Key risks and opportunities

As a business, we face many risks and related opportunities. How we manage these risks and capitalise on opportunities ensures the ongoing profitability and thus the sustainability of our business.

Risk management process

Our risk management processes are integral components of business processes and align with our core values and strategic focus areas. Our board is ultimately responsible for the governance of enterprise risk management and for ensuring that the enterprise risk management framework and processes are effective and robust. The board is supported and assisted by the risk committee and the Group risk management function. The Group Risk Manager engages with key executives and senior management across the Group to identify risks, and the Group risk register incorporates risks from southern Africa, Alliance Medical and Scanmed.

We follow a combined assurance process with three lines of defence to ensure accountability and to distinguish between owning and managing risks, overseeing risks, and providing independent assurance. We ensure that risks and opportunities are appropriately identified, assessed, evaluated and managed by implementing an enterprise risk management strategy and framework, which take into account the principles of King IV and is based on the ISO 31000 international standards on risk management. We further monitor risks according to their nature, potential impact and likelihood.

Embedding risk management processes into our day-to-day operations ensures that the Group is better equipped to identify events impacting our objectives and to manage risks in line with our strategy. Both line management and employees are responsible for implementing risk management policies and processes.

The risk committee receives periodic, independent assurance on the effectiveness of risk management processes from internal audit. The board, along with the risk committee, confirms that it is satisfied that there are adequate, ongoing risk management processes in place to provide reasonable assurance that key risks and opportunities are identified, evaluated and managed.

The analysis on the next page highlights the key risks and related opportunities we are exposed to as a Group. These risks are reviewed through internal operational mechanisms. This section should be read in conjunction with the material matters section. The analysis further highlights how assurance is leveraged through our combined assurance process.



	DESCRIPTION OF THE RISK AND ITS CONTEXT	POTENTIAL OPPORTUNITIES

Funder risk (Ranking in 2018: 1)	In southern Africa, Life Healthcare is under continuous pricing pressure from healthcare funders seeking to manage the overall cost of healthcare. This is primarily driven by a difficult economic environment that has placed pressure on them to contain increases in member contributions in an environment that is seeing a reduction in the number of medically insured lives. This, coupled with escalations in healthcare costs and utilisation, has led to funders instituting managed care initiatives, more affordable plans but with less cover, stringent case management and increased restricted provider networks. Our admission rates could be impacted by our ability to secure preferred network agreements with healthcare funders, as well as more stringent case management. Alliance Medical operates across a number of markets that provide a portfolio of healthcare services. Funding challenges remain prevalent across all northern European health economies. Alliance Medical has a mix of public and private income streams, with public revenue comprising 85% of total revenue in the UK, 62% of revenue in Italy and 39% in Ireland. Scanmed relies on servicing the National Healthcare Fund – Narodowy Fundusz Zdrowia (NFZ) – for a significant 80% portion of its revenue, with limited diversification in its revenue sources, placing revenue at risk when pressure is applied by the NFZ.	Through increased engagement, targeted interventions and a differentiated service offering, we can position ourselves as the service provider of choice locally and internationally

	HOW WE ADDRESS THIS RISK	STAKEHOLDERS IMPACTED

	Implementing an appropriate pricing strategy with a focus on efficiencies and input costs Maintaining a focus on safeguarding good relations with healthcare funders, and engaging with them on their specific issues and concerns Providing a differentiated service offering Focusing on interventions with doctors to increase clinical outcome data and efficiency Long-term contracts in place between our international businesses and their respective National Healthcare Funds Executing a strategy to include growth in the private sector volumes	RELATED MATERIAL MATTERS AND ASSURANCE Healthcare funders Cost of care Quality of care standards Portfolio performance

	DESCRIPTION OF THE RISK AND ITS CONTEXT	POTENTIAL OPPORTUNITIES

Regulatory and compliance risk (Ranking in 2018: 2)	The Group is required to comply with all applicable laws and regulations of the countries in which we operate. In addition to these general compliance requirements, the global healthcare industry is subject to an increasing number of new regulations. In South Africa, the Competition Commission’s HMI – together with the potential impact of impending regulations such as the Protection of Personal Information Act, 4 of 2013 (POPIA), the NHI Bill and the Medical Schemes Amendment Bill – continue to require our attention. In addition, the Department of Health (DOH) introduced the Office of Healthcare Standards: Norms and Standards. Internationally, we remain committed to adhering to the General Data Protection Regulation (GDPR), which applies to the European Union (EU) and the European Economic Area (EEA).	Through continued engagement with regulators and relevant bodies, we can assist the industry to develop appropriate solutions We are committed to compliance to ensure we enhance and protect our reputation Transparent engagement processes have the potential to enhance our relationship with a variety of stakeholders, including regulatory bodies

	HOW WE ADDRESS THIS RISK	STAKEHOLDERS IMPACTED

	Proactively monitor and, where possible, provide input for any new proposed legislation, in the interest of all stakeholders in each of the respective territories Ensure compliance through our quality standards Continue to engage with the Competition Commission through our established multi-disciplinary task team, which allows us to communicate our position on various issues effectively Continuous engagement with our doctors and other stakeholders throughout the HMI to stay up to date of any developments Ongoing assurance by internal audit with adherence to regulatory requirements in the regions where we operate	RELATED MATERIAL MATTERS AND ASSURANCE Cost of care Increasing regulations Quality of care standards Government relationships


	DESCRIPTION OF THE RISK AND ITS CONTEXT	POTENTIAL OPPORTUNITIES

Skilled healthcare professional shortages (Ranking in 2018: 4 and 6)	There is a general shortage of doctors in the South African and Polish healthcare markets, and a shortage of radiologists and radiographers in the regions where Alliance Medical operates. Such shortages of healthcare professional skills affect the Group’s growth prospects, our ability to deliver quality care and services and, ultimately, the sustainability of our operations.	Through our interventions, we can assist in alleviating critical skills shortages while also positioning Life Healthcare as a business that supports the healthcare professionals we associate with

	HOW WE ADDRESS THIS RISK	STAKEHOLDERS IMPACTED

	A clear recruitment and retention strategy is in place, including: Providing bursaries and sponsorship programmes to specialists, as well as facilitating continuous professional development training for them Ongoing engagement Doctor partnership model and support policy, with regional clinical managers appointed to enhance doctor relationships and implement quality improvement initiatives Improved infrastructure and equipment at facilities Enabling reduced professional indemnity premiums through enhanced clinical measures Internationally, the shortage of radiologists and radiographers that could affect Alliance Medical is addressed through investment in a variety of reward, development, recruitment, cultural initiatives and university partnerships In Poland, we host internships for selected and identified specialisations to secure their ongoing service Organising paid internships, vocational practices and apprenticeships in Poland	RELATED MATERIAL MATTERS AND ASSURANCE Specialised skills shortage

	DESCRIPTION OF THE RISK AND ITS CONTEXT	POTENTIAL OPPORTUNITIES

Country risk (Ranking in 2018: 10)	We operate in the global healthcare market, with our operations spread across different countries. There is the risk that country-specific factors, such as economic factors, political factors, or government policies, could adversely affect the Group. The downturn in the South African economy impacting the affordability of healthcare, as well as the uncertainty around the possible impact of Brexit, specifically a hard Brexit, remain top-of-mind.	By actively working with local governments, we can build relationships based on trust, positively impacting the healthcare markets within the countries we operate in

	HOW WE ADDRESS THIS RISK	STAKEHOLDERS IMPACTED

	Actively monitoring country-specific factors in the countries where we operate Ongoing engagement with regulators and governments Brexit contingency and continuity planning Divestment where appropriate	RELATED MATERIAL MATTERS AND ASSURANCE Healthcare funders Government relationships Portfolio performance


	DESCRIPTION OF THE RISK AND ITS CONTEXT	POTENTIAL OPPORTUNITIES

Cybercrime and data breach (Ranking in 2018: 7)	The threat of cybersecurity continues to pose a key risk to our business globally. Due to the widespread use of computers and network-enabled medical devices, threats are evolving, becoming more unpredictable and increasingly frequent. This includes the threat of Group data and information being compromised.	By investing in information security controls, we are able to offer comfort to our stakeholders that we have measures in place to safeguard our data

	HOW WE ADDRESS THIS RISK	STAKEHOLDERS IMPACTED

	We have a matured Information Security Management System (ISMS) that is internationally certified by the British Standards Institution (BSI) (ISO 27001:2003) Regular risk assessments are performed, including annual internal and external security assessments An information management security strategy is in place to improve security, manage residual risks and implement further measures to protect the Group’s intellectual property from hacking and other illegal cyber activities Logical and physical IT security controls are in place, including advanced email protection, firewalls, end-point protection, cybersecurity enhancements and protection of personal information Proactive tools are in place to detect and respond to cyber threats Regular information security and cyber awareness training for staff Policies, processes and controls in place to ensure adherence to the General Data Protection Regulation (GDPR)	RELATED MATERIAL MATTERS AND ASSURANCE Cost of care Increasing regulations

	DESCRIPTION OF THE RISK AND ITS CONTEXT	POTENTIAL OPPORTUNITIES

Key human resource risk (Ranking in 2018: 5)	Due to the highly specialised nature of the healthcare industry, and in light of key growth strategies, certain executive and management employees have a significant impact on the Group’s performance. Failure to attract and to retain employees with the appropriate skillsets for these key roles could hamper performance and, ultimately, the achievement of strategic objectives.	Through targeted succession planning we ensure business continuity and are able to attract talented leaders Quality resources improve business performance

	HOW WE ADDRESS THIS RISK	STAKEHOLDERS IMPACTED

	Recruit high calibre resources for key roles Executive succession planning in place Successors are identified and monitored Enhance our EVP, including employee share schemes, remuneration and other benefits, to attract and retain employees Develop employees in all levels of management Monitor various indicators, such as employee turnover, and develop response strategies to correct any negative trends that emerge	RELATED MATERIAL MATTERS AND ASSURANCE Specialised skills shortage Labour relations and employee retention


	DESCRIPTION OF THE RISK AND ITS CONTEXT	POTENTIAL OPPORTUNITIES

Clinical and patient safety risk (Not ranked in 2018)	Continuing to improve the quality and safety of healthcare services provided by the Group is of utmost importance to us. Failure to consistently deliver safe, high-quality care to our patients is a risk.	Through an ongoing focus on quality and safety we can enhance the patient experience and protect our reputation

	HOW WE ADDRESS THIS RISK	STAKEHOLDERS IMPACTED

	A Quality Management System (QMS) is in place to ensure quality healthcare is provided and that established quality control procedures are in place QMS certification, and ISO 9001 and ISO 13485 accredited through BSI Monitoring of clinical performance indicators Quarterly national quality review meetings are held Internal quality assessments carried out yearly at each hospital by the Quality Systems Support Specialist (QSSS) Medical malpractice and professional indemnity insurance are in place Ongoing training of staff on quality procedures	RELATED MATERIAL MATTERS AND ASSURANCE Quality of care standards

	DESCRIPTION OF THE RISK AND ITS CONTEXT	POTENTIAL OPPORTUNITIES

Information technology (IT) infrastructure, disaster recovery and project implementation (Ranking 2018: 3)	Our IT systems are critical in delivering quality service to our patients, increasing patient safety and decreasing medical errors, as well as strengthening the interactions between patients and healthcare providers. With healthcare becoming more consumer friendly, there is a drive towards electronic health records and digitisation. It is therefore imperative that our IT infrastructure and systems are appropriate and fit-for-purpose to respond to this cultural shift. There is also a risk of failure to maintain reliable information systems for business operations in the event of an IT disaster. Furthermore, we remain exposed to the implementation risk regarding information management projects which are under way to improve the existing infrastructure and ensure better Group-wide integration.	By investing in our IT infrastructure, we are able to offer better and more efficient services to our patients, thereby lowering the cost of care while maintaining quality Appropriate and effective IT infrastructure and systems support growth initiatives and performance expectations, therefore providing the opportunity to be more competitive

	HOW WE ADDRESS THIS RISK	STAKEHOLDERS IMPACTED

	Regular, periodic assessments of our IT infrastructure are conducted, with action plans implemented to effect enhancements and address shortcomings Disaster recovery capabilities are maintained and aligned with agreed business tolerances Disaster recovery tests are performed annually with action plans documented and implemented to address any identified shortcomings Rigorous project management methodology is followed, with strong business sponsor leadership and oversight A formal Systems Development Lifecycle (SDLC) process is in place and a Total Cost of Ownership (TCO) costing model is applied to each project Project prioritisation is conducted Risk registers are maintained for projects and a response plan is in place for identified risks	RELATED MATERIAL MATTERS AND ASSURANCE Cost of care



	DESCRIPTION OF THE RISK AND ITS CONTEXT	POTENTIAL OPPORTUNITIES

Reputational risk (Ranking in 2018: 8)	Adverse events while performing clinical procedures and services, or other activities, could negatively affect the Group’s reputation and relationships with key stakeholders. Furthermore, events outside of our control can adversely affect our brand.	Through an ongoing focus on quality and a clear communication strategy, we can enhance and protect our reputation

	HOW WE ADDRESS THIS RISK	STAKEHOLDERS IMPACTED

	Quality management processes are in place across the business with ISO 9001 certification held A media strategy is in place for dealing with complaints raised through the media, as well as other media-related issues	RELATED MATERIAL MATTERS AND ASSURANCE Increasing regulations Quality of care standards