Risk management

Our risk appetite level largely remains cautious rather than aggressive. This has made the Group more resilient and adequately responsive to difficult local and global socio-economic conditions.

Our risk management process

Famous Brands is subject to various risks, including compliance, financial, operational, information technology and strategic risks. The Board and management are accountable for risk management and find an appropriate balance between taking risks and exercising prudence.

Our risk management framework aligns with the Committee of Sponsoring Organizations of the Treadway Commission Framework and has remained solid and mostly unchanged over the past year. Since our strategic choices reduce risks, risk management and the Group’s business strategy go hand in hand. Famous Brands is careful to avoid subjecting the Group to risks that exceed the risk appetite.

Risk management is the responsibility of the Audit and Risk Committee, which provides regular updates to the Board. The Audit and Risk Committee sets out the Group’s risk appetite based on the level of risk it is willing to accept in pursuit of the Group strategy.

At an operational level, the Group’s current and potential risks are tracked by a specialised Risk Forum comprising Exco members and representatives from Internal Audit and other divisions. This forum also allows Famous Brands to realise innovation opportunities by exploring the opportunities related to risks.

In line with good governance practices, every local and foreign legal entity has a duly constituted Board. We have an established process to ensure that these entities prepare their own risk register, which is tabled at entity Board meetings.

Together with the Risk Forum, the Committee and the management team foster a culture of risk governance and awareness throughout the Group. The Group receives expert advice from our Group Risk Executive on properly incorporating risk management procedures into daily operations. The Group Risk Executive and other risk specialists are involved in the development and execution of business strategy, including implementing key action plans. They are present in project teams as a sounding board on potential issues.

Key risks are identified based on the following:

  • Risk-bearing capacity: The capacity to absorb risk-related losses without threatening the Group’s ongoing sustainability based on its current business model.
  • Risk appetite: The amount and type of risk the Group is willing to accept in pursuing its strategic objectives.
  • Risk tolerance: The acceptable levels of variation relative to achieving the Group’s strategic objectives.

Famous Brands confirms that there were no unexpected or unusual micro risks that materialised outside of our risk appetite.

Compliance monitoring

Famous Brands is developing a comprehensive regulatory compliance framework to map the relevant legislative universe across each geography. This framework aims to lessen the chance of not meeting regulatory requirements.

We track our Protection of Personal Information Act (POPIA) compliance and use the internal audit assurance process to identify improvement areas. The Group is in the process of aligning business operations to data protection laws across all our markets.

In the new financial year, we will explore implementation of a governance, risk and compliance (GRC) tool to facilitate the assessment and consistent management of regulatory compliance in all our markets.

Improving our risk management in 2023

Enhancing data risk management

In 2023, data risk management was prioritised and the Master Data Department now reports to the Group Risk Executive. The Master Data Department acts as a core data gatekeeper to ensure that data is clean, appropriately integrated and secured. We are exploring ways to drive robust data analytics through this department to provide better data risk insights to the business.

Insurance model and insurer risk reduction requirements

The insurance market continues to harden with insurers repricing risk and revaluating the risks they will cover. In 2022, Famous Brands completed a Group-wide insurance review, and in 2023 we completed the work to optimise our insurance model. We are confident that this work has ensured that our insurance model is appropriate and will address uninsurable and difficult to insure risks in the medium to long-term. In 2024, we will commence optimisation of the insurance cell captive with our partners.

In addition, we are implementing the insurance risk reduction requirements set by our insurer. This included improving how we secure and protect our physical operations and assets.

Implementing the three-year IT security plan

In 2021, we completed a security gap analysis with an external service provider to understand our maturity level and benchmark our security environment against relevant industry standards such as the National Institute of Standard and Technology (NIST) and ISO 27001. The findings from this report were utilised to develop Famous Brands three-year IT security roadmap, to assist the group in maturing their IT security environment.

In 2023, the IT security team together with their strategic partners worked through implementing year two of the three-year IT security roadmap. We have made significant strides in improving the overall security maturity over the past two years. These improvements include maturing the following:

  • Application security
  • Data security
  • Endpoint and mobile security
  • Security operations
  • Human security
  • Infrastructure protection
  • Network security
  • Threat management
  • Identity and access management

With the support of an independent cyber security expert, we continue to conduct annual penetration test and breach attack simulations, to find and exploit vulnerabilities in our environment. This is over and above the vulnerability management programme implemented this year.

Famous Brands continue to focus on human security, where we are investing in employee training and awareness programs to ensure that all employees understand and adhere to security protocols.

We have set ambitious targets for 2024 to continue our upward trajectory in terms of security maturity. This will well-position the Group to stay ahead of evolving security threats and maintain the trust of its consumers, stakeholders and partners.

Focus areas for 2024

Famous Brands continues to enhance its risk management capabilities, with the following being focus areas for 2024:

  • Reinforce business resilience against business interruption events.
  • Deployment of tools to drive risk management automation and analytical capability.
  • Optimise the cell captive insurance model.
  • Enhance ESG risk management capability.
  • Implementation and enhancement of the three-year IT security roadmap/plan.

Key risks

The Group’s top ten key risks are defined below, along with their potential impact, our mitigating actions, and the potential upside they offer. We have identified both internal and external risks. We indicated impact categories based on the tolerance levels across the four areas: finance, reputation, consumer and employee. The likelihood is based on the probability of occurrence.

Inherent risk heatmap

1. Sustainable revenue growth post COVID-19 still uncertain due to macro risk factors

Potential
root causes

Potential impact
on value

Residual mitigation
actions

Strategic matters

Opportunities

  • Leverage our presence in AME.
  • Leverage flexible trading formats, including potential growth in the drive-thru format.
  • Leverage own home delivery capability.
  • Leverage business intelligence and consumer relationship management (CRM) technology.
  • Menus and basket innovation.
  • Retail product growth.
  • Consumers face extreme pressure due to high inflation, increasing energy costs, rising interest rates, and a slow economic recovery.
  • Increased local and global political instability, including the continuation of the Russia/Ukraine war.
  • Competition from third-party food aggregators remains fierce.
  • Operating margin pressure.
  • Impact on shareholder returns.
  • Market share decline.
  • A strategic plan is in place to deliver on different formats and channels. The big box format legacy around Casual Dining Restaurants is being addressed via a smaller, more agile footprint.
  • Company-owned store defence strategy is in place to protect key sites and overall market share.
  • Cash generation and preservation remain critical.
  • A ten-year strategic plan is in place with a key focus on growing our brands in South Africa and selected markets.

2. Information security breach through cyber and internal attacks

Potential
root causes

Potential impact
on value

Residual mitigation
actions

Strategic matters

Opportunities

Benefits from enhanced technology.

  • Potential IT structure misalignment with complexities, governance and risks associated with the Group’s technology stack.
  • Failure to adequately address identified IT security and general control vulnerabilities.
  • Loss of intellectual property.
  • Regulatory contraventions.
  • Systems downtime.
  • Reputational damage.
  • Famous Brands with its strategic partners are effectively implementing a three-year IT security plan which includes enhanced cyber security control measures.
  • Cyber security plan has been overlayed by combined assurance model which provides both internal and external assurance.

3. Onerous capital requirements on consumer-facing technology to maintain competitive edge

Potential
root causes

Potential impact
on value

Residual mitigation
actions

Strategic matters

Opportunities

  • Market share gains.
  • Operational efficiencies achieved.
  • Enhanced consumer experience across multiple touchpoints.
  • Competitors are investing ahead of the curve in response to current and future consumer trends.
  • COVID-19 has accelerated the consumer shift to convenience enabled by technology.
  • Cashflow pressure.
  • Revenue loss.
  • Market share erosion.
  • Group-wide enterprise architecture and structure strategy is in place to cover operating system architecture and consumer-facing technology.
  • Execution of key consumer-facing technology initiatives.
  • Regular enhancements of online experience, payment processes, data analytics and consumer relationship management.

Read more here.

4. Supply chain disruptions

Potential
root causes

Potential impact
on value

Residual mitigation
actions

Strategic matters

Opportunities

  • Product innovation and operational efficiencies.
  • Our vertically integrated business model offers our franchise partners increased competitive advantage.
  • Geopolitical and security instability drives increased lead times, shipping costs, and fuel increases.
  • Climate change leads to poor weather patterns and crop yields.
  • Increased incidence of animal disease outbreaks.
  • Water shortages and a potential day zero situation in Gqeberha.
  • Instability in the local transport industry with recurring foreign driver-related protests.
  • Union fabric is deteriorating with an increased trend towards disruptive wage disputes.
  • Margin erosion.
  • Pressure on working capital.
  • Negative impact on service levels.
  • Planning and procurement teams review product and price impacts across the value chain.
  • The acquisition and reconstruction of the Midrand Campus will provide capacity and agility in the medium to long term.
  • Vertical integration allows us to control production, increase inventory holding and manage gross margins.
  • Supply Chain business continuity and disruption plans in place.
  • Insurance strategy and risk management plans are in place to mitigate the impact of business disruptions.
  • Day zero plan in place for our Gqeberha operations.

5. Unreliable electricity supply negatively impacting Supply Chain and restaurants

Potential
root causes

Potential impact
on value

Residual mitigation
actions

Strategic matters

Opportunities

Alternative energy sources with reduced carbon emission impact on the environment.
  • An unreliable power supply in South Africa has significant impact on the Group.
  • Poor local distribution infrastructure that is prone to breakdowns.
  • Generator backup solutions are not fit for purpose.
  • Operational inefficiencies.
  • Margin erosion.
  • Reduced day stock cover to meet sales demand. If we are unable to maintain production, we use reserves, which increases the risk of stock unavailability.
  • Execute our plan to have key sites resilient to extended load shedding without disruptions.
  • Accelerate investment in more efficient generators and solar power.
  • The majority of restaurants have some form of back-up power.
  • Develop contingency plan for electricity blackout scenario.

6. Inability to respond appropriately to business disruption

Potential
root causes

Potential impact
on value

Residual mitigation
actions

Strategic matters

Opportunities

  • Shareholder value protection and enhancement.
  • Business rationalisation and optimisation.
  • Comprehensive business continuity plans in the development stage for some operations.
  • Labour laws limit speed and agility in a disruptive environment.
  • Increased trend of wage disputes leading to protests.
  • Extended period to recover operations resulting in revenue loss and increased operating costs.
  • Interruption of service to franchise network and consumers.
  • Supply Chain business continuity and disruption planning in place per operational site.
  • Insurance risk management plan in place, including an appropriate solution for uninsurable and difficult to insure risks.
  • Acquisition and development of the Midrand Campus will provide more capacity and flexibility.
  • Develop contingency plan for electricity blackout scenario and update business continuity plans accordingly.

7. Increasing regulatory environment

Potential
root causes

Potential impact
on value

Residual mitigation
actions

Strategic matters

Opportunities

Increased agility in responding to new regulations could be a competitor advantage.
  • Increased need for a robust Group regulatory framework and dedicated focus.
  • Increasing trend towards demanding regulatory requirements.
  • Difficulty in complying with new regulations immediately.
  • Regulatory fines and penalties.
  • Litigation and reputational damage.
  • Excessive use of executive time to meet compliance requirements.
  • Increasing cost of doing business.
  • Develop and implement the regulatory compliance framework.
  • Resources in place to comply with regulations and prepare the business for changes to these.
  • We are executing plans to strengthen in-country governance and regulatory compliance across AME.
  • We continue to monitor impact of grey listing and related regulations.
  • Explore implementation of an integrated GRC tool.

8. Uncertainty over franchise partner sustainability and profitability post the COVID-19 impact

Potential
root causes

Potential impact
on value

Residual mitigation
actions

Strategic matters

Opportunities

  • Improved franchise partner sustainability through more favourable rental terms.
  • Menus and basket innovation.
  • New thinking on how to save costs and improve sustainability where possible.
  • Our vertically integrated business model offers our franchise partners increased competitive advantage.
  • Difficult trading conditions for our franchise partners due to energy insecurity and increased input costs.
  • The Casual Dining Restaurant segment has not fully recovered from the pandemic.
  • Uncertainty over favourable lease negotiations and renewal terms due to some landlord hostility.
  • Social and political instability has heightened the risk of unrest.
  • The government’s stance on foreign nationals directly impacts the restaurant sector.
  • Margin pressure.
  • Negative impact on annual net store growth.
  • Increased number of franchise business failures.
  • Providing business sustainability relief packages to our franchise partners is an option in the short to medium term.
  • We continue coordinating rent relief and lease renegotiations for our franchise partners to ensure favourable lease terms. Relocations are applied where necessary.
  • We have coordinated class action cases on business interruption claims with various insurers on behalf of our franchise partners.

9. Inefficient financial systems and processes

Potential
root causes

Potential impact
on value

Residual mitigation
actions

Strategic matters

Opportunities

  • Continue unlocking operational efficiencies through standardisation and automation.
  • Financial system inadequacies.
  • Limited automated financial solutions.
  • Period close inefficiencies.
  • Reduced dependency on financial information for decision making.
  • Human errors.
  • Plans in place to introduce a new financial solution for business unit reporting.
  • Developing business intelligence tool for Group reports.
  • Completed the project to develop a new Group consolidation tool.
  • Streamlining and strengthening financial processes.
  • Continued rollout of the enterprise resource planning system across the Group.
  • Employed an IFRS specialist who supports the business IFRS application.

10. Loss of reputation and severe brand damage

Potential
root causes

Potential impact
on value

Residual mitigation
actions

Strategic matters

Opportunities

Enhanced stakeholder value and strong ethical culture.
  • Unethical behaviour by a key stakeholder locally or abroad.
  • Non-adherence to set Group procedures and escalation framework.
  • Loss of trust.
  • Loss of confidence in management.
  • Loss of market share.
  • Continued promotion of ethical practices among our key stakeholders based on an ethics framework.
  • We have conducted an independent ethics and risk opportunity assessment through the Ethics Institute.
  • Ethics strategy and management plan developed and ready for implementation.

Emerging risks

Our risk management process considers emerging risks and their potential impact on the Group. In the 2023 calendar year, we considered the potential impact of the following emerging risks:

  • Trading in a recessionary environment where the cost-of-living crisis is on the rise.
  • Unrest and disruption related to 2024 election campaigns in South Africa, and unstable coalition-run municipalities with an impact on service delivery.
  • The Zimbabwean Exemption Permit extension will lapse in December 2023 and may result in increased xenophobic attacks.
  • The potential for increased crime and a break down in the rule of law.
  • Increased business costs and bureaucratic processes related to South Africa’s grey listing.
  • Animal disease outbreaks, including foot and mouth.
  • Mental health and financial stress of employees.
  • The occurrence of a total grid failure in South Africa.
  • General collapse of local water infrastructure and the potential of Day Zero in Gqeberha.
  • Hardening insurance market.
  • Natural disasters and extreme weather events.
  • Geoeconomic and security confrontations.
  • Government fiscal outlook deteriorating.
  • Accelerated foreign capital outflows from emerging markets including South Africa.
  • Retention of key human resources.