1 INVESTOR MANAGEMENT DAY RISK 2

1 INVESTOR MANAGEMENT DAY ‒ RISK

2 Risk Department Structure Risk Manual and Management Methodology Construction Risk Management Challenges facing the industry

Risk Department Structure Group Five Limited Board Chair of Risk Committee Chair of Audit Committee CEO Project Risk Committee G. R. O. EXCO Head Office SHEC Quality Head Office Legal Commercial Risk Manager Statutory Head Office Compliance Internal Audit Country Business Units Sites Sites

The Group Five Risk Manual Risk Management Policy Philosophy Framework Risk Department structure Risk Committee Responsibility matrix The system – “STAR” Strategic Risk The Top. Operational Risk in construction today 10 risk exposures Project Risk (Best Practice) SHEQ Country Risk Financial Risk Legal Risk Information Technology Insurance Internal Audit 4

Risk Management Methodology Risks are identified on all three levels: - Strategic: Bi-annually, - Operational: Quarterly - Project: Monthly (CLC) - Management meetings --Group Risk meetings Monthly site Officer reports to the Risk Committee Culture - Policies & System Procedures based on industry best practice - Risk culture awareness campaigns - RM Surveys - Risk based Internal Audits - Output from STARS is the input into IA audit program - Output of IA is input into STARS - Independent assurance that risks & opportunities are being identified and - Online system reports, RM dashboards, RM reports Risk Committee reports - Assign responsibility, action to be taken & target p rou G dates on action Strategic plans. - Real time U B notifications & Operational Culture reminders, System - RM dashboards, ite reports & S Project statistics - Questionnaire based on world wide organizational failures and lessons learnt, - Purpose is to trigger your thoughts i. t. o risk scenarios - Risk and Opportunity - Contract Life Cycle Management system, - Database of all Risks & Opportunities in the form of risk registers, - Action plans

Construction Risk Management ‒ model Compliance HR Legal & Commercial SHEQ STARS One System VALUE Contract Life Cycle PROF IT CORPORAT Internal Audit E GOVERNAN LOSSE CE S IT Country Risk Business Development Finance 6

Construction Risk Management ‒ STARS System 7 A risk and opportunity management system, ensuring consistent behaviour and real-time monitoring of risks and opportunities to enable improved decision-making

8 Construction Risk Management ‒ The risk life cycle within the contract life cycle Group Business Risk Register Manual Filter & Upload Consolidated Group Project Risk Register Design Rules: • Nor more than 15 1. 2. 3. 4. 5. questions per audit Business Development (clearing house) Pre-tender risk assessment Tender handover & Pre-contract Planning 6 Monthly Risk Review Contract Closure • All questions have pre -defined answers (Post Mortem)

Construction Risk Management ‒ The role of Internal Audit Risk based auditing is conducted on a continuous basis throughout the year on all business units and sites: ─ Information utilised in conducting risk based audits include: ─ STARS Risk Registers ─ Identifying risks via discussions with senior management from all business units ─ Best practice processes based on information from the ECRI and the Contract Life Cycle All mega projects are audited at least twice a year We also conduct joint audits with our JV partners on all joint venture projects Site audits are conducted on all sites when they reach the 40% completion stage

Construction Risk Management 10 ‒ Country risk management within the contract life cycle Country risk analysis selecting acceptable countries • Selecting appropriate tendering entity for statutory and tax purposes • Pricing specific costs associated with operating in the chosen country (logistics, tax etc. ) • Specific risk • Planning and finalising logistical & operational issues • Establishing contract for appropriate legal entity, tax structures and compliance requirements • Guideline on practical tax implications of contract • Mobilising appropriate workforce • Advising on and overseeing compliance • Continuous monitoring of country risk profile • Site audits and contract risk reviews Share lessons learnt

Challenges facing the industry Skill shortage Commodity price volatility and availability Changing client needs (Large multi-disciplinary contracts) ESKOM impact Availability of key machinery Subcontractor capacity Health & Safety

Definition of acronyms SHEQ = Safety, Health, Environment, Quality STARS = Risk Tracking System CLC Contract Life Cycle = ECRI = Institute Engineering and Construction Risk EPC Engineer, Procure and Construct =