Combined assurance for effective governance

The board, supported by the audit committee, is ultimately responsible for Exxaro’s system of internal control, which has been designed to evaluate, manage and provide reasonable assurance against material misstatement and loss.

We apply a combined assurance model to optimise assurance by management, as well as internal and external providers, while fostering a strong ethical climate and mechanisms to ensure compliance.

Using our board-approved enterprise risk management approach, management identifies key risks facing Exxaro and implements the necessary internal controls. The process is monitored and evaluated by internal audit while independent external auditors cover key controls and accounting matters. Every year, key sustainability indicators are selected for reasonable or limited external assurance ( ESG report) with comparable information for trend analysis where possible.

The board and audit committee assessed the effectiveness of controls for the year to 31 December 2019 as satisfactory, principally through a process of management self-assessment (including formal confirmation by executive management), reports from internal audit, independent external audit and other assurance providers.

Approach, governance and reporting

Exxaro defines assurance broadly to cover all sources, including external assurance, internal audit, management oversight and regulatory inspections.

Our combined assurance model includes and optimises all assurance services and functions to collectively provide an effective control environment and support the integrity of information used for internal decision making by management, the board and its committees, and in our external reports including:

• Corporate governance disclosures in terms of King IV^TM
• Financial statements and other external reports, including our integrated report and ESG report.

Our combined assurance forum is a working group, which coordinates assurance activities within Exxaro. Regular invitees include members of the audit committee as well as the sustainability, risk and compliance committee. The forum’s activities and outcomes of assurance reports are presented quarterly to the audit committee.

When commissioning specific assurance prior to publishing external reports, the forum considers:

• Application of assurance should be applied to underlying data used to prepare a report, or to the process for preparing and presenting a report, or both
• The nature, scope and extent of assurance in terms of suitability for the intended audience of a specific report
• The specification of applicable criteria for measuring or evaluating the underlying subject matter of the report.

The well-defined and embedded process enables Exxaro to publish specific disclosure on the approach to assurance of external reports including:

• A brief description of the nature, scope and extent of assurance functions, services and processes underlying preparation and presentation of a report
• A statement by the board on the integrity of a report and basis for this statement with reference to the assurance applied.

Assurance review

For the year under review, the sources, level, and focus area of assurance commissioned and performed, are summarised below.

			Function assured
Focus area	Assurance provider	Tier/level of assurance*	Corporate	Business unit
External/statutory audit	PwC	3	Yes	Yes
Selective non-audit services	PwC	3	Yes	Yes
Sustainable development/KPIs	PwC	3	Yes	Yes
Environmental liability provisioning	PwC	3		Yes
Mining rights and environmental legal compliance	Inlexso	3		Yes
B-BBEE DTI code compliance	Empowerdex	3	Yes	Yes
Mining charter compliance	Ngubane	3	Yes	Yes
Insurance risk surveys	IMIU	3		Yes
Major and mega capital projects	EY	3		Yes
Mineral Resource and Mineral Reserve statement	EY	3		Yes
Governance, risk and internal controls	EY	3	Yes	Yes
Employee benefits	Ngubane	3	Yes	Yes
Social and labour plan projects	Ngubane	3		Yes
ISO and OHSAS certifications	Various	3		Yes

*Tier/level of assurance refers to independent external assurance.

Outcome of assurance reports

The outcome of assurance reports issued, is illustrated below.

2012 to 2019

The total number of findings raised since 2012 is 2 086. The split by status of the findings is depicted in the chart below. As of 31 December 2019, there was a total of 1 691 findings that had been successfully resolved from the total of 2 086, leaving a total of 395 open findings that require the attention of management and assurance providers.

Status of findings	Internal audit	Other assurance providers	Total
Follow-up in progress	11	0	11
Ready for audit	95	206	301
Within timelines	3	35	38
Open/outstanding (overdue)	30	15	45
Total	139	256	395

Overdue findings have been classified by ratings assigned in the final audit report and split into audit source below.

Audit source	Level 1 (high)	Level 2 (medium)	Level 3 (low)	Not rated	Total
Internal audit	7	12	1	10	30
Other assurance providers	3	9	3	0	15
Total	10	21	4	10	45