DISCLOSURE ON MANAGEMENT APPROACH

Risk philosophy

Effective risk management is central to maintaining competitive advantage and adapting to changes in the internal and external business environment. The underlying principle of integrated enterprise-wide risk management (ERM) is that risk management must form part of all strategic, business planning and day-to-day operational activities. Exxaro’s ERM adopts a holistic approach to managing uncertainty, representing both risk and opportunity. The aim is to establish the acceptable level of risk in each area of business, which should be as low as reasonably practical, while taking full advantage of the highest returns possible to maximise shareholder wealth. In all risk management activities, compliance with South Africa’s King III is achieved by coordinating and integrating these activities for effective integrated risk management governance.  

Risk owners are responsible for continuous identification, assessment, mitigation and management of risks within the existing and ever-changing risk profile of the environment in which they operate.  

The internal auditors and chief audit executive, being responsible for the combined assurance process, evaluate the effectiveness of the risk management process and report to the audit, risk and compliance committee (audit committee) which, in turn, provides assurance to the board.  

Risk appetite

The audit committee approves Exxaro’s consolidated risk appetite for residual risks (ie the result after applying mitigation or control measures to the inherent risks identified and assessed), and ensures this is aligned with the group strategy. Exxaro’s risk appetite is a function of its ability to withstand unexpected losses and their impact on the group’s ability to continue as a going concern. Differentiated risk appetites apply at different levels throughout the group. The top residual risks at different levels in the organisation receive continuous and enhanced attention and are subject to periodic monitoring and reporting by risk owners to reduce the residual risk rating.  

Risk identification and assessment process

The risk management process is continuous, with well-defined steps. Risks from all sources are identified and once they pass a set materiality threshold, a formal process begins in which causal factors and consequences are identified and the correlation with other risks and mitigating controls is reviewed.  

The top residual business risks, appropriately categorised and based on impact and likelihood of occurrence, together with mitigating control measures, are disclosed below in descending order. These risks do not exceed Exxaro’s risk appetite but have the highest residual risk rating, warranting disclosure and continuous management as per the decision of the executive committee, audit, risk and compliance committee of the board, and the board itself.

EXXARO’S TOP RESIDUAL BUSINESS RISK MAP FOR 2010

Legend for 2010 residual business risk map

1. Infrastructure constraints impacting on current operations and growth aspirations (100)
2. Commodity price and currency volatility impacting on profitability, investment returns, project evaluations and BEE shareholding structure (80)
3. Inability to maintain a licence to operate due to non-compliance with all applicable legal and regulatory frameworks (80)
4. Potential delays to operations and projects associated with the time taken to obtain approval for mining and environmental rights (80)
5. Lack of security of, and cost of electricity, impacting adversely on safety and sustainable operations (80)
6. Inadequate regulatory changes to enable meaningful participation in IPPs in the South African industry (80)
7. Climate change impacting adversely on sustainable operations (64)
8. Late commissioning of growth projects fundamental to Exxaro’s future sustainability (60)
9. Insufficient supply of clean water for sustainable operations and communities (51)
10. Insufficient attraction and retention of key skills negatively impacting on current operations and growth aspirations (48)
11. Risks associated with the closure of current operations (48)
12. Adverse impact of above inflation increases on operating costs, profitability, and cost of capital projects (48)
13. Insufficient security of critical materials due to scarcity and price (48)
14. Fraud perpetrated resulting in quantifiable losses (40)
15. Risk of not successfully implementing improvement project initiatives (Project Siyaya) thereby not realising revenue, cost reduction and increased operational efficiency targets (32)
16. Funding of current operations and growth aspirations hampered by balance sheet capacity and other resource constraints (32)
17. Risk of previous versions of software applications impacting negatively on information security and availability (32)
18. Investment opportunities do not yield expected returns (32)
19. Resource nationalisation resulting in sub-optimal utilisation of resources (24)
20. Reliance on a non-managed operation for financial stability (20)

Residual risk ratings (percentages) are disclosed in brackets after the description of the residual risk.