Governance, risk and compliance, and remuneration reports
Clover's Risk Universe
| Inherent risk on business model | Risk mitigation |
|---|---|
|
Continuously monitor sales prices to ensure price premiums are justified. Clover continuously considers potential actions to drive further cost efficiencies. |
|
Continuously monitor sales prices to ensure price premiums are justified. Clover is considering potential actions to drive further cost efficiencies. |
|
Supplier agreements are continuously renegotiated to improve efficiencies. Commodity prices are monitored on a monthly basis through the CFI trading desk, through which best prices are realised. |
|
Clover continuously monitors the milk price to feed cost ratio to protect its milk sources. New growth markets are being pursued through Clover Fonterra Ingredients (CFI) and our African expansion initiatives. |
|
Communication channels with labour are being enhanced to address the business risks. |
|
Synergies can be unlocked by having a centralised Industrial park which will assist Clover and the milk producers of South Africa to grow and create new markets. Commodity pressure is cyclical. |
|
A retailer has embarked on a process that requires Clover to only deliver to its distribution centre, while all distribution to its stores will henceforth be done by themselves. From Clover’s perspective, our fleet would have to be changed to cater for bulk loads. Clover is currently considering action plans to change its distribution model to enhance efficiencies, while considering new distribution opportunities. |
|
Continuous compliance monitoring and training of personnel. Mitigation measures are formulated into written policies. |
|
A Competition Law Centre of Excellence has been established and is supported by Bowman Gilfillan. This centre will draft Clover’s policies and train personnel in compliance. |
|
Clover IT has implemented a variety of security tools to monitor its infrastructure and activity on the network. These include scans that identify and rate the infrastructure’s external and internal vulnerabilities, enabling Clover to take immediate action should security threats be identified. Clover has a Security Information and Event Management (SIEM) tool used for real-time analysis of security alerts, supported by a comprehensive antivirus system and a firewall that protects against advanced digital threats. |
GOVERNANCE OF RISK
Effective risk management aligns risk and opportunities to Clover’s vision and mission. Furthermore, it informs a strategy of taking calculated risks in a manner that does not jeopardise the direct interest of stakeholders. Clover’s risk profile stipulates a prudent approach to corporate risk, as shown in decisions on risk tolerance and mitigation.
Clover’s Board assumes full responsibility for the governance of risk through a formal risk management framework. It effects its duties through the Audit and Risk Committee.
To ensure a consistent approach to risk management throughout Clover, the Board approved an Enterprise Wide Risk Management Framework that defines Clover’s risk-bearing capacity, risk appetite and risk tolerance. This policy and framework incorporates generally accepted and annually reviewed risk management practices and the integrated framework on Enterprise Risk Management disseminated by the Committee of Sponsoring Organisations (COSO). All service organisations, support functions, processes, projects and entities controlled by Clover are required to conform to this policy and framework. Management is continuing to integrate risk limits into business processes. This exercise includes setting authorisation thresholds for pursuing strategies within the predetermined levels of risk appetite, as well as establishing risk tolerances for operational functions.
These risk limits are used to compile the risk impact categorisation table, which is used for measuring and prioritising risk according to the materiality of impact values.
Management has been charged with the design, implementation and monitoring of Clover’s risk management structures. Each business unit conducts quarterly risk assessments to monitor the efficiency of these structures. Clover records and manages its risk universe on the BarnOwl risk management system, which prioritises material, inherent and residual risks.
The Management Risk Committee meets each quarter to table Clover’s key risks as well as the status of mitigating action plans. Key risks and mitigating actions are reported to the Audit and Risk Committee each quarter.
In the last financial year, Deloitte was appointed by Clover as part of the internal audit coverage plan to review the maturity and effectiveness of risk management function against Clover’s Enterprise Wide Risk Management Framework and the principles of the King III Code. Deloitte was tasked with providing appropriate recommendations for improving Clover’s risk management policy and processes. Deloitte concluded that management had solidly embedded risk management processes across the organisation to establish a well-defined risk function. Based on its review of risk management in other organisations, Deloitte concluded that Clover is generally more advanced in its risk management processes than comparable organisations. Deloitte has, however, made several recommendations to further embed risk management practices for deeper insights into risks and incidents.
Clover runs ongoing fraud awareness campaigns at branch level across all levels of staff to raise awareness of Clover’s Ethics Policy, the use of the ethics hotline and the fact that all calls to this line are treated confidentially by an independent party. Tip-offs received are actively investigated, followed-up on and resolved. The Board, assisted by the Audit and Risk Committee, are satisfied with the effectiveness of Clover’s risk management function.
GOVERNANCE OF INFORMATION TECHNOLOGY (IT)
Information technology is an integral part of the business and fundamental to ongoing operations. In view of the strategic importance of IT, Clover aligned its business requirements to available IT resources and technology to ensure appropriate IT strategy is formulated to improve Clover’s competitiveness for its future sustainability. Clover’s IT department (Clover IT) developed an IT Governance Framework that considers relevant structures and processes for meeting Clover’s business requirements. Relevant IT best practises, such as those in the COBIT framework, have been adopted to ensure appropriate mitigation of IT risks.
IT governance is a set of business processes that imposes management and control disciplines on IT activities to help ensure the integrity and protection of IT operations, while achieving business goals. This requires a system in which all stakeholders, including the Board, internal customers, and in particular departments such as finance, have the necessary input into the decision making process.
The Board is responsible for IT governance, which is included in the Board’s work plan. The Board delegated the responsibility to implement the IT Governance Framework to management under the oversight of the Audit and Risk Committee, which considers the major IT risks and opportunities quarterly. In this financial period, Deloitte performed advisory reviews on Clover’s IT Governance against the COBIT framework, including the protection of personal information and the adequacy of Clover’s IT disaster recovery procedures.
IT Governance Review
- Deloitte conducted an IT Governance Review with the intention to measure certain key governance objectives within the Clover IT environment against the COBIT 5 IT Governance Framework.
- The results indicated that Clover’s IT strategy is effectively linked to business goals and objectives and that IT is viewed as a strategic enabler that is essential to the business in achieving its goals.
- Clover performs regular IT risk assessments, in which IT risks are tracked and monitored.
- Clover’s IT Governance is conducted through formal structures, underpinned by supporting documentation such as IT Governance Charter, Clover Board Charter, IT Governance Framework, IT Risk Management and IT Strategy. Management monitors Clover’s risk exposure and the effectiveness of risk controls though a formalised IT Steering Committee and Management Risk Committee.
PoPI IT Readiness and Data Classification Review
- In anticipation of the Protection of Personal Information Act (PoPI), Deloitte performed an advisory review on Clover’s IT readiness for PoPI.
- From this review Clover IT has formalised a data classification policy for personal and confidential information
- This is supported by a formal privacy policy which governs the collection, processing, use and transfer of personal information.
Disaster Recovery
- During the past financial year Deloitte, as Clover’s Internal Auditors, performed an advisory review on disaster recovery procedures for Clover’s material IT infrastructures, including:
- Server Infrastructure:
- Network Infrastructure
- iSeries Environment (ERP Platform)
- Customer Service Centre (CSC).
- The outcome of these reviews indicated that Clover’s disaster recovery processes and procedures were adequate. Clover’s procedures are to be continuously improved for effective execution in line with best practice.
COMPLIANCE WITH LAWS, CODES, RULES AND STANDARDS
The Company Secretary is responsible for facilitating compliance throughout Clover.
Clover ensures that all employees are inducted and have a consistent understanding of compliance policies and procedures. Clover is in the process of finalising its compliance policy, which documents the Board’s stance on compliance within Clover for:
- assessing applicable laws, regulations and supervisory requirements
- rating and prioritising risks
- training employees to comply with applicable supervisory requirements.
Non-adherence with the documented standards will lead to disciplinary action, which could result in dismissal.
During the year under review, Clover consulted with business bodies to enhance its regulatory universe and documented processes for ensuring adequate and effective controls. Clover’s regulatory universe consists of more than 80 legislated and non-legislated supervisory requirements that are applicable to Clover’s business.
After consultation with business bodies and by adopting its risk rating methodology, the following acts and other regulations, in no particular order, have been identified as priority areas:
- Competition Act 89 of 1998
- National Building Regulations and Building Standards Act 49 of 1995
- Consumer Protection Act 68 of 2008.
- Foodstuffs, Cosmetics and Disinfectants Act No.54 of 1972.
- Income Tax Act 58 of 1962 (as amended).
- JSE Listings Requirements (not an Act but considered relevant).
- Occupational Health and Safety Act 85 of 1993.
- Value-Added Tax Act 89 of 1991 (as amended)
- Tax Administration Act 28 of 2011 (as amended)
- Employment Equity Amendment Act 47 of 2013
- Labour Relations Amendment Act 2014
- Companies Act 71 of 2008
- Agricultural Product Standards Act No. 119 of 1990.
Compliance with provisions of the Consumer Protection Act and Competition Act
Clover trains its staff and promotes a culture of compliance through online educational campaigns on the requirements of the Competition Act and the Consumer Protection Act.
During the review period, more than 840 employees from various departments completed the online training and refresher valuations (2015: 690 employees) for the Competition Act. Over 400 employees completed online training and assessments for the Consumer Protection Act.
It is compulsory for all management employees and those who may be exposed to anti-competitive or collusive behaviour to complete the training.
Clover has established a Competition Law Centre of Excellence (CLCE), in conjunction with Bowman Gilfillan as its Competition Law advisors. The CLCE has the function of ensuring proper standards of competition law compliance within Clover.
During the year under review, Bowman Gilfillan commenced a full review of Clover’s compliance with the Competition Act with a particular focus on areas of milk procurement, commercial arrangements and joint ventures. Bowman Gilfillan advised the Board that it did not identify any contravention of the Competition Act.
On 13 March 2014, the Acting Commissioner of the Competition Commission initiated a complaint against Clover Industries Ltd (Clover), Parmalat (Pty) Ltd (Parmalat) and Midlands Milk (Pty) Ltd (Midlands Milk), alleging that these three parties agreed, at some stage in or around 2012, to fix the purchase price of raw milk or trading conditions in terms of which the raw milk is purchased. This alleged transgression was in possible contravention of section 4(1) (b)(i) of the Competition Act 89 of 1998, as amended. The complaint only came to Clover’s attention during March 2015 and Clover immediately conducted an internal investigation in conjunction with Bowman Gilfillan. Bowman Gilfillan’s investigation did not reveal any conduct on Clover’s part that suggests that in 2012 it directly or indirectly co-ordinated with Parmalat and Midlands Milk to fix the purchase price of raw milk, or trading conditions in terms of which the raw milk is purchased, as alleged by the Commission.
At the time of writing, Clover has received no further communication from the Commission with regard to the above complaint.
During the review period, Clover complied in all material aspects with all relevant legislation. Apart from several legal proceedings arising from the routine course of business, the Board is satisfied that Clover does not face any material pending or threatening legal actions.
Insider trading
The Board has approved a Price-Sensitive Information Policy and an Insider Trading Policy for Clover. Directors, officers, relevant employees and service suppliers have been informed that they are compelled to comply with these policies.
Salient features of these policies are:
- no Clover employee may deal directly or indirectly in Clover shares on the basis of unpublished price-sensitive information regarding the business
- no director or officer of Clover may disclose trade information of the business
- directors and officers are precluded from trading in Clover shares during closed periods or prohibited periods as determined by the Board.
Closed periods are imposed from:
- the end of the first six-month period to the time of the publication of the interim financial results on the JSE’s Securities Exchange News Service (SENS)
- the financial year-end date to the time of the publication of the final financial results on the JSE’s SENS.
Any director wishing to trade in Clover’s shares must obtain clearance from the chairman of the Board or the designated director prior to trading in these shares.
INTERNAL AUDIT
Deloitte has been given responsibility for implementing the annual internal audit plan approved by Clover’s Audit and Risk Committee. As with any policy or protocol, there are inherent limitations to the effectiveness of any system of internal controls due to human error, or the deliberate circumvention or overriding of controls. Accordingly, an effective internal control system can provide only reasonable assurance with regards to preparing financial statements and safeguarding assets. Clover’s internal controls and systems are designed and monitored to provide reasonable assurance regarding the reliability of the financial statements and to protect, verify and maintain accountability for its assets. These controls are based on established policies and procedures, as implemented by trained personnel with segregated duties and responsibilities. Internal control systems are managed by way of a documented organisational structure with segregated responsibilities and established policies and procedures which are communicated throughout the business. Internal audit personnel are carefully selected, trained and developed to effectively execute their duties. Significant findings are reported to the Executive Committee as well as the Audit and Risk Committee, which will take corrective actions to address identified deficiencies in internal control.
During the review period, no material breakdowns in internal controls were reported within the key areas reviewed. These evaluations were the main input considered by the Board in reporting on internal control effectiveness.
Clover’s external auditors, Ernst & Young Incorporated (EY), performed a limited assurance review of management’s assessment of internal controls for financial reporting. This was a separate exercise done in addition to the internal audit conducted by Deloitte. No material findings were reported to the Audit and Risk Committee and nothing has come to the attention of the directors or the auditors that indicates any material breakdown in the effectiveness of the internal controls during the reporting period.
DISCLOSURE OF COMPLIANCE WITH CODE
As required by the JSE Listings Requirements, the Board endorses the King III code and is satisfied that Clover has conformed throughout the reporting period to all material aspects of the Code, except where it has applied the principle of ”apply or explain” as indicated in the King III index.
Jacques van Heerden
Company Secretary
12 September 2016
