Risk management

Appropriate and calculated risk taking is essential to our Group’s success and growth.

Risk management process

Famous Brands is exposed to several risks, including strategic, financial, operational and compliance risks. The Board and management are responsible for overseeing risk management and ensuring the Group strikes an appropriate balance between taking risks and applying caution.

Our risk management framework remained robust and largely unchanged in the past year and is aligned with the Committee of Sponsoring Organizations of the Treadway Commission Framework. There is a strong correlation between risk management and the Group’s business strategy as our strategic choices mitigate risks. Famous Brands is mindful of not exposing the business to unacceptable levels of risk.

At a Board level, risk management is delegated to the Audit and Risk Committee, which provides regular updates to the Board. The Audit and Risk Committee sets out the Group’s risk appetite, based on the level of risk it is willing to accept in pursuit of the Company strategy.

The Committee and the management team, together with the established Risk Forum, provide a culture of risk governance and awareness throughout the Group. Our Group Risk Executive provides specialist guidance to the Group on better integrating risk management processes into day-to-day activities.

At an operational level, a dedicated Risk Forum consisting of Exco members and representatives from Internal Audit and other functions meet regularly to monitor the Group’s existing and emerging risks. This forum also allows Famous Brands to realise innovation opportunities by exploring risks.

Key risks are identified based on:

• Risk-bearing capacity: The capacity to absorb losses related to risks without threatening the Group’s ongoing sustainability based on its current business model.
• Risk appetite: The amount and type of risk the Group is willing to accept in pursuing its strategic objectives.
• Risk tolerance: The acceptable levels of variation relative to achieving the Group’s strategic objectives.

Compliance monitoring

The Group is developing a comprehensive regulatory compliance framework to map the legislation across each geography. This will further mitigate the risk of failing to meet regulatory and compulsory standards.

Famous Brands monitors its POPIA compliance and has leveraged the internal audit assurance process to identify gaps and improvement opportunities. The Group also reviewed the information laws in various countries and updated the governance process to ensure regulatory risks are appropriately identified and managed.

Famous Brands monitors developments regarding the Extended Producer Responsibility regulations that came into law in South Africa in May 2021. Work has been completed to ensure Famous Brands is recognised by the relevant producer responsibility organisations. The producer responsibility organisations are still aligning with the regulator on processes to ensure effective implementation of the regulation.

Cyber security enhancements

Each year we conduct a penetration test and/or a breach attack simulation, a security exercise where a cyber security expert finds and exploits vulnerabilities in our IT environment. In addition, we conducted a gap analysis with an external service provider to benchmark the Group’s security environment against IT security frameworks from the National Institute of Standard and Technology, Centre of Internet Security and ISO270001. The results from this analysis fed into the development of the three-year IT security road map.

Insurance review

In 2022, Famous Brands reviewed its insurance cover across the Group. Based on the gap analysis and recent black swan events, we are still optimising our insurance model to ensure it is still fit for purpose and will address uninsurable and difficult to insure risks. This work will be concluded in 2023.

Business continuity planning

Famous Brands continued its work to improve business continuity planning to close gaps at specific manufacturing and logistics sites. For example, this included further improvements in KwaZulu-Natal after the July 2021 unrest.

Going forward

Our focus in the coming year is to further entrench our business and insurance risk management capabilities throughout the Group. This includes operationalising risk management in each operating entity, including Company-owned restaurants, implementing the technology enterprise architecture and structure strategy which includes the three-year IT security plan and completing the regulatory compliance framework, which covers the regulatory requirement of the countries where we operate.

Key risks

Our top 10 key risks are defined below, along with their potential impact, our mitigating actions and future opportunities they present. Both internal and external risks are identified.

Risks are ranked according to the severity of their potential impact on the Group. Impact categories are determined based on tolerance levels across four areas: finance, reputation, consumer and employee factors. Likelihood is based on the probability of occurrence.

Residual risk heat map

Residual risk assessment

The residual risk and the extent of mitigation are illustrated in the graph below.

1. Revenue growth deceleration and recovery impacted by COVID-19

2. Information security breach through cyber and/or internal attacks

3. Onerous capital requirement to implement consumer-facing technology

4. Unreliable electricity supply impacting the Supply Chain and restaurant trade

5. Inability to respond appropriately to business disruptions

6. Regulatory and compulsory standards compliance failures

7. Uncertainty over franchisee sustainability and profitability during and post-COVID-19 impact

8. Inefficient financial systems and processes

9. Supply chain disruptions

10. Loss of reputation and severe brand damage

Emerging risks

Our risk management process considers emerging risks and their potential impact on the Group. In 2022, we considered the potential impact of the following emerging risks:

• Infectious diseases including African swine flu, avian flu and foot and mouth disease.
• The water crisis in the Eastern Cape including the potential of day zero.
• Supply chain shortages and stock replenishment delays in the UK due to a shortage of lorry drivers.
• A proposed health promotion levy in South Africa to include ultra-processed foods such as junk food.

Looking forward, we are tracking several risks, which include:

• A deteriorating global security picture including conflict and potential instability in Africa.
• Local macro-economic issues and infrastructure challenges, including the availability of water.
• Continued supply chain disruptions.
• Rising food inflation.
• Insurance risk management including the impact of uninsured and difficult to insure risks.