Unit: Subject: Sarbanes-Oxley Act Review - Fixed Cycle Title: Risk and Control Identification Year end:

E E Y C V R I N O T K E SUGGESTED CONTROLS TO MITIGATE THE POTENTIAL MANAGEMENT CONTROL or COMMENTS (if Risk is CONTROL OWNER G C S R OBJECTIVE I POTENTIAL RISK E E E

R RISK (Internal ) excluded from the Scope) (Name) J T F B A E O C R

Acquisition of Fixed Assets Recorded fixed acquisitions represent fixed assets O,F FAS Recorded acquisitions do not represent fixed Written capitalisation- policies: Guidelines for acquired by the organisation (validity). Fixed assets represent 101 assets acquired by the organisation. Expense items may be capitalising versus expensing acquisitions should be assets to which the entity has legal rights. Only valid items incorrectly capitalised. established. Periodic review by management of assets are capitalised. captured to assets recorded on the fixed assets register. Physical asset verification to asset register. Authorisation of Capex forms in terms of the Limits of Authority including a review of the cost centre, cost element, Capex number, asset value and description of the item. All fixed asset acquisitions are recorded. (completeness) O,F FAS Not all fixed asset acquisitions are recorded. Periodic independent inspection of fixed assets are 102 conducted. The results are agreed to fixed asset records and differences timeously investigated, explained and resolved.

Acquisitions of fixed assets are not incorrectly expensed. O,F FAS Acquisitions may be incorrectly expensed. The Adequate policies are in place to ensure the clear distinction 103 understatement of purchases of capital goods will lead to the between items to be capitalised as fixed assets and items understatement of liabilities and assets. Overstatement of (below certain amounts) to be expensed. Periodic reviews of income is also likely as a result of failing to depreciate the the repairs and maintenance account are conducted for any asset which has not been recorded. significant items which should have been capitalised.

Fixed asset acquisitions are accurately recorded. (accuracy) O,F FAS Fixed asset acquisitions are not accurately recorded: Fixed Detailed fixed asset records are maintained and updated 104 asset accounts may be misstated, amounts may directly from source purchase documentation (e.g. supplier be incorrect as a result of this. Incorrectly recorded assets invoice, contract etc). Review by management of source may also be difficult to identify physically at a later stage. documentation to loaded data in order to verify the accuracy of the data captured. Fixed asset acquisitions are allocated correctly. (classification) O,F FAS Fixed assets recorded in the wrong asset or expense Each asset record is allocated to a specific asset class in 105 accounts. Misclassification of fixed assets to conceal SAP. Master data for an asset class is defined once at the unauthorised purchases (possibly for the benefit of employees client level. Asset classes determine the depreciation method or third parties). utilised. Asset recordings are scrutinised for correctness. Authorisation of Capex forms in terms of the Limits of Authority including a review of the cost centre, cost element, Capex number, asset value and description of the item.

Fixed asset acquisitions are recorded in the appropriate O,F FAS Fixed asset acquisitions are not recorded in the appropriate Fixed assets purchases are recorded at the date of receipt period. (proper period) 106 period. Asset register is not updated promptly. (per GRN). The manual gives detailed instructions for recording fixed assets on the date of acquisition. Asset- related transactions before and after the end of an are scrutinised and/or reconciled to ensure complete and consistent recording in the appropriate accounting period.

S-OX Fixed Assets risks and controls 12/15/2005 Page 1 of 10

E E Y C V R I N O T K E SUGGESTED CONTROLS TO MITIGATE THE POTENTIAL MANAGEMENT CONTROL or COMMENTS (if Risk is CONTROL OWNER G C S R OBJECTIVE I POTENTIAL RISK E E E

R RISK () excluded from the Scope) (Name) J T F B A E C O R

Employees and management are provided with the information O,F FAS No formalised are communicated to cost centre Asset acquisition and related financing agreements are they need to control the capital expenditure process. Cost 107 holders which could result in overruns. Non-budgeted reviewed by management (including consideration of the overruns and non-budgeted costs are controlled. costs might not be formally approved through a Capex. capital expenditure budget), before being authorised. When actual expenditures exceed authorised amounts, the excess is appropriately approved. Asset acquisitions are authorised in accordance with Board's O,F FAS Asset acquisitions should be made in accordance with Capital expenditure and leasing proposals are prepared for criteria. (authorisation) The number of employees authorised 108 Company approval limits and the Capex policy. review and approval by responsible officers. Review and to approve capital asset purchases are limited. approval of all capital expenditure requests takes place by a senior independent person/s: Fixed asset requests for purchases are approved in accordance with the Limits of Authority. (e.g. Board approval is obtained for significant capital asset projects and acquisitions above a certain amount.) Authorisation of Capex forms includes a review of the cost centre, cost element, Capex number, asset value and description of the item. The number of employees authorised to approve capital asset purchases is limited. Designated individuals who may initiate capital asset transactions and the limits of their authority are clearly defined. Written approval is required for all capital asset projects and acquisitions. Capital budgets are compared to actual expenditures on a monthly basis and significant differences analysed, investigated and reported. Most capital expenditure is anticipated in advance, comparing budget to actual amounts can help detect misuse of funds.

Asset acquisitions are adequate and appropriate to serve the O,F FAS Asset acquisitions may not be suitable to fulfil the purposes for All acquisitions are made after a thorough viability study has purposes for which they are acquired. 109 which they have been acquired e.g. plant capacity may be been handed in as motivation for the acquisition. These inadequate. Unsuitable or unauthorised assets may be documents are attached to the Capex, reviewed, authorised acquired. Unnecessary property, plant or equipment is and kept on file. Clearly documented policy statements has acquired resulting in unused or idle capacity. been developed setting forth asset acquisition criteria for the review and approval of proposed capital expenditure. Management consults with other Mills to obtain unused assets prior to assets. No payments for acquisitions of assets are effected without correct approval. (See Expenditure Cycle). All acquisitions are made after a thorough viability study has been handed in as motivation for the acquisition. These documents are attached to the Capex, reviewed, authorised and kept on file.

The cost of asset acquisitions meets the company's criteria for O FAS The cost of the acquired assets may not meet the company's Documented policy statements have been developed setting meeting the investment. 110 criteria for meeting the investment. forth assets acquisition criteria such as review and approval of proposed capital expenditure, acceptable inventory and service levels, economic analysis and justification. Capital Expenditure Requests exceeding a predetermined limit are supported by a cost-benefit exercise.

Tax allowances are correctly applied. O FAS Taxation allowances may not be correctly applied. Not all valid Company Tax Department review and approval of useful life 111 tax allowances may be claimed. Investment decisions may be and depreciation or amortisation method for each property made based on incorrect financial information (i.e. not taking addition over a stated amount. The useful lives established allowances into account). for tax purposes for various classes of properties and equipment must fall within guidelines published by the relevant tax authorities.

S-OX Fixed Assets risks and controls 12/15/2005 Page 2 of 10

E E Y C V R I N O T K E SUGGESTED CONTROLS TO MITIGATE THE POTENTIAL MANAGEMENT CONTROL or COMMENTS (if Risk is CONTROL OWNER G C S R OBJECTIVE I POTENTIAL RISK E E E

R RISK (Internal Audit) excluded from the Scope) (Name) J T F B A E C O R

Appropriate supporting documentation is retained for fixed O,F,C FAS Acquisition documentation may be lost or otherwise not Capex forms are pre-numbered, authorised and reviewed. Any assets. 112 communicated to appropriate personnel. missing documents are investigated and resolved. Route copy of purchase orders for capital expenditure to personnel who process fixed assets. Reconcile fixed asset additions with capital expenditure authorisation.

Company assets can be adequately identified for inventory O FAS Acquired assets may not be adequately described. Assets are All assets should be tagged. It should be possible from purposes. Asset tags are used to control and monitor 113 not identifiable. Assets are not tagged correctly. Asset reference to the tag to determine the asset serial number, inventory. location may be misstated. location, description of the asset and its name. Pre- determined group assets identification techniques have been documented and adhered too.

Depreciating Fixed Assets Depreciation charges are valid. (validity) O,F FAS Depreciation charges are invalid. Depreciation charges are dictated by the fixed asset 201 accounting policy. Only the fixed asset has access rights to change the depreciation period. Fixed asset accountant assesses whether the asset classification is appropriate. Depreciation exception items (in terms of expectations established by management) are consistently identified, monitored, and corrected. Depreciation and amortisation charges are computed and O,F FAS Depreciation charges are not correctly calculated and Standard programmed algorithms perform depreciation recorded accurately (accuracy). 202 recorded. Assets and other deferred cost accounts may be calculations in SAP. Depreciation and other calculations charged with incorrect amounts. Overheads rates used to performed by the SAP system are regularly reviewed for value fixed assets may be incorrect due to incorrect accuracy. Depreciation exception items (in terms of assumptions with respect to allocations and classification of expectations established by management) are consistently fixed costs. If depreciation is misstated, asset book values identified, monitored, and corrected. Prior to asset disposition may not be fairly stated. Sales prices for assets may be all transactions should be reviewed, verified and approved by established based upon incorrect data. Investment decisions management. may be made based on incorrect financial information.

Depreciation charges are correctly allocated (classification). O,F FAS Misclassification of depreciation may affect depreciation and Fixed asset accountant assesses whether the asset 203 taxation amounts. classification is appropriate. Computation, reporting, and classification guidelines for asset related transactions have been documented. Reconciliation of depreciation run and FI- AM is performed monthly. All depreciation charges are recorded in the appropriate F FAS Not all depreciation charges are recorded in the appropriate Depreciation charges are reviewed by management including period. (completeness and proper period) 204 period. consideration of recording in the appropriate accounting period. The depreciation method and useful life used for depreciating O,F FAS The anticipated useful life of an asset may be incorrectly set, Specific individuals have been designated to consider individual or classes of assets are established in compliance 205 establishing an unreasonable period during which cost is changes in methods of depreciation or life cycle of the asset in with company and policies and with GAAP (locally and amortised or depreciated. The wrong method may be used to general. Assigned responsibility exists for periodic internationally). (validity) depreciate an asset. i.e. RBB vs SL, RBB vs Sum-of-the- independent review of the reasonableness of useful lives Digits, etc. assigned to fixed assets and the methods of depreciation. Defined economic life cycles and methods of depreciation for various classes of assets for financial reporting purposes exist. Established policies regarding depreciation methods and asset life cycles exist, are communicate to appropriate personnel, and periodically review to ensure continued appropriateness. Depreciation detail is reviewed for accuracy and compliance with policies and procedures. Company Tax Department review and approval of life and depreciation or amortisation method for each property addition over a stated amount.

S-OX Fixed Assets risks and controls 12/15/2005 Page 3 of 10

E E Y C V R I N O T K E SUGGESTED CONTROLS TO MITIGATE THE POTENTIAL MANAGEMENT CONTROL or COMMENTS (if Risk is CONTROL OWNER G C S R OBJECTIVE I POTENTIAL RISK E E E

R RISK (Internal Audit) excluded from the Scope) (Name) J T F B A E C O R

Adjustments to fixed assets processed are correctly calculated O,F,C FAS Adjustments processed are calculated or recorded Supervisory review, verification and approval of adjusting and recorded (accuracy) 206 inaccurately entries are conducted. Adjustments to fixed assets are valid. (validity). O,F FAS Invalid adjustments are processed. Adjustments may be Management reviews reconciled adjustments made to identify 207 recorded to conceal fixed asset inventory differences. any unauthorised changes.

Adjustments to fixed assets are properly authorised in O,F FAS Adjustments are not authorised. Adjustments are authorised in accordance with the Limits of accordance with company policy. (authorisation) 208 Authority and reviewed for authorisation.

Adjustments to fixed assets are processed promptly (proper O FAS Adjustments are not processed in the appropriate period. Asset-related transactions, before and after the end of an period). 209 accounting period are scrutinised and/or reconciled to ensure complete and consistent recording in the appropriate accounting period. Cut-off and closing procedures and schedules are developed and followed.

Disposal and Transfer of Fixed Assets Recorded fixed asset disposals are valid. (validity) O,F FAS Recorded fixed asset disposals do not represent actual Clear criteria, in writing, exist for the identification and 301 disposals. disposal/transfer of damaged, obsolete, or unneeded fixed assets. Management review of additions and disposals are performed by DHO. Pre-numbered disposal documentation is completed, authorised, processed and kept on file.

All fixed asset disposals are recorded. (completeness) O,F FAS Fixed asset disposals and scrapping of old and obsolete Periodic independent checks from fixed asset records are 302 assets not recorded. Equipment is disassembled and used for conducted to ensure that the assets physically exist, especially spare-parts and parts used do not conform to quality those that could be disposed of without a noticeable effect on standards set out by the company. operations. Written approval on a pre-numbered standard form is obtained and authorised by management.

Disposal and transfer of assets and their related adjustments O,F FAS Fixed asset disposals are not accurately calculated and The asset accountant reviews the authorised disposal form are accurately recorded in the relevant asset accounts and 303 recorded (including incorrect value when disposing of the and checks calculations and processing. Fixed Asset Registers. (accuracy) asset) Fixed asset disposals are promptly recorded (proper period). FAS Fixed asset disposals are not recorded in the appropriate Periodic controlling/accounting review of the fixed asset 304 period. Asset Register is not updated timeously. register (in conjunction with cost centre heads) (inter alia) to identify assets that have been disposed/scrapped. Asset- related transactions before and after the end of an accounting period are scrutinised and/or reconciled to ensure complete and consistent recording in the appropriate accounting period. Periodic review and verification of disposal and transfers are made by independent supervisory personnel.

The transfer and disposal of assets are appropriately O FAS Assets disposals are not made in terms of the company policy. A formal policy is in place for authorising and reporting on fixed approved by management. (authorisation) 305 Assets may be sold, transferred or retired without asset disposals, sale and lease-backs. All recorded disposals management's knowledge. Asset disposals or transfers may of fixed assets are approved by management. No property is not be communicated to appropriate personnel. Assets may allowed to leave the premises without the written approval of a be disposed of at inappropriate prices. specified executive on a pre-numbered standard disposal form. A physical check takes place of all fixed assets leaving the premises to the aforementioned document. Pre-numbered fixed asset disposal and transfer authorisation forms are reviewed and missing documents investigated. Comparison of critical details of each requested sale or other disposals with established criteria. Review of significant contracts (e.g. contracts for sales of land) by legal counsel. All assets being disposed of are compared to market related items and depreciated value checked.

S-OX Fixed Assets risks and controls 12/15/2005 Page 4 of 10

E E Y C V R I N O T K E SUGGESTED CONTROLS TO MITIGATE THE POTENTIAL MANAGEMENT CONTROL or COMMENTS (if Risk is CONTROL OWNER G C S R OBJECTIVE I POTENTIAL RISK E E E

R RISK (Internal Audit) excluded from the Scope) (Name) J T F B A E C O R

Disposals of fixed assets to other group companies are FAS Asset transfers within the group may not be appropriately Transfer of assets valued over R1 million to affiliate appropriately controlled. 306 controlled. companies are approved by the Board. Transfers of assets within the company, are done at Net ("NBV") and transportation costs and costs to set-up are only capitalised to the extent of the useful life of the asset being transferred.

Disposal of fixed assets is permitted only in accordance with O FAS Assets may be lost, stolen or converted to private use. The responsibilities for authorising the removal of assets, company policy. 307 contracting for salvage, and subsequent receipt of payment should be segregated. Periodic review and verification of disposal and transfers should be made by independent supervisory personnel. Physical asset verification takes place periodically. Assets are not disposed of that could be used in other O FAS Assets may be disposed of that could be used in other Sales do not take place without consultation with the other company / group operations. 308 company / group operations. Mills to ensure maximisation of group assets. Disposal of physical assets is permitted only in accordance O,F FAS Assets may be sold to a party that will use them in a manner Clearly written statements of criteria e.g. Property may not be with company policy: e.g. assets are not sold to a party that 309 detrimental to the company. sold to competitors. will use them in a manner detrimental to the company.

All asset disposals comply with appropriate government O,F,C FAS Transfer or sale of assets may not be made in accordance All statutory requirements such as tax legislation and the regulations. 310 with regulatory requirements resulting in fines and penalties. Companies Act are complied with. Procedures for disposal of salvage or surplus property, including segregation and special handling of dangerous/hazardous equipment and controls to ensure salvage and surplus do not utilise costly storage space. Procedures for legal department review and approval of contracts prior to execution.

Profits or losses on the disposal of assets should be O,F,C FAS Assets and related accounts may be charged or credited with In SAP, standard programmed algorithms perform the accurately and promptly classified and reported. (accuracy and 311 incorrect amounts. Accounting classifications may be calculation of the or loss upon disposal of an asset. The classification) incorrect. profit or loss upon disposal of an asset is independently recalculated. Correct accounting for Capital Gains Tax on disposals of O,F,C FAS Incorrect accounting for Capital Gains Tax on disposals of Gains and losses from the disposition of assets are computed assets. 312 assets. in accordance with GAAP and the Tax act.

Management of Fixed Assets

Fixed Asset Maintenance Records Fixed asset maintenance records are updated timeously. O FAS If maintenance activities are not recorded timely, duplicate Asset maintenance schedules are prepared, updated, and (proper period) 401 maintenance activities may be performed; this, in turn, might monitored by management, and activity per the asset adversely affect the resources available for maintenance maintenance schedule is reconciled to the asset maintenance projects. history register regularly. Records of fixed asset maintenance activity are accurately O FAS An inaccurate or incomplete asset maintenance history Maintenance activity is recorded on pre-numbered maintained. (accuracy) 402 register may result in inappropriate decisions about repair sheets/work orders; numerical sequence of such forms is versus replacement of fixed assets. accounted for. Asset maintenance activities are edited and validated upon data entry; exceptions are investigated and resolved. Changes to the asset maintenance history register are compared to source documents to ensure that they were input accurately. Management periodically reviews asset maintenance activities, per the asset maintenance history register, to ensure compliance with management's objectives.

Safeguarding of Fixed Assets

S-OX Fixed Assets risks and controls 12/15/2005 Page 5 of 10