Combined assurance for effective governance

The board, supported by the audit committee, is ultimately responsible for Exxaro's system of internal controls, which has been designed to evaluate, manage and provide reasonable assurance against material misstatement and loss.

We apply a combined assurance model to optimise assurance by management, as well as internal and external providers, while fostering a strong ethical climate and mechanisms to ensure compliance.

Using our board-approved ERM approach, management identifies key risks facing Exxaro and implements the necessary internal controls with comparable information for trend analysis where possible.

The board and audit committee assessed the effectiveness of controls for the year ended 31 December 2022 as satisfactory, principally through a process of management self-assessment (including formal confirmation by executive management), reports from internal audit, independent external audit and other assurance providers.

Approach, governance and reporting

Exxaro defines assurance broadly to cover all sources, including external assurance, internal audit, management oversight and regulatory inspections.

Our combined assurance model includes and optimises all assurance services and functions to collectively provide an effective control environment and support the integrity of information used for internal decision making by management, the board and its committees, and in our external reports including:

• Corporate governance disclosures in terms of King IV
• Financial statements and other external reports, including our integrated report and ESG report

The forum's activities and outcomes of assurance reports are presented quarterly to the audit committee.

Assurance review

For the year under review, the sources, level and focus area of assurance, commissioned and performed, are summarised below.

Outcome of assurance 2022

As 31 December 2022 there were 394 open findings, reflecting an increase of 73 open findings in the year. Of the 394 open findings, 310 (79%) findings are classified as "Ready for Audit" (a three-month "waiting" period is applied before performing follow-up procedures for the control to be fully embedded). The split by status of findings is depicted in the chart below.

Overdue findings have been classified by ratings assigned in the final audit report and split into sources below.

Refer to Appendix A in the ESG report for detailed disclosure.