50 / 220
Technology and information governance
The Board is responsible for the
Group’s technology and information
governance risk and compliance. The
Board has delegated its responsibility
for the implementation of IT
governance to management, which in
turn, has adopted an IT governance
framework. The Information Security
Officer continues to drive a number
of operational and educational
programmes across the organisation
in order to ensure the framework is
effectively communicated and that all
Group companies are informed of the
framework and associated policies.
Management has implemented
controls to ensure that the policies are
effectively adopted and maintained
across the organisation.
IT controls have been tested to ensure
consistent and adequate risk
management has been applied. The
operation’s environment has been
tested to ascertain the process
requirements from both an
enhancement as well as a compliance
perspective.
On project and system changes,
processes are in operation to ensure
that focus is appropriately maintained.
Congruent with growth in business,
there has been a marked increase
in new requests for technology
enhancements. These processes
ensure that efforts are focused on
developments that will assist
customers to meet their objectives,
while maintaining acceptable
performance levels from the systems.
In order to gear the technology
function to support the growing
business environment, a number of
governance, risk and compliance
objectives were set and have been
met. The governance framework was
developed by initially identifying
generic technology risks and the
policies developed aligned to the
framework are in some cases more
Group specific, and these are being
refined and defined in more detail to
ensure a higher level of maturity.
The most significant key risk is the
threat from cyber security. A significant
effort is spent with internal audit,
external audit and specialist third
parties to ensure that we continually
update and test our systems to ensure
that we have taken every precaution
possible.
The ‘big data’ programme is regularly
reviewed with the compliance officer
to make sure that we are compliant
with POPI and other appropriate
legislation in the use of the Group’s
data.
Refer to the Group’s material risks on
pages 13 and 14 which includes
further detail on cybercrime risk and
mitigation and disaster recovery and
continuity of business.
BLUE LABEL
INTEGRATED ANNUAL REPORT 2017
/
48