Cyber threats remain at the top of risk registers

July 30, 2024

Esme Arendse, CEO at Aprio Credence

In the face of a fresh wave of reported SA and global cyber breaches, Aprio Credence research confirms cyber threats remain at the top of risk registers for SA’s leading companies.

Cyber risk continues to be the most prevalent perceived threat for JSE Top 40 companies, with four of out five of South Africa’s biggest listed companies listing cyber security as one of their principal or material risks.

This finding from Aprio Credence’s fifth annual research study into the published risk registers of JSE Top 40 companies comes on the back of Cisco’s 2024 Cybersecurity Readiness Index, which found that South African companies are dangerously unprepared for cyber-attacks, with just 5% of companies ranked at the ‘mature’ level of readiness which is needed to be resilient against modern cybersecurity.

Climate risk continues to be a concern for just over half of the JSE Top 40 companies, based on a review of their 2023 integrated reports, with regulatory risk and the ability to attract and retain the right skills perceived as more prevalent threats than climate or ESG issues. A staggering 63% of the companies list regulatory and people concerns as principal risks, compared with 55% for climate and 22% for ESG issues.

Two of the “big movers” in this year’s research were the risks associated with technology disruption and implementation, and successful project execution. More than half of the reviewed enterprises identify successful project execution as a concern – compared to 40% for the previous reporting period – while technology threats and disruption as a principal risk doubled in its prevalence, with 40% of SA’s leading companies listing this as a concern.

Of interest, only one South African company explicitly listed Artificial Intelligence as a material risk in last year’s research, and this didn’t change at all in our 2024 review – despite the World Economic Forum highlighting manipulated and falsified information (linked to the abuse of AI) as “the most severe short-term risk the world faces” in its Global Risks Report 2024. One JSE-listed mining company, it would seem, is aligned with this concern, listing the threat of false and fake information as a principal risk in its 2023 integrated report.

One in three of the 40 companies reviewed continue to express serious concerns around electricity supply issues – virtually unchanged from the preceding year – but perhaps surprisingly, water supply concerns were slightly down from the previous year: 15% of the JSE Top 40 companies listing this issue as a principal or material risk compared to 20% in the previous year.

Given Aprio Credence’s focus on reputation management and crisis leadership, we are pleased to see that reputational risk appears is firmly back on the radar for progressive South African corporates, with 30% of the top companies listing reputation or brand risk as a material concern – its highest rating across the past five years of the research study.

For more comprehensive insights into the top 20 risks on South Africa’s leading company risk registers – from supply chain and currency risks to regulatory and liquidity concerns – and how Aprio Credence can help build reputational resilience for your enterprise in the face of such threats, please contact Esme Arendse, CEO at Aprio Credence on esme@aprio.co.za or call her on 082 694 7643.