GOVERNANCE, BUSINESS ETHICS AND RISK

We consider sound corporate governance, ethical conduct, robust risk management and regulatory compliance to be fundamental to our commercial sustainability. We must operate ethically, transparently and accountably if we are to avoid legal and reputational risks and maintain high employee and

CORPORATE GOVERNANCE

We continuously assess our governance operating model to ensure that robust internal governing bodies and proper systems/processes are in place to support our leadership team to drive change, set strategic direction and formulate high-level goals and policies centred around creating equal opportunities for economic advancement that are accessible to all levels of society.

The Board is responsible for overall governance and risk, through its audit and risk sub-committee. The ethics committee provides strategic direction on ethics and governance.

A NEW MANAGEMENT STRUCTURE FOR ENHANCED SECURITY

In November 2018, in line with our strategy and purpose of transforming lives, performance ambition and the realities of our operating environments, we reorganised our ways of working to enhance our focus on the customer and strategically align teams for improved execution.

The Corporate Security division, formerly Risk, is headed by the Chief Corporate Security Officer who now has responsibility for all aspects of corporate risk and security, including cyber security.

To consolidate its assurance remit and make it independent of the Technology Division, the Cyber Security Department now falls under Corporate Security, which is tasked with safeguarding network security. The Chief Corporate Security Officer and the Internal Audit team continue to report to the Board audit committee.

The Compliance and Fraud Prevention functions were merged to improve efficiency and avoid overlapping activities such as fraud-related controls and mitigations, ethics management and compliance and controls monitoring.

“We must operate ethically, transparently and accountably… to maintain our sustainability and success.”

The main focus areas of potential risk for corporate security during the year under review have been:

Adverse regulatory environment;
Cyber risks;
Market disruptions such as competition and changes in our business ecosystem; and
Partnership management risk.

ETHICAL BEHAVIOUR

We recognise that corruption drives inequality by preventing fair access to economic power and basic social needs and, in extreme cases, results in violation of human rights. We take steps to cultivate awareness and put anti-corruption monitoring and corrective measures in place, and drive behaviour change in society through collective action initiatives.

ETHICS AND COMPLIANCE AMONG OUR EMPLOYEES

In FY18, anti-corruption training of contract and full-time equivalent (FTE) staff was conducted mainly via staff sessions. In FY19, we provided customised training on a department-by-department basis. In FY20, we intend to change our approach to ensure better coverage.

Ethics awareness sessions are conducted annually. Following feedback from our ethics perception survey, topics covered include duty to report and conflicts of interest. These awareness sessions highlight policies such as the employee code of conduct, which outlines the importance of reporting any ethical issues in the business, and by which all staff and Board members are required to make a regular declaration against conflicts of interest.

Staff ethics training to promote an ethical culture within the organisation also takes place annually, supplemented by mandatory e-learning courses. These empower staff to successfully address any risks arising in their departments or roles.

Our ethics and compliance function was independently audited to ensure its continued efficiency in promoting ethical business practices and fighting corruption, both internally and among our partners.

ETHICS TRAINING FOR OUR PARTNERS
We continuously provide business partner ethics and anti-fraud training to promote ethical business practices among our M-PESA agents, dealers and suppliers. We collect all KYC documents to ensure compliance, and are developing a new app to bring about effi ciencies in the digital capture of KYC documentation during the subscriber registration process.

The Code of Ethics promotes and enhances ethical business conduct in line with the UNGC principles relating to human rights, labour standards, environment and anti-corruption. We continue to make it mandatory that our suppliers sign up to the Code for Businesses in Kenya; their contracts are not renewed unless they do so. Ninety-six per cent of our suppliers have signed up so far.

RISK MANAGEMENT

We have undertaken key initiatives to enhance internal systems to mitigate risks such as fraud and to improve process efficiency and effectiveness. This includes strengthening the credibility of relevant products and services by pursuing professional certification.

NEW RISK MANAGEMENT SYSTEMS PUT IN PLACE

We have implemented Metric Stream software, a digital Governance, Risk and Compliance (GRC) system that will enable us to achieve objectives reliably while addressing uncertainty by ensuring we efficiently track risks and the related controls environment across the enterprise. The introduction of an automated Revenue Assurance System (RAS) will ensure efficient, timely and independent revenue reporting and billing processes.

FRAUD AND ANTI-CORRUPTION

We consistently review our compliance with regulatory obligations, particularly those surrounding fraud, corruption and anti-money laundering (AML) legislation. Compliance with KYC requirements and procedures surrounding the registration of customers and M-PESA transactions to ensure security and combat money laundering, are key focus areas for us.

We more than doubled the number of assessments undertaken the previous year. Under our updated strategy, some reviews were combined so as to cover a broader scope.

ADDRESSING FRAUD AND CORRUPTION
A countrywide surge in SIM-swap fraud accounts for the high number of cases reported to law enforcement agencies in FY19. By contrast, far more fraud cases were investigated in FY18, when a major investigation was conducted involving the corporate loyalty scheme4, than in FY19.

Audit reviews: in-depth reviews that evaluate specific internal controls and processes
Fraud reviews: conducted on specific areas/processes which may have become compromised
Risk assessments: comprehensive evaluations of a range of risks, from operational and strategic to ethical
Special request reviews: reviews of special areas/processes requested by management

Internally, 78 members of staff underwent a disciplinary process to deal with issues of corruption including breach of policy, negligence and asset misappropriation. Most of the cases investigated were initiated by tip offs, which indicates that our duty-to-report training has borne fruit. The nature of disciplinary cases is dynamic; the change in statistics indicates neither an improvement nor a worse environment.

Devices are issued to customers based on certain criteria such as accumulation of a certain threshold of loyalty points, but ten members of our staff had been engaged in theft of these devices. All ten were investigated.

Addressing Corruption and Fraud

One case, involving process negligence, led to 35 further dismissals. This has not been included, however, since it is not necessarily an anticorruption corrective measure.

CUSTOMER FRAUD AWARENESS CAMPAIGNS

Through road shows and local language campaigns in televisual, digital, print and radio media (such as Jichanue and our awareness campaign around the 333 fraud reporting hotline), we have raised public awareness about emerging social engineering fraud schemes. Through these channels we share the steps customers can take to avoid falling victim to scams, as well as information for reporting fraud.

The GSMA Mobile Money Certification is a global initiative by the Global System for Mobile Communications Association (GSMA) and associated operators to ensure safer, more transparent, more resilient financial services for millions of mobile money users. It defines and promotes excellence in mobile money services, enhances consumer trust, accelerates commercial partnerships and sets benchmarks.

Customer Fraud Awareness in Numbers

This has aided us in speedily identifying fraudsters and taking action to combat them. Customer tip-offs have enabled us to block fraudulent subscribers faster and improve fraud controls.

GSMA MOBILE MONEY CERTIFICATION
One of our top aspirations for the year under review was to attain GSMA Mobile Money Certification for our M-PESA policies and practices. We became one of the first five mobile money providers ever to obtain the certification.

The GSMA commissioned a professional certification body to carry out a rigorous independent audit of our mobile money-related practices and policies. Upon successful resolution of the issues raised, Safaricom was awarded the certification on 3 April 2018.

DATA CENTRE TIER III DESIGN CERTIFICATION
Opened in 2015, the Thika Data Centre is our main data centre for co-location services. In FY19 we applied for a Tier III Design Certification for the centre from the Uptime Institute.

The certification confirms that the data centre design supports any planned works on site infrastructure (maintenance or modification) without disrupting operations, providing our enterprise customers with a differentiated service, verified by a global expert, and an assurance of 24/7 infrastructure availability.

The certification was awarded following a thorough forensic assessment of the Safaricom Data Centre design by international experts.

THE B-TEAM: KEEPING ETHICAL, SUSTAINABLE BUSINESS ON THE AGENDA
Safaricom is a founders circle member of the B-Team Africa, not-for-profi t alliances of business leaders who are committed to responsible and sustainable business practices for the wellbeing of people and the planet.

RESPONSIBLE TAX PRINCIPLES
Oxfam reports that tax and benefi ts systems can reduce inequality and poverty, provided a government takes proportionately more tax from those on higher levels of income, and redistributes welfare benefi ts to those on lower incomes.

The B-Team and leading companies (including Safaricom), through engagement with civil society organisations, institutional investors and international institutions, have developed a set of Responsible Tax Principles. These provide a framework for what good tax practice (a key element in reducing inequalities) should look like and a benchmark for businesses to work towards in areas such as tax management strategy, interactions with authorities and reporting.

Safaricom and KCB Group have endorsed the principles, and B-Team Africa is mobilising other business leaders to do the same in key countries including Kenya and Ghana.

Oxfam (2018), “The Commitment to Reducing Inequality Index 2018”, available at https://www.oxfam.org/en/research/commitment-reducing-inequality-index-2018 (accessed 22 June 2019)

ENDING ANONYMOUS COMPANIES AND ADVOCATING FOR OPEN CONTRACTING
B-Team Africa, with the Open Government Partnership (OGP), continues to advocate for government progress towards transparency in public, open data registers, starting in Kenya and expanding to Ghana. This will combat corruption by demanding that organisations operate transparently.

Safaricom, Invest in Africa and other B-Team Africa members continue to mobilise private sector support for transparency in public and private procurement. In partnership with HIVOS East Africa, the Government of Kenya-Business Registration Service and the private sector and the private sector, B-Team Africa joined the conversation on the new benefi cial ownership requirements in the amended Companies Act of Kenya.7 Our supply chain team has kept ahead of the curve by being vigilant in requesting that potential and existing suppliers provide detailed benefi cial ownership information before we undertake any business with them.

LOOKING AHEAD TO 2020

Future focus areas pertaining to governance, risk and regulation include:

building on policies and processes to ensure cyber security for our business and stakeholders;
continuing to promote and support customer awareness around social engineering fraud;
maintaining an active role in collaborative advocacy action to promote ethics and integrity among all our stakeholders;
expanding initiatives to ensure KYC compliance across the business and among our partners;
promoting ethical business practices and a culture of integrity within Safaricom and among its business partners and supporting the efforts of other organisations to abide by the same;