Cyber Threat The No 1 Item On The Risk Registers Of Sa’s Leading Listed Companies

November 18, 2021

Given the growing number of cyber breach incidents reported in South Africa over the past 12 months, it’s no surprise that cyber breach concerns have overtaken regulatory risk as the number one concern for risk officers. This is a key finding in Aprio Credence’s latest annual review of JSE Top 40 companies’ published risk statements.

 

According to the review, which is based on research into the risk statements in the companies’ latest integrated reports, 86% of the JSE Top 40 enterprises say that cyber-attacks and data breaches are a top tier risk concern – while just more than half of the same companies list regulatory and compliance risk as one of their biggest risks going forward.

 

The research findings spanned 72 different categories of risk. There were five new entries into the Top 40 list for 2021, with close to 90% of the companies from the 2020 research project featuring in this year’s review by Aprio Credence.

 

COVID-19 related risks remain a prominent concern on companies’ risk registers for 2021 and beyond, featuring as a top tier risk for seven out of 10 enterprises in the review. Interestingly, only 21% of the JSE Top 40 companies listed the pandemic as a primary risk in their integrated reports published 12 months ago.

 

Based on the latest integrated reports, the five most prevalent concerns for C-suite executives around South Africa appear to be cyber risk, followed by pandemic-related impacts, the macro-economic environment, operating risks, and marketplace competition and disruption.

 

“It’s encouraging to see that reputation risk is increasingly being viewed by South Africa’s top companies as a standalone risk item alongside the usual suspects such as safety, liquidity, compliance and market risks, with 30% of the Top 40 companies now viewing reputation as a top-tier, separate risk item rather than a risk-of-risks or an outcome of other articulated risks,” says Alan Arguile, partner at Aprio Credence.

 

“Other notable findings include climate-related risk now featuring on the risk radars of more than half of the top companies, compared to a 26% prevalence 12 months ago. As a water-scarce country, access to water resources is also featuring more prominently in the risk reporting, with almost a quarter (22%) of the Top 40 companies now raising this as a concern,” says Arguile.

 

While safety remains a strong concern, particularly for mining companies, this year’s research revealed that identifying, recruiting, and retaining top people and skills, is a more prevalent concern compared to employee safety in terms of top tier articulated risks. 54% of the Top 40 presented human resource challenges as a top tier risk, while just under half the same companies listed safety as a primary risk going forward.

 

At the other end of the spectrum, just one of the sampled companies presented the impact of Brexit as a top tier risk; social media risk also featured on the top tier risk register of a single Top 40 company; and social unrest was raised by three top companies as a primary risk concern in their integrated reports, which were published a few months ahead of the unrest which devastated parts of South Africa in July.

 

To find out more about our 2021 research into Top 40 companies’ articulated risks and how you can practically mitigate the reputational impacts of these risks, please contact Esme Arendse on esme@aprio.co.za or Alan Arguile on alan@aprio.co.za