internal accountability
internal control
The board is accountable for the group’s system of internal control and has delegated this responsibility to management.
The system of internal control is designed to ensure that the significant risks are being appropriately managed and provide reasonable assurance that:
- business objectives will be achieved in normal and adverse trading conditions;
- operations are efficient and effective;
- management and financial information is reliable;
- there is compliance with applicable laws and regulations.
Management is focused on continuous improvements to the system of internal control, and has implemented a new financial system to further enhance and improve end-to-end financial controls and processes within the group.
independent assurance providers
A key element of the system of internal control is the reviews of independent assurance providers who assess the adequacy and effectiveness of the controls.
internal audit
Internal audit applies a risk-based approach that provides independent assurance on the adequacy and effectiveness of the system of internal controls in place to manage the significant risks down to an acceptable level. It also engages proactively with management to drive meaningful and sustainable improvements in the control environment. This is achieved by using specialist risk and control knowledge to provide practical recommendations to improve the design of and compliance with key controls. Where necessary, for example highly specialised IT reviews, these reviews are outsourced to specialist consultants.
The internal audit coverage plan is reviewed and approved by the audit committee in May each year, and is revised quarterly to ensure that it remains relevant to the key business priorities and changing risk environment. Key audit findings are reported to the audit committee quarterly in the red flag report. Progress in addressing these red flag items is audited quarterly and items are reported to the committee until they have been resolved satisfactorily. This enables the committee to ensure that prompt action has been taken to address the key areas of concern.
external audit
Ernst & Young Inc and SAB&T Inc, the joint external auditors, provide stakeholders with an independent opinion on whether the annual financial statements fairly present, in all material respects, the financial position of the company and the group. External audit regularly liaises with internal audit to understand the scope of their work and the results of their audits. It should be noted that any control work performed by external audit is limited to the work necessary to support their audit opinion.
external auditor independence policy
External audit is a key component of the independent assurance framework and therefore the audit committee needs to ensure that external audit is independent and objective. To govern this, the board has adopted an external auditor independence policy which defines the prohibited and allowable non-audit services which the external auditors can perform and restricts the value of allowable non-audit services to 20% of the annual external audit fee. This policy complies with the minimum requirements as set out in the Corporate Laws Amendment Act (No. 24 of 2006), the Auditing Profession Act (No. 26 of 2005) and the requirements of the Code of Professional Conduct of the Independent Regulatory Board for Auditors, and in a number of cases is more restrictive.
other independence assurance
Specialist assurance providers have been used to assess the adequacy and effectiveness of controls in certain instances. These include audits on product health, safety and hygiene at our stores and suppliers. The output of the risk management process, in conjunction with the work of the independent assurance providers, indicates to the directors that the controls in place are adequate and effective. This opinion recognises that the business is dynamic and that at any point in time there are new areas of risk exposure which may require management attention. As such, there is a continual focus on ensuring that the control environment within each business area is understood and maintained at the required level.
