Technology and information governance
The Board is responsible for the Group's technology and information governance risk and compliance. The Board has delegated its responsibility for the implementation of IT governance to management, which in turn, has adopted an IT governance framework. The Information Security Officer continues to drive a number of operational and educational programmes across the organisation in order to ensure the framework is effectively communicated and that all Group companies are informed of the framework and associated policies. Management has implemented controls to ensure that the policies are effectively adopted and maintained across the organisation.
IT controls have been tested to ensure consistent and adequate risk management has been applied. The operation's environment has been tested to ascertain the process requirements from both an enhancement as well as a compliance perspective.
On project and system changes, processes are in operation to ensure that focus is appropriately maintained. Congruent with growth in business, there has been a marked increase in new requests for technology enhancements. These processes ensure that efforts are focused on developments that will assist customers to meet their objectives, while maintaining acceptable performance levels from the systems.
In order to gear the technology function to support the growing business environment, a number of governance, risk and compliance objectives were set and have been met. The governance framework was developed by initially identifying generic technology risks and the policies developed aligned to the framework are in some cases more Group specific, and these are being refined and defined in more detail to ensure a higher level of maturity.
The most significant key risk is the threat from cyber security. A significant effort is spent with internal audit, external audit and specialist third parties to ensure that we continually update and test our systems to ensure that we have taken every precaution possible.
The 'big data' programme is regularly reviewed with the compliance officer to make sure that we are compliant with POPI and other appropriate legislation in the use of the Group's data.
Refer to the Group's material risks which includes further detail on cybercrime risk and mitigation and disaster recovery and continuity of business.