UnderstandingKey risks
The risk management environment
It is the board’s responsibility to undertake a comprehensive assessment of the key risks facing the group and to oversee the culture that permeates through the group to its staff. In determining the risk appetite and tolerance of the group, the board must establish a framework of effective controls, which enable risk to be assessed and managed. In this pursuit, the board is supported by the executive and risk committees.
The enterprise risk management process (“ERMP”) encompasses the review, identification, quantification, prioritisation, response to, and monitoring of, the key risks affecting the company and the consequences of these risks, in the development and enhancement of risk control measures. The ERMP is a dynamic process informed by risks that evolve or dissolve over time.
The responsibilities distributed in accordance with the ERMP are as follows:
Hotel businesses and
operations
Identify and communicate
- Understand key risks and observe the day-to-day operations of each hotel
- Report any events or eventualities which may have a bearing on the likelihood or impact of any key risks facing the company
Risk
committee
Review and evaluate
- Overseeing the development of a policy and plan for enterprise risk management in the form of an enterprise risk register and annually reviewing and recommending its approval to the board
- Summarise key risks, their causes, their potential impacts, and effective mitigating processes
- Ensure effective monitoring of risks
Board of
directors
Direct and assure
- Approve risk policy, including risk appetite and set attitudes towards risk within the company
- Review the efficacy of the ERMP by thoroughly reading the risk committee’s reports and asking comprehensive questions in respect of their content
- Determine strategic approach to risk and instruct Risk Committee accordingly
COMBINED ASSURANCE MODEL
The combined assurance model aims to augment the assurance coverage achieved regarding key risks affecting the company. The following levels of assurance, provided by various assurance providers are:
First level of defence:
Management
Activities and/or actions undertaken by management to obtain assurance that controls are effective and key risks are being adequately mitigated, including: strategy development and implementation; performance measurement; risk management; and monitoring of compliance to laws and regulations.
Second level of defence:
Corporate (specialist) functions and management committee oversight
Internal or external assurance providers who have been mandated by management to provide them with assurance that controls are effective and key risks are being adequately mitigated.
Third level of defence:
Independent assurance providers
Independent internal or external assurance providers, such as external financial, IT, and environmental auditing specialists, that have been mandated at board level to provide assurance that controls are effective and key risks are being adequately mitigated and escalated to the board through the risk committee.
Fourth level of defence:
Oversight structures
These structures consist of the board and the audit, social and ethics, and remuneration committees.
OUR RISKS AT A GLANCE
Exposure to negative aspects of the socioeconomic environment: economic stability,growth, interest rates, terrorism, inflation,political uncertainty and labour unrest in our chosen markets
Less business and leisure travel combined with over supply of rooms
Natural non-weather-related disasters, including earthquakes, pandemics (i.e. Covid-19) and acts of government, e.g. declaration of state of emergency or disaster
IT security/cyber security threats
Loss of market share
Failure to maintain current B-BBEE rating and achieve Employment Equity targets
Not optimising pricing strategy/yield management for the market conditions
Funding and liquidity constraints
Climate change
Exposure to negative aspects of the socio-economic environment: economic stability, growth, interest rates, terrorism, inflation, political uncertainty and labour unrest in our chosen markets
Root causes of the risk:
- Inappropriate government policies.
- Political power struggles.
- Credit rating changes, global credit crunch, currency fluctuations, and inflation.
- Government-mandated travel restrictions and border closures.
- Terror attacks.
- Xenophobic backlash.
- Increased labour demands.
- Bureaucracy.
- Protest action/riots/insurrection.
Potential impact of the risk:
- Reduced demand.
- Reduced profitability.
- Restriction on repatriation of funds.
- Changing environment impacts on investment assumptions.
- ROA ratio impact.
- Price-pressure and excessive discounting.
- Asset impairments.
Mitigating measures:
- Maintaining our price and value advantage.
- Reducing our risk of exposure through our geographic spread of portfolio and brand management.
- Ensuring that the group has comprehensive insurance cover in place (now excluding cover for pandemics).
- Sale of the East African operations concluded, and no further Africa expansion envisaged.
- Avoidance of high-conflict and high-risk territories.
- Agreements with third-party security providers in place.
- Implementation of BAR.
Key opportunities that may arise in responding to this risk:
The group’s current mitigation strategy in response to this risk over the last two years has proven to be effective. In considering future expansion and acquisition, the team overseeing the decision will consider the benefits enjoyed by CLHG as a result of the geographic distribution of the group’s hotels, and will continue to include this in the consideration criteria for preserving or creating value through strategically dispersed properties.
Less business and leisure travel combined with oversupply of rooms
Root causes of the risk:
- Remote and hybrid working models have resulted in increased reliance on technological platforms.
- Fewer airlines and flights due to, inter alia, business rescue of large airlines and suspension of air operator certificates.
- Cost cutting in many companies’ travel and conference budgets.
- High unemployment, high inflation, reduced disposable income, and decreased consumer and business confidence in South Africa.
- Concentration of our rooms in South Africa.
- Government enforced regulations and restrictions
Potential impact of the risk:
- Decline in occupancy rates resulting in reduced profitability.
- Increased discounting resulting in sub-inflation room rate increases.
- Declining profit margins.
Mitigating measures:
- Monitoring alternative technology developments and enhancing various IT platforms.
- Social media and online strategy in place.
- Increased focus on major corporate entities, government, leisure travel.
- Participation/listing on Online Travel Agency (“OTA”) platforms.
- World-class health and safety protocols independently audited and updated as necessary.
- Implementation of best available rate (BAR).
- Enhanced food & beverage offering across all four brands.
Key opportunities that may arise in responding to this risk:
Our position as one of the leading hotel groups in southern Africa enables us to leverage our reputation as a hotel group catering to every price point, while still maintaining high standards of service. Strategically, the group is constantly assessing the market and determining the BAR which optimises returns for each additional room sold.
Natural non-weather-related disasters, including earthquakes, pandemics (i.e. Covid-19) and acts of government.
Natural non-weather-related disasters, including earthquakes, pandemics (i.e. Covid-19) and acts of government.
Root causes of the risk:
- Increasing frequency and/or severity of unpredictable and unprecedented events.
- Local and international outbreaks and transmissions of viruses.
- Globalisation.
Potential impact of the risk:
- Hotel closures (temporary and permanent).
- Operating income loss and discounting.
- Liquidity constraints.
- Health and welfare of staff and in-house guests.
- Asset loss and/or damage.
- Safety and security of staff, guests, and assets.
Mitigating measures:
- Renegotiation of contracts.
- Independently auditing and updating our world-class health and safety protocols.
- Maintaining good relationships with stakeholders (banks, shareholders, and suppliers).
- Scenario planning by our Crisis Response Team (“CRT”), including monitoring risks, developing mitigating strategies and implementing them.
- Business continuity and Disaster Management plans in place and revised on an ongoing basis.
- Membership of industry bodies to liaise with government regarding industry concerns.
- Comprehensive insurance cover in place (now excluding cover for pandemics).
- Reducing our risk of exposure through our geographic spread of portfolio and brand management.
Key opportunities that may arise in responding to this risk:
Associated with this risk is our key strategic objective to develop a solution-oriented culture in our business practices and plans, and to orientate our staff to thinking pre-emptively about what the response ought to be should the risk come to pass. Our Crisis Response Team has demonstrable experience in proactively responding to material risks as they arise and to ensure that the group has the relevant resources and training to react appropriately at all levels of employment.
IT security/cyber security threats
Root causes of the risk:
- Ransomware attacks
- Electronic viruses, industrial sabotage attempts and social engineering.
- Opening of network to external parties for delivery of reservations.
- Absence of formal IT security policies in respect of various platforms and devices.
- Employee unawareness/ignorance/naivety.
Potential impact of the risk:
- Reputational risk.
- Disrupted services or loss of data and/or loss of data integrity.
- Theft of data.
- Cost associated with preventative measures.
- Cost of non-compliance with legislation (penalties or fines).
- Financial risk associated with cyber/ransomware attacks.
Current mitigating procedures in place:
- Using and regularly updating anti-virus software and patch management processes.
- Segmenting our network and core business systems with the application firewall.
- Introducing multi-factor authentication (“MFA”) for users accessing our network.
- Web and mail filters in place.
- Performing regular external and internal vulnerability scans (PEN-test).
- External assessment of our security posture.
- Cyber security internal audits are performed periodically.
- Mandatory regular security awareness training programme in place.
- Disaster Recovery Plan (“DRP”) in place and regularly tested.
- Total number of substantiated complaints received concerning breaches of customer privacy during the year ender review: NIL
Key opportunities that may arise in responding to this risk:
The strategy for constant monitoring, monthly security training and ongoing communication as to the importance of cyber security. The responsibility placed on each member of staff, fosters engagement and a sense of belonging within the organisation, which in turn boosts employee engagement and morale.
Loss of market share
Root causes of the risk:
- Increase in competitor products into the market.
- Brand erosion or weakness.
- Introduction of disruptor products into the market (AirBnB).
- Lack of product development and/or enhancement of existing products (such as refurbishments).
- Inadequate levels of service.
- Inadequate marketing and social media strategy.
- Competitor discounting.
Potential impact of the risk:
- Product becomes a commodity.
- No competitive edge.
- Reduced profitability.
- Business sustainability.
Current mitigating procedures in place:
- Social media and digital strategy in place.
- Constantly evolving and enhancing product offering.
- Extended food and beverage offering across all brands.
- Investing in the brand by maintaining spend on hotels.
- Loyalty programme to be significantly enhanced and relaunched.
- Participation/listing on OTA platforms.
Key opportunities that may arise in responding to this risk:
The enhanced food and beverage offering, in addition to the new BAR methodology, has made us more competitive across all markets, including the leisure market. In order to maintain our current market share and improve our share in the leisure market specifically we will prioritise increasing our existing technological offering to include differentiating digital amenities, including a revamped and improved loyalty programme, in order to remain relevant to our target market.
Failure to maintain current B-BBEE rating and achieve Employment Equity Targets
Root causes of the risk:
- High staff turnover (poaching of staff).
- Lack of sufficient skills in relevant categories.
- Failure by B-BBEE suppliers to maintain B-BBEE status in current economic times.
- Failure to identify new ESD opportunities.
- Unwind of BEE equity transaction.
Potential impact of the risk:
- Penalty could be imposed for non-compliance with legislation/regulations/code.
- Potential labour unrest.
- Loss of business.
- Reputational risk.
- Lower procurement score.
Current mitigating procedures in place:
- Remuneration, Transformation and Employment Equity committees actively monitor various aspects of B-BBEE and EE.
- Skills development programmes are in place.
- MANDASCO monitors retention, advancement of and recruitment of suitable candidates.
- Identified and included as a strategic imperative of the board.
- Graduate Internship Programme (“GIP”).
- Participation in the YES Programme.
- Use and encourage suppliers to improve own B-BBEE ratings through procurement selection process.
Key opportunities that may arise in responding to this risk:
The group initiated participation in the YES programme with the onboarding of 36 candidates, who are all embedded in operational teams and gaining valuable skills and experience. The programme is an opportunity to nurture new talent, develop future leaders and improve our B-BBEE rating.
Not optimising pricing strategy/yield management for the market conditions
Root causes of the risk:
- Seasonal demand of product.
- Absence of pricing strategy/policy.
- Economic crisis.
- Increased supply of hotel rooms.
- Ongoing discounting by competitors.
- Reduced consumer disposable income.
Potential impact of the risk:
- Lost revenue opportunities.
- Reduced profitability.
- Non-achievement of stakeholder expectations.
- Loss of market share.
Current mitigating procedures in place:
- Extended food and beverage offering across all brands.
- AI Business intelligence tool which aides forecasting and demand prediction based on internal and external factors.
- Yield management through the implementation of BAR.
Key opportunities that may arise in responding to this risk:
Further strategic implementation of AI business intelligence in other aspects of resource optimisation e.g. resource planning based on occupancy forecasts and inventory management based on food and beverage forecasts.
Funding and liquidity constraints
Root causes of the risk:
- Risk of breaching covenants.
- Inability to refinance or access further funding.
- Credit rating changes, global credit crunch, currency fluctuations, and inflation affecting credit requirements.
- Any shock event resulting in a decrease in operational activity, profitability and resultant debt capacity.
Potential impact of the risk:
- Restricts growth.
- Potential negative impact on dividend pay-out policy.
- Negative effect on share price.
- Inadequate working capital.
- Lack of funds for refurbishment and maintenance programmes.
Mitigating measures:
- Renegotiating key terms with banks in good time and maintaining a conservative term structure of debt maturities, including covenants and facilities.
- Restructuring capital and operating expenditure.
- Continually investigating alternative sources of capital.
- Potential asset sales.
- Maintaining cost awareness and prudent cost management.
- Working capital requirements supported by improved occupancies and cash generated from operations.
Key opportunities that may arise in responding to this risk:
The group’s financial performance during the year under review shows the efficacy of the group’s mitigating strategy in respect of this risk. There is an improved understanding of the group’s operations, governance and resilience by the group’s bankers, which has resulted in improved financial terms and covenants in the recent loan refinance agreements.
Climate change
Root causes of the risk:
- Carbon emissions.
- Pollution.
- Poor waste management.
- Extensive use of non-biodegradable materials.
- Excessive deforestation.
- Non-sustainable fishing/farming.
Potential impact of the risk:
- Global warming.
- Scarcity of resources.
- Natural disasters.
- Reduction in travel.
- Reputational risk.
- Sanctions and penalties.
- Supply-chain disruption.
Mitigating procedures:
- Sustainability committee in place.
- Solar panels installed at 25 hotels with further installations to follow.
- Single-use plastic minimisation strategy ongoing.
- Environmental awareness training.
- Water and energy savings initiatives.
- Waste management and recycling initiatives.
- Green building initiatives.
- Industrial action.
Key opportunities that may arise in responding to this risk:
The upcoming year will be a crucial one in our sustainability journey as additional sustainable solutions will be introduced into our operations and business practices.
