Annual Financial Statements 2020

102 ANNEXURE CRISK AND CAPITAL MANAGEMENT OPERATIONAL RISK CONTINUED RISKS Credit Funding and liquidity Market Operational STANDARD BANK NAMIBIA LIMITED Annual financial statements 2020 103 Compliance risk Compliance risk is the risk of legal or regulatory sanctions, financial loss or damage to reputation that the company may suffer as a result of its failure to comply with laws, regulations, codes of conduct and standards of good practice that are applicable to its financial services activities. Approach to compliance risk management The company's approach to managing compliance risk is proactive and premised on internationally accepted principles of risk management, including those recommended by Basel. It is aligned with other company risk type methodologies. company compliance supports business in complying with current and emerging regulatory developments, including money laundering and terrorist financing control, sanctions management, identifying and managing conflicts of interest and market abuse and mitigating reputational risk. Framework and governance Compliance risk management is a core risk management activity overseen by the BRC. The head of compliance has unrestricted access to the chief executive and to the chairman of the BAC, thereby ensuring the function's independence. The company's compliance framework is based on the principles of effective compliance risk management, as outlined in the Banking Institutions Act, and recommendations from international policy-making bodies. Our business compliance model includes dedicated compliance support and advisory services to business which is supplemented by training. A robust risk management reporting and escalation procedure requires both business unit and functional area heads to report monthly and quarterly on the status of compliance risk management in the company. Money laundering and terrorist financing control Legislation across the company pertaining to money laundering and terrorist financing control imposes significant requirements in terms of: ⚫ customer identification ⚫record keeping • staff training • obligations to detect, prevent and report money laundering and terrorist financing. SBG minimum standards are implemented throughout the company. The company also subscribes to the principles of the Financial Action Task Force, an inter-governmental body developing and promoting policies to combat money laundering and terrorist financing, of which Namibia is a member country. Compliance training Employees are made aware of their responsibilities in terms of current and emerging legislative and regulatory requirements through ongoing training and awareness initiatives. Employees, including senior management, are made aware of their legislative responsibilities either through e-learning, face-to-face interventions or through targeted awareness campaigns. Training is key to embedding a culture of compliance in the company. Regulatory change The company aims to embed regulatory best practice in our operations in a way that balances the interests of various stakeholders, while supporting the long-term stability and growth in the markets where we have a presence. The company operates in a highly regulated industry across multiple jurisdictions, including the need to comply with legislation with extra-territorial reach. The company's regulator is the Bank of Namibia (BON). BON supervises both the company and SBN, the banking entity, on a consolidated basis. Environmental and social risk Environmental and social risk assessment and management deals with two aspects, being those over which: ⚫ the company does not have control but has potential to impact on its operations and those of its clients the company does have direct control such as waste management and the use of energy and water. The uncontrolled aspects include threats to the global environment result from changing global climate and its impact on weather patterns, fresh water, infrastructure, economic growth and social resilience. The company uses two approaches to screen and process projects, namely the Equator Principles for project finance loans and an internally developed appraisal system for other financial product types. These tools are designed to identify the risks associated with a transaction and the customer's ability to manage environmental and social issues, as well as the risks associated with the transaction itself such as the nature and value of the loan, and the industry sector involved. All project finance deals will in future be screened for climate change risk and human rights impacts. This is in addition to the more traditional environmental and social risks which include those associated with occupational health and safety, relocation of communities and the impact on livelihoods of individuals. In relation to the controllable aspects, energy use, water use, waste production and carbon emissions resulting from our operations are recorded within an environmental management system. This is used both for improving efficiency and reporting to key stakeholders. Environmental efficiency targets have been set at SBN level. From a governance perspective, the company's material issues are companied into six broad categories which form the basis of engagement on sustainability issues with the company executive committee and the board. These are: ⚫ sustainable long-term financial performance ⚫ governance, regulation and stakeholder engagement ⚫ sustainable and responsible financial services ⚫ socioeconomic development • a positive and consistent employee experience ⚫ the environment. Business continuity management and resilience Business continuity management is defined as a holistic management process that identifies potential impacts that threaten the company and provides a basis for planning in mitigation to these operational impacts. It further provides a framework for building resilience and the capability for an effective response that safeguards the interests of key stakeholders, reputation, brand and value-creating activities. The company has business resiliency and continuity plans in place to ensure its ability to operate on an ongoing basis and limit losses in the event of severe business disruptions. Crisis management is based on a command and control process for managing the business through a crisis to full recovery. These processes may also be deployed to manage non-operational crises, including business crises, at the discretion of senior management. Contingency and recovery plans for core services, key systems and priority business activities have been developed and are revisited as part of existing management processes to ensure that continuity strategies and plans remain relevant. Information risk management Information risk is defined as the risk of accidental or intentional unauthorised use, modification, disclosure or destruction of the company's information resources, which compromises confidentiality, integrity or availability. Information risk management deals with all aspects of information in its physical and electronic forms. It focuses on the creation, use, transmission, storage, disposal and destruction of information. Information risk management is responsible for establishing an information security management system inclusive of an information risk management framework, and promotes information risk management policies and practices across the company. The execution of these policies and standards is functionally overseen by the company chief information officer. Financial crime control Financial crime includes fraud, money laundering, violent crime and misconduct by staff, customers, suppliers, business partners, stakeholders and third parties. The company will not condone any instance of financial crime and where these instances arise, the company takes timely and appropriate remedial action. Financial crime control is defined as the prevention and detection of, and response to, all financial crime in order to mitigate economic loss, reputational risk and regulatory sanction. The company's financial crime control unit is mandated by the BAC to provide capabilities which minimise the overall impact of financial crime on the company. This ensures the safety of our people and assets, and builds trust with our stakeholders. The company's financial crime control function reports to the head of risk. This function enables a holistic view of the status and landscape of financial crime prevention, detection and response, including emerging threats. The company head of financial crime control has unrestricted access to executives and the chairperson of the BAC, thereby supporting the function's independence. Occupational health and safety The health and safety of all employees remains a priority. Training of health and safety officers and employee awareness is an ongoing endeavour. company policies are being rolled out to all operations and the number of incidents being reported is reducing. Other risk Business risk Business risk is the risk of loss due to operating revenue not covering operating costs and is usually caused by the following: ⚫ inflexible cost structures ⚫ market-driven pressures, such as decreased demand, increased competition or cost increases company-specific causes, such as a poor choice of strategy, reputational damage or the decision to absorb costs or losses to preserve reputation. It includes strategic risk and post-retirement obligation risk. Business risk is governed by EXCO which is ultimately responsible for managing the costs and revenues of the company. The company mitigates business risk in a number of ways: • Extensive due diligence during the investment appraisal process is performed, in particular for new acquisitions. ⚫ New product processes per business line through which the risks and mitigating controls for new and amended products and services are tabled and discussed. • Stakeholder management ensures favourable outcomes from external factors beyond the company's control. ⚫ The profitability of product lines and customer segments is consistently monitored. • Tight control is maintained over the company's cost base, including the management of its cost-to-income ratio. This allows for early intervention and management action to reduce costs where necessary. Being alert and responsive to changes in market forces. There is a strong focus in the budgeting process on achieving headline earnings growth while containing cost growth. In addition, contingency plans are built into the budget that allow for costs to be significantly reduced in the event that expected revenue generation does not materialise. ⚫ The company continually aims to increase the ratio of variable costs to fixed costs, allowing for more flexibility to proactively reduce costs during economic downturn conditions. Strategic risk Strategic risk is the risk that the company's future business plans and strategies may be inadequate to prevent financial loss or protect the company's competitive position and shareholder returns. The company's business plans and strategies are discussed and debated by members of management and non-executive board members. Post-retirement obligation risk Post-retirement obligation risk is the risk to the company's earnings that arises from the requirement to contribute as an employer to an under-funded defined benefit plan. The risk arises due to either an increase in the estimated value of medical liabilities or a decline in the market value of the fund's assets or reduction in their investment returns. The company operates a defined contribution plan. The company maintains a number of defined benefit pension and medical aid provider schemes for past and certain current employees, collectively termed post-retirement obligations. Refer to note 35. Reputational risk Reputational risk results from damage to the company's image which may impair its ability to retain and generate business. Such damage may result in a breakdown of trust, confidence or business relationships. Safeguarding the company's reputation is of paramount importance. Each business line, legal entity or support function executive is responsible for identifying, assessing and determining all reputational risks that may arise within their respective areas of business. The impact of such risks is considered alongside financial or other impacts. Matters identified as a reputational risk to the company will be reported to the company head of governance and assurance who, if required, will escalate these matters to EXCO. Should a risk event occur, the company's crisis management processes are designed to minimise the reputational impact of the event. Crisis management teams are in place both at executive and business line level to ensure the effective management of any such events. This includes ensuring that the company's perspective is fairly represented in the media.