Risk
Ever-increasing reliance upon computer systems necessitates a stable, secure and uninterrupted computer infrastructure.
How we manage this risk
- constant senior management review and updating of the IT strategic plan;
- maintaining a comprehensive, regularly-tested disaster recovery plan that should provide seamless computing capacity in the event of a disaster, involving the establishment of secure computer suites in separate locations with adequate capacity to provide backup access to critical systems;
- strict change control procedures for all system enhancements;
- conducting risk assessments for all significant projects;
- ensuring that access controls are implemented and enforced;
- ongoing consolidation and standardisation of applications and infrastructure technology;
- an ongoing upgrade and technology “refresh” programme to ensure that our applications and infrastructure are current and supported;
- instilling employee awareness of the need for responsible use of computer facilities (all employees being required to abide by a formal computer code of conduct);
- ongoing emphasis at all levels on enhancing IT security from all potential threats, both internal and external; and
- adopting strong IT governance policies and best practice IT service delivery models.
Crime
Risk
Crime, particularly armed and violent crime, which continues unabated, creating losses and, in particular, trauma to our staff.
How we manage this risk
- continually reviewing security at stores;
- providing staff training on how to deal with armed robberies;
- maintaining a strong focus on syndicated identity fraud via a dedicated forensics department;
- maintaining regular communication with anti-crime fora to ensure that we minimise the impact of crime in all of its forms; and
- utilising an anonymous toll-free whistle-blowing facility for the reporting of criminal acts (details of which are contained later in this report).
Shortage of skills and expertise
Risk
Without insightful, specialised and talented staff at all levels, our continued success and growth through innovation would be endangered.
How we manage this risk
- maintaining an effective nominations committee for succession planning and appointment of senior executives and board appointments;
- ensuring that processes are in place to attract, retain and develop high-quality staff within an environment that can satisfy ambition; and
- having access to a pool of skills in all key areas via our divisionalised structure, which lends itself to seamless resource transference.
Bad debts
Risk
Within the context of the current financial environment and the threat of escalating unemployment, there is a risk of increasing bad debt.
How we manage this risk
Account origination
- Credit applications are reviewed for fraud indicators, and assessed against NCA-compliant internal scorecards, credit bureau scores, and verification of employment where necessary.
Account management
- Analytic decision systems determine appropriate collection strategies, approved credit line adjustments and authorisations by utilising internal behavioural and credit bureau scores.
Systems and strategies are subject to ongoing management review within both of the above risk areas.
Business continuity
Risk
The loss of a major head office facility or distribution centre could impact upon critical business functions.
How we manage this risk
- maintaining separate head office buildings and distribution facilities, and providing backup facilities for critical functions;
- splitting the computing capacity over four server rooms in separate locations;
- maintaining current business continuity plans for all trading and service divisions;
- maintaining comprehensive physical protection measures; and
- maintaining appropriate insurance cover.
Internal control
The board of directors is responsible for the group’s systems of internal control. Effective internal control systems have been implemented and are continuously evaluated:
- to provide reasonable assurance as to the integrity and reliability of the financial statements;
- to safeguard, verify and maintain accountability of its assets;
- to detect and minimise fraud, potential liability, loss and material misstatement; and
- to review compliance with applicable legislation and regulations.
The internal control systems are governed by a comprehensive internal control standards manual that is available to all staff via our intranet. Compliance with these standards rests within each division and is monitored by internal and external audit checks.
The board is not aware of any material breakdown during the past year in the functioning of these controls.
Internal audit
The internal audit department carries out an independent appraisal and assurance function. Although it is responsible to the group’s Financial Director for administrative matters, it reports to the audit committee and the risk committee of the board. This structure does not impair the function’s independence or objectivity. An internal audit charter, approved by the audit committee and conforming to the International Standards for the Professional Practice of Internal Auditing, determines the mission and scope of the function.
Further information on the internal audit function is contained in the divisional reports section of this annual report.
Code of ethics
The board has adopted a code aimed at creating a culture of the highest standards of ethics and uncompromising honesty among all employees throughout the group. The code is founded on the principles of integrity, good faith, impartiality, openness and accountability. The code of ethics forms an integral part of the induction programme and all new employees agree to subscribe to the code. It is available to all staff members on our intranet.
It is comprehensive in nature, clearly outlining the full obligations of every member of staff in their dealings with fellow employees, customers, suppliers, competitors, shareholders and society at large. It requires inter alia:
- conformance with all laws and regulations;
- disclosure of any gifts offered or received and which must be within prescribed financial parameters;
- disclosure of any direct or indirect conflict of interest;
- that no bribes be accepted or proffered;
- reporting of any unethical or harmful behaviour; and
- compliance with all of the group’s standards and procedures, including the computer usage policy.
Sound processes are in place to manage any deviations from this code.
Whistle-blowing
A whistle-blowing facility has been in place since February 1998 for the reporting of suspected fraud and unethical behaviour. Use is made of an outsourced, anonymous, toll-free hotline. All reports are submitted to the centralised risk management department, which ensures that all incidents are logged and resolved. A minimum reward of R5 000 is paid when follow-up confirms evidence of fraud or unethical behaviour. There is a strong focus on staff awareness of this facility through regular distribution of informational cards and posters. An additional reward of R10 000 is paid twice annually to a randomly-selected staff member who has already been awarded the R5 000 reward.
During the year 113 reports were received, resulting in 27 dismissals.
