ESG Report 2021
Exxaro Resources Limited
Integrated report 2021
Adequate and effective control
Our corporate governance structure supports our ability to create value in the short, medium and long term. Through this structure, the board exercises effective control, and builds and protects the organisation's reputation and legitimacy. We consider good corporate governance, the responsibility of our board, executive management and all our employees.
To further allow Exxaro's core businesses to thrive in an increasingly dynamic market and industry sector as well as to continue to support the execution of the approved strategy, the group governance was extensively reviewed in 2021. The board has subsequently adopted a new framework that provides an overview of its governance structures, principles, policies and practices, which together enable us to meet our statutory and regulatory requirements as well as direct how people interact with us and stakeholders.
The board committees enable the board to deal with more issues with greater efficiency by having focused expertise considering specific areas on its behalf. If approached appropriately, a committee's involvement should ideally also enhance the objectivity of the board's judgement. Therefore, to assist the board in executing its functions, the board delegates activities to its committees through formal terms of reference.
In 2020, the board committees embarked on a significant transformation journey, focusing on reimagining the operating model, acquisitions and evolving the broader business strategy. This was driven by a changing business environment and regulatory developments. To this end, we revisited and enhanced the terms of reference of our corporate governance structures, which in line with King IV, included:
The committees' terms of reference were updated in 2021 with key focus areas, annual work plans and objectives being revisited. The mandates of three committees were materially revised:
The board, on behalf of the company, recognises the statutory and fiduciary duties of directors of subsidiary companies and in particular, their duty to act in the best interests of the subsidiary company at all times whether or not the director is nominated to the board of the subsidiary company (in its capacity as holding company). If there is a conflict between a subsidiary company director's duties and Exxaro's interests, as holding company, the director's duties in the subsidiary company must prevail.
Our control and oversight functions consist of the corporate secretariat, risk management, compliance management, legal, strategy, internal audit and assurance, and finance (as it relates to financial compliance), which are responsible for providing enterprise-wide oversight on operational management and consolidated reporting. The heads of these functions have direct access to the board, audit committee, SERC and the RBR committee (as appropriate).
The internal audit function does not receive delegations through the CEO but is delegated authority directly by the audit committee to execute responsibilities in terms of the internal audit annual plan. However, the chief audit officer reports administratively to the FD. The board is ultimately responsible for overseeing the effectiveness of the oversight functions and ensuring an effective internal control environment within the group.
The company's delegation of authority policy and framework define the limits of authority designated to specific positions of responsibility in Exxaro's management structure. It also defines commitments and transactions that may include capital amounts approved by individuals on our behalf. The final approval of commitments and transactions outlined in the policy must always be made by parties with designated authority.
Our delegation of authority policy and framework are regularly reviewed to ensure aligned decision making. This also provides direction and clear delegation of power to management. The framework is adopted by our subsidiary company boards and implemented throughout the group as part of the overall group governance framework. A deep dive into the group delegation of authority policy and framework has been scheduled for 2022. In 2021, the energy business delegation of authority was subject to a rigorous process of review by the executive committee and the board with various opportunities to provide input around delegations and oversight requirements. A revised energy business delegation of authority framework was approved by the board and adopted by the Cennergi subsidiary companies. Following this, a review of sub-processes has been scheduled for 2022 as it is a critical governance pillar to ensure an effective control environment and is a key enabler for the achievement of business objectives.
The board is satisfied that the delegations in place contribute to role clarity and the effective exercise of authority and responsibilities.
The board governs technology and information management (IM) in a way that supports the organisation setting and achieving its strategic objectives.
The risk of data theft ranks as the most pertinent risk that IM is addressing due to previous lack of adequate controls. At present, there are several treatment efforts underway to mitigate the risk. Data discovery and classification, roll out of Intune solution for mobile devices and data encryption have been completed. A data loss prevention tool has been deployed and policies applied, which will be ongoing. Exxaro's security posture is continuously monitored and reported to the RBR committee.
Digital dashboard at our Belfast BU
A review of the IM governance space was conducted with the following outcomes:
The IM programme, including document IM and implementation of the data privacy programme in compliance with POPIA is in full force and effect.
Our ERM approach provides a framework and process for all types of risk management, regardless of risk or impact type at all levels of the organisation. The same terminology and assessment mechanisms are used for finance, projects, safety and operational risk management. We have a set of risk names, one impact and one likelihood scale used across different disciplines to ensure management concentrates efforts and resources on material activities.
The risk management function, through the combined assurance model, coordinates with internal audit to obtain evidence on the effectiveness of treatment and control activities in achieving the desired and planned risk treatment outcomes. Assurance providers (internal audit, sustainability KPI audits, external assurance providers, self-assessments and accreditation reviews) monitor effectiveness of significant risk treatments and compliance with regulatory requirements, non-binding rules, codes and standards as well as policies and procedures.
The ERM framework was reviewed to update changes in reporting structures and role designations, and to align with current governance practice and standards. The board is satisfied that Exxaro has a mature risk process that ensures risks potentially impacting our strategic objectives are pursued by management to create shareholder value.
Please refer to our business for details on our risks and combined assurance for effective governance for details on our combined assurance for effective governance.
We are committed to maintaining high standards of integrity, professionalism and ethical behaviour in our relationships. We comply with relevant legal requirements in our jurisdictions, and the law serves as a minimum standard of conduct. Beyond complying with the law, it is important that every director and employee is sensitive to the appearance of improper conduct, and establishes whether or not our actions are honest and responsible.
The group's compliance philosophy is captured in a compliance policy. It supports ethical and responsible corporate citizenship, and seeks to create sustainable value for all stakeholders by striving for operational efficiency, growth and regulatory compliance with applicable laws.
We conducted an audit of our compliance function in 2020 to ensure effective compliance management was applied and key areas were addressed in 2021.
A specific focus area for 2021 was the POPIA project implementation plan roll-out across the organisation to ensure compliance by the group, which included review of policies and adopting new policies, review of systems and processes as well as training throughout the organisation.
Report Index