Deloitte Risk Conference 2017 Creating and Sustaining Value Summary Report October 2017 Deloitte Risk Conference 2017: Creating and Sustaining Value – Summary Report

Deloitte Risk Conference 2017 Creating and sustaining value Summary Report October 2017 Deloitte Risk Conference 2017: Creating and sustaining value – Summary Report

Welcome and Introduction

Managing risk is about creating and South Africa’s “Strength of auditing sustaining value. Value can be created and reporting standards” slipped from but cannot be sustained if risk is not the first to the thirtieth position out of managed. Irrespective of how thorough 137 economies globally. Auditors and risk management is, black swan events their opinions ironically are not audited. are missed. The accounting profession’s The profession is built on integrity black swan has arrived. and trust. The public’s expectations of the profession have changed. The In South Africa’s current context, accounting profession can no longer business is perceived as being only comply with internal standards. exploitative, self-interested and Expectations are higher and therefore aiding in corruption. The majority of the profession’s standards need to businesses know that this is not a true increase too. To survive, the profession representation; business is a force will need to be introspective. for good and contributes positively to society. South Africa’s institutional strength has also been eroded in the last year. As These perceptions and alleged reported in the Global Competitiveness unethical behaviour tarnish the image Report, the strength of South Africa’s of the majority of good corporate institutions dropped from position 40 to citizens, which should make ethical position 76 in the last year. Although this leaders and businesses uncomfortable. is likely an overreaction based on recent To have a credible voice on important events, it requires a concerted response issues, businesses must be willing to from both government and business to “clean house”. restore trust in the country’s institutions.

The auditing profession specifically has been affected. This is shown in the recently released World Economic Forum’s Global Competitiveness Report.

Lwazi Bam Dr Martyn Davies Chief Executive, Managing Director, Emerging Deloitte Africa Markets & Africa, Deloitte Africa

2 Deloitte Risk Conference 2017: Creating and sustaining value – Summary Report

Keynote: How do we manage risk?

Good corporate governance should 5. Successful implementation is the be a firm’s first safeguard against both result of accountability. Stakeholders internal and external risks. Corporate need to be responsible for the governance is able to mitigate risk implementation of specific elements successfully if it works the way in which it of a risk mitigation strategy. was intended. Risk management needs to be To ensure good corporate governance, internalised to be effective. Within the the focus needs to be on financial framework, a number of variables can management decisions of a company. change depending on time, geography The failure of a system to address risks and circumstance. Companies need to is the result of internal processes. In develop the norms and standards to order to survive and mitigate risks, both react to sudden changes as part of their countries and companies need to focus risk mitigation strategy. on the long-term view. South Africa’s current environment Companies should make use of a five- and unpredictability has resulted in point framework to identify and mitigate uncertain long-term consequences and different types of risks: has made it very difficult for companies to make decisions. 1. Risk is a judgement of benefits and consequences. ”Short termism” A smart approach to risk will be to mesh which tries to determine which party the framework with current occurrences. will benefit from a decision now, Company Boards need to spend less rather than looking for the greater time reading onerous reports and more benefit in the long term, results in a time really understanding the company reduction of value. and the risks that it faces if they are to govern ethically and correctly. 2. The ability of a board to mitigate against risk is dependent on a degree of certainty. Board members need to be encouraged to read externally in order to understand and anticipate exogenous macroeconomic and political risks.

3. Communication is critically important to identifying and mitigating risks. Communication between the Board and other company employees as well as communication between the Trevor Manuel company and its clients builds trust. Chairman, Old Mutual

4. The implementation of any strategy is dependent on people and therefore, it can be disrupted by unequal power relations. To be effective, the implementation of risk mitigation strategies needs to be measured against predetermined parameters.

3 Deloitte Risk Conference 2017: Creating and sustaining value – Summary Report

Risk and volatility: The corporate perspective

In the last 100 years, the frequency declined in recent months. The Chicago The greatest uncertainties facing the of references to ‘risk’ and ‘volatility’ Board Options Exchange Volatility Index global economy today are posed by in English-language books has risen (VIX), sometimes referred to as the imbalances in the Chinese economy, sharply. The conclusion we draw is that “fear gauge”, is close to a 25-year low. the prospect of a more protectionist as societies become richer, they become Financial markets seem to be counting US, events in North Korea, Brexit less tolerant of risk and more willing on exceptionally low uncertainty and and the unpredictable effects of to pay insurance to hedge themselves good prospects. To some extent, this is monetary tightening. The last point against uncertainty. consistent with the global recovery that reflects a potentially risky set of events: is unfolding, but it also prompts concerns increasingly stretched asset values, In the 1990s, it seemed that the world that financial markets are becoming rampant risk appetite and the unwinding was entering an era of stable growth, excessively optimistic. of US quantitative easing. low inflation and reduced volatility. The financial crisis destroyed that The economic effect of external shocks, In conclusion, news flow and sentiment illusion, highlighting and accentuating such as natural disasters or terrorist change rapidly and feed through to vulnerabilities in the global economy. attacks, on rich economies is often business optimism. Yet the corporate Corporates have responded with an muted. This is as such events only rarely horizon, with its premium on strategic increased focus on mitigating external change macroeconomic fundamentals; thinking, is far longer than the news flow risk. to the extent these shocks have horizon. Businesses need to mitigate, economic effects they tend to displace manage and identify emerging risks. The Global Financial Crisis ushered activity in time, not permanently destroy But they need, too, not to overreact to in a “new normal” of slower growth it. Policymakers can use fiscal and every movement in markets and news. and greater volatility. Economics has monetary policy to “lean against” the Sometimes the right response is to ride become more important for businesses effects of external shocks. Paradoxically, out negative sentiment. Many risks are as an unpredictable environment and capital destruction in the case of natural transient and many fail to materialise. external risks create new challenges for disasters often leads to stimulus as Businesses need to resist short-term corporates. Macroeconomic, financial economies rebuild. pressures and aspire to the long view. and political risk are now business risks. The crisis gave new impetus to corporate There are important exceptions, ones risk management. Google searches where external shocks have a significant for the term “Chief Risk Officer” almost effect on economies. Deep financial tripled between 2007 and 2017. crises cause deep recessions. Systemic mismanagement by governments, as in Global growth is running at around Venezuela, has dire economic effects. three-quarters of the rates seen before And what is called ‘traumatic resets’, such the crisis. Slower growth has been as the Arab-Israeli War in 1973 which accompanied by bursts of volatility, sent the oil price soaring, change vital making risk more difficult to manage economic relationships which damage and mitigate. Corporates have become the economy. more cautious and risk averse. Deloitte’s Ian Stewart Chief Economist, Deloitte UK own work with CFOs shows that as The decline of institutions and systems perceptions of risk increase, risk appetite is a powerful sign of systemic failure. declines, investments, mergers, and International rankings, such as such as acquisitions fall and corporate cash the WEF Global Competitiveness Report, balances increase. World Bank Ease of Doing Business Report and the Heritage Foundation A year ago, there was a high focus on risk Index of Economic Freedom, provide a and uncertainty in news flow. Yet over way of thinking about the strength of the last year the mood has changed. institutions. Small countries tend to do References in the press to economic well in such rankings, and tend to be and financial uncertainty have fallen more resilient to shocks. sharply in the US, China and Europe. Almost all indices of financial risk have

4 Deloitte Risk Conference 2017: Creating and sustaining value – Summary Report

The global political economy: What are the implications for business?

In its 2017 Global Risk Report the World the population is becoming interracial, Economic Forum notes that years of intercultural and more socially building pressure fuelled by the 2008 integrated. This is setting the stage for Global Financial Crisis crystallised into what could be an incredible political shift. dramatic political results, especially witnessed during the course of 2016. The youth that are soon going to be of This resulted in a more challenging voting age and making future political business environment globally. decisions are likely to be less loyal in terms of race, tribalism, culture and Whether it is the inauguration of religion, and are likely to make decisions Trump’s administration in the US, Brexit in a completely different way from what Lesiba Mothata in Europe, preparations underway for South Africa’s current generation is Executive Chief Economist: Investment Team, China’s new leadership, or allegations used to. Alexander Forbes Investments of state capture and corruption in South Africa, uncertainty about trade From an investment perspective, Gina Schoeman Director, South Africa Economist, Citibank and investment policy is rising for many companies have grown tired both international and South African of South Africa’s political risk, and Nhlanhla Nene businesses. are looking offshore and into other Interim Head of School, Wits Business School countries on the continent. Accordingly, For South African businesses, the FDI to South Africa has fallen and mainly Ian Stewart Chief Economist, Deloitte UK biggest risk from the ongoing local portfolio rather than bricks and mortar political turmoil is a prolonged low investments make up investment flows growth environment, with growth to the country. This comes with expected to reach a mere 0.6% in various risks. 2017 and recover to just over 1% in the medium term. This falls short For example, as the Trump of increasing economic activity for administration looks to decrease industries such as retail or financial corporate taxes American multinational services. firms could consider repatriating their dividends due to South Africa’s rising However, the situation is unlikely to political risk profile and worsening credit worsen to the extent of, for example, rating. More so, due to South Africa’s an emerging market peer such as Brazil overreliance on portfolio flows, sudden where analysts expect the economy to capital outflows because of better continue shrinking, after contracting opportunities outside the country’s by 4% annually for the past two years. borders could result in serious negative Political uncertainty is anticipated to implications on its national accounts, start waning past the ANC’s December specifically the current account balance. elective conference and this could mark the end of a downward cycle for South Despite the level of political uncertainty Africa, though the economic recovery in South Africa, when compared to the thereafter will likely be slow. sentiments of investors about Brexit for instance and political turmoil in other Another risk to South Africa’s political emerging countries such as Brazil, South economy is the country’s changing African bond issuances, surprisingly demographics. About 40% of South so, are still oversubscribed by foreign Africa’s population is under the age of funds. This continued confidence from 20, and 75% is under the age of 40. As international investors highlights the youths seek employment opportunities, independence and strength of domestic net migration within South Africa is institutions such as the South African towards the major business hubs in Reserve Bank and points towards Gauteng. With more youths migrating brighter prospects for the economy. into urban hubs, a greater proportion of

5 Deloitte Risk Conference 2017: Creating and sustaining value – Summary Report

Securing your business against cyber risk: How big is the threat?

According to the 2017 World Economic In addition, firms can also more Forum Global Risk Report, cybercrime effectively mitigate cyber security risks ranked sixth among the top 10 risk by collaborating against cybercrime concerns for executives across the through community-based threat world. With the recent surge in major intelligence. cyber-attacks, organisations that fail to pay significantly more attention to Looking in more detail at the South cyber security do so at their own peril. African context, the Ponemon Institute’s 2017 Cost of Data The nature of cybercrime has changed Breach Study found South African drastically over the past decade with organisations as being the most Sean Duffy even nation states and multinationals vulnerable to cyber-attacks compared Executive: Security Solutions MEA, Dimension Data actively perpetrating attacks among to organisations in other countries. various organised cybercrime A major reason for this is poor Toby Shapshak networks. capacity. Though cyber security Columnist for Forbes and Financial Mail, Editor-in- Chief and Publisher of “Stuff” Magazine skills programmes in the country Besides the rise in orchestration are oversubscribed, there is still a Professor Sebastiaan von Solms of cybercrimes by well-resourced shortage of skills in the sector. As a Director of the Centre for Cyber Security, University organisations, the form of attacks is result, businesses lack the necessary of Johannesburg rapidly expanding with new major human capital to manage related risks. Graham Blain business threats presented through Head of Risk, Governance and Compliance for IoT (Internet of Things) innovations. Another element contributing to the Standard Bank Group IT As perpetrators such as nation states higher vulnerability of organisations are better resourced and have better in South Africa is poor enforcement technological capabilities, businesses of digital governance and compliance can barely keep up with cyber security policies. Organisations over-invest in innovations and defend themselves cyber security technology rather than against constantly evolving forms of people and processes. attacks. Beyond technological vulnerability, One of the most effective ways social engineering, which entails businesses can minimise cyber attacks such as phishing, is somewhat security risks is to cultivate a culture overlooked and organisations need to of vigilance about operating digitally. drive awareness about this at every Supporting this approach, a cyber- level of personnel to ensure their attack simulation conducted by the people are not key points of cyber Bank of England found that financial vulnerability campaigns in addition to services firms that were most vigilant technological security measures. about their cyber security prevented cyber-attacks much better than firms that were confident their digital networks were secure.

6 Deloitte Risk Conference 2017: Creating and sustaining value – Summary Report

Understanding the cost of regulatory compliance

Thomson Reuters tracks about 750 South Africa’s mining sector is another Comparing development and regulatory different regulators globally. Between example of how regulation can stifle models across the world, the approach them, these regulators produce a businesses. The country has lost out to likely to benefit South Africa the most regulatory update every seven minutes. the rest of the world in a sector in which is the one adopted by some of Asia’s This statistic marks how challenging it was a global leader for many decades. most thriving economies. It is not that complying with regulation and legislation Due to over-burdensome regulation, economies in the East do not have has become in the last few years. For many mining firms have downsized stringent regulations but rather they compliance officers, the main question is and some have even left the country to have well thought out regulatory systems how to keep up with a rapidly changing invest in countries providing a less costly in conjunction with strong human capital and increasingly demanding global operating environment. development. This has in turn enabled regulatory environment. them to take advantage of emerging Nonetheless, some of the regulation technological developments to an extent In South Africa, regulation is currently in the mining sector, especially health that their business environments now incredibly costly and can stifle business and safety regulations are a necessity. surpass many western economies. growth. For instance, according to Sectoral regulation is imperative but the World Bank, it takes up to 56 days as seen in the best practice approach to register a business in South Africa of health and safety regulations in the compared to less than 10 days in mining sector, regulation across different Rwanda. economic sectors needs to be risk based such that the more risky operations in a As many analysts point to insufficient given industry are, the more regulated regulation as the major cause for the that specific industry should be. 2008 Global Financial Crisis, regulation in the financial sector has become an Although regulation is burdensome increasingly serious issue since. In South for corporate South Africa, companies Africa’s context, increasing regulation must not view compliance as the Dr Azar Jammine has largely had a negative impact on the avoidance of penalties but rather Director and Chief Economist, Econometrix financial sector from a financial inclusion as an opportunity for proactive risk perspective. As policy makers seek to management. Regulation always has Ann Bernstein enhance financial inclusion, demanding unintended consequences, but from a Executive Director, Centre for Development and Enterprise (CDE) financial regulations such as KYC, this risk management point of view is critical has simply made it too costly for formal to mitigating various economic and Nic Swingler financial services firms to cater for the business risks. Head of Financial Crime, Barclays Africa underserved population. A balance must be struck between Anthony Smith Director: Deloitte Risk Advisory Africa On a global scale, analysts forecast that regulation, and industrialisation and banks would have paid over US$400bn development policy objectives to avoid in fines between now and 2020 due to red tape from preventing business failure to comply with a rapidly changing growth. A starting point for regulators regulatory environment. is to focus on developing well thought out growth-based and market-related Arguably, in South Africa attention has regulations. shifted away from business growth in order to regulate. As much as A case in point is South Africa’s labour regulation is important in ensuring law. Labour regulations in South Africa a stable business environment, over are based on a developed country model regulation – as clearly evidenced in while the country is still a developing South Africa – is costing countries country and as a result, this has hindered globally in terms of business and employment growth significantly. consequently employment growth.

7 Deloitte Risk Conference 2017: Creating and sustaining value – Summary Report

An insight and an idea: Who is SA’s next president?

The winner of the ANC’s national elective Dlamini-Zuma’s policy stance is centred The national election in 2019 will likely conference in December will likely on Radical Economic Transformation be a standoff between establishment become the country’s president in 2019. and the expropriation of land without and anti-establishment politics. Should Currently, the greatest question in the compensation. This also translates to Dlamini-Zuma become the leader of the South African political space is “Will ownership of the South African Reserve ANC, a coalition government after 2019 there be an ANC elective conference in Bank. Dlamini-Zuma’s policy stance is very likely and will result in horse- December?” If the faction supporting closely mirrors what President Zuma trading between parties. If Ramaphosa President Jacob Zuma thinks that there articulated in the State of the Nation or Mkhize win the ANC’s leadership is a possibility that they may lose, they Address in February. Her greatest conference, the outcomes of 2019 are will disrupt the proceedings, delay the drawback is the support shown to much more difficult to predict. appointment of a leadership team and her by the ANC Youth League and the finally install a compliant team of their Umkhonto we Sizwe Military Veterans own choosing. This tactic has been used Association as this associates her successfully in recent weeks in the Free campaign with the Zuma-Gupta faction. State and Eastern Cape and it nearly succeeded in the Northern Cape too. Mkhize has been running a low-level campaign. However, he has delivered KwaZulu-Natal (and possibly the more speeches than any other Eastern Cape) may not resolve their candidate has. Although his campaign leadership disputes in time for the ANC has been less forceful than Dlamini- conference in December and so may be Zuma and Ramaphosa’s, it has been very excluded. Should KwaZulu-Natal and thorough, astute and professional. His the Eastern Cape be excluded, Zuma’s policy stance is very closely aligned with Justice Malala faction will argue that the conference that of Ramaphosa. SA political commentator, presenter and author lacks credibility as two of the largest provinces are not represented and The next leader of the ANC will be therefore the conference cannot go determined by whom the branches ahead. Although Cyril Ramaphosa and send as delegates to the conference. Dr Zweli Mkhize’s supporters will push The assumption is that KwaZulu-Natal, for the conference to go ahead there is as the largest province according to approximately only a 60% probability of the number of delegates, will elect the the conference happening. leader. The province’s leadership is no longer partisan and support is split There are currently three contenders in between candidates. Massive corruption the ANC leadership race: Dr Nkosazana regarding branch delegates has been Dlamini-Zuma, Cyril Ramaphosa and uncovered in the province, with 4, 000 Dr Zweli Mkhize. Ramaphosa chose to fake delegates registered. keep quiet through numerous scandals involving President Zuma, allowing the Although Dlamini-Zuma’s campaign status quo to continue and alienating currently seems to be dead in the water, many that had goodwill and faith in his she may still win due to gatekeeping, leadership abilities. In 2017, Ramaphosa corruption, cash bribery and the forging finally found his voice and began to of memberships. If she wins, the status speak out against the corruption he quo will continue. The ANC as a party previously tacitly supported. In terms of may split and actors such as Ramaphosa, policy, he supports the implementation Makhosi Khoza and Pravin Gordhan may of the National Development Plan. form a new party, resulting in the legal ANC and a new party claiming to be the “true” ANC.

8 Deloitte Risk Conference 2017: Creating and sustaining value – Summary Report

Summary and close

Companies need to aspire to the Although mitigation of risks is costly, it long-term view. The importance of risk provides companies with the opportunity management is now being built into to understand both their business and company strategies as lower growth clients better. and higher volatility further compound existing risks.

Financial volatility is at a 25-year low and this creates numerous opportunities and greenshoots for businesses in South Africa. To take advantage of this, companies need to build independent oversight with assurance of risk and an understanding of risk mitigation. Companies must be able to both manage risk and extract the benefits represented by it. Corporate culture needs to be Navin Sing driven by good governance if it is to Managing Director: Deloitte Risk Advisory Africa restore trust in the current environment.

In terms of cyber risk, it is no exaggeration to state that corporate South Africa is at war. We do not know who the enemy is nor where they will strike, but we know the consequences will be dire. Guardrails need to be embedded into the DNA of businesses to prevent cyber-attacks. This requires real-time monitoring of threats and the ability to respond swiftly to mitigate risks. A cyber threat provides companies with the platform to create a better risk management structure and the opportunity to reap the regulation benefit.

9 Deloitte Risk Conference 2017: Creating and sustaining value – Summary Report

Contacts

Dr Martyn Davies Managing Director, Emerging Markets & Africa [email protected] +27 (0)11 209 8290

Navin Sing Managing Director: Risk Advisory Africa [email protected] +27 (0)11 806 5040

Pramesh Bhana Chief Operating Officer: Risk Advisory Africa Africa Leader: Risk Advisory – Clients, Industries & Markets [email protected] +27 (0)11 209 6337

Anthony Smith Director: Risk Advisory Africa [email protected] +27 (0)11 209 8445

Derek Schraader Director: Risk Advisory Africa [email protected] +27 (0)21 427 5659

Hannah Edinger Associate Director: Deloitte Africa [email protected] +27 (0)11 304 5463

10 Deloitte refers to one or more of Deloitte Touche Tohmatsu Limited, a UK private company limited by guarantee (“DTTL”), its network of member firms, and their related entities. DTTL and each of its member firms are legally separate and independent entities. DTTL (also referred to as “Deloitte Global”) does not provide services to clients. Please see www.deloitte.com/about to learn more about our global network of member firms.

Deloitte provides audit, consulting, financial advisory, risk advisory, tax and related services to public and private clients spanning multiple industries. Deloitte serves four out of five Fortune Global 500® companies through a globally connected network of member firms in more than 150 countries and territories bringing world-class capabilities, insights, and high-quality service to address clients’ most complex business challenges. To learn more about how Deloitte’s approximately 245 000 professionals make an impact that matters, please connect with us on Facebook, LinkedIn, or Twitter.

This communication contains general information only, and none of Deloitte Touche Tohmatsu Limited, its member firms, or their related entities (collectively, the “Deloitte network”) is, by means of this communication, rendering professional advice or services. Before making any decision or taking any action that may affect your finances or your business, you should consult a qualified professional adviser. No entity in the Deloitte network shall be responsible for any loss whatsoever sustained by any person who relies on this communication.