As disclosed in note 11 to the consolidated financial statements, the carrying value of goodwill is R14 315 million and comprises 34% of the total assets of the Group. The directors conduct an annual impairment assessment to test the recoverability of the carrying value of goodwill in accordance with IAS 36: Impairment of assets ("IAS 36"). The directors' assessment of the impairment of goodwill is performed by determining the recoverable amount of goodwill with reference to the higher of value in use or fair value less cost to sell for each cash generating unit.

The directors applied judgments in the estimation of the value in use including the determination of the values of the following key assumptions:

• Growth rates;
• Tariff increases;
• Inflation rates;
• Discount rates; and
• Terminal growth rate.

These key assumptions have a significant impact on the value in use calculation and their values are estimated on the basis of expected future market conditions, which are also subject to change.

For the southern African cash generating units, the assumption with the most significant effect on the impairment assessment which requires significant judgement by the directors is the tariff increases. Tariff increases are based on latest available economic forecasts and the directors' expectations of the outcome of annual tariff negotiations. As a result the impairment assessment of goodwill for the southern Africa cash generating units with a particular focus on the judgement applied in determining the tariff increases used in the calculation of value in use was considered a key audit matter.

In evaluating the impairment of goodwill, we reviewed the value in use calculations prepared by the directors and the judgments applied in these calculations, with a particular focus on the judgement applied in determining the tariff increases utilised in the valuation models of the southern African cash generating units. We performed various procedures, including the following:

• Testing of inputs into the cash flow forecast against historical performance and in comparison to the directors' strategic plans in respect of each cash generating unit;
• Involving our specialists to evaluate whether the directors' model complies with the requirements of IAS 36;
• Recomputation of certain value in use amounts of the southern African cash generating units;
• Comparing the tariff increases to historical data regarding economic growth rates for the southern African cash generating units;
• Assessing industry data on tariff increases for any contradictory evidence to the tariff increases applied by the directors; and
• Performing sensitivity analyses on the tariff increases to evaluate the extent of impact on the value in use and the appropriateness of the directors' disclosures.

The judgments applied in the calculation of the value in use relating to the impairment of goodwill, with a particular focus on the judgement applied in determining the tariff increases in the southern African cash generating units were considered appropriate. We considered the goodwill impairment disclosures to be appropriate.

The Group's operations are heavily dependent on the use of technology and various financial reporting systems. The IT environment is complex and pervasive to operations due to:

• The large volume of transactions processed in numerous locations daily; and
• A strong reliance on automated controls as well as IT dependent manual controls.

Consequently, appropriate IT controls are required to ensure that applications process data as expected and that changes are made in an appropriate manner. Such controls contribute to mitigating the risk of potential fraud or errors.

During our audit we identified vulnerabilities in the IT control environment in the southern Africa operations around user access, developer access and change management controls on key financial accounting and reporting systems. There is a risk that exploitation of these vulnerabilities could result in the financial accounting and reporting records being materially misstated.

The weakened IT environment relating to the southern African operations was therefore considered a key audit matter.

Significant audit effort was therefore spent to understand, document and test controls to mitigate the risk of misstatements as a result of the vulnerabilities identified, that weakened the IT environment in the southern African operations.

Our audit required extensive involvement from our senior audit personnel, IT specialists and individuals with specialised knowledge.

Due to the fact that we were unable to rely on the IT general controls in southern Africa, we were required to amend our initially planned control reliance audit approach to a fully substantive based approach, incorporating:

• Increased detailed testing, which increased our sample sizes and resulted in a largely manual testing approach;
• Increased procedures over assessing the completeness and accuracy of reports produced by the systems before reliance could be placed on them; and
• Extensive data analytics were performed on journal entries throughout the period in order to extract entries that might exhibit characteristics of fraudulent entries.

Based on the audit procedures performed and the level of expertise and effort associated with the current year audit, we are satisfied that our audit procedures were sufficient to mitigate the impact of the weakened IT controls identified over financial reporting.

As disclosed in note 1.1.2 to the consolidated financial statements, Life Healthcare was a victim of a targeted criminal attack on the IT systems of the southern African operation. Management took the decision to take all their systems offline in order to actively contain the attack and investigate the incident further.

The attack impacted a number of hosts and servers across the network. Management engaged specialists to perform a forensic analysis on a sample of computers that were impacted by the incident. During the system down time, Life Healthcare reverted to accounting for all transactions manually.

Once the systems were switched back on, management captured each individual manual transaction through the system as if it occurred on a real time basis.

Extensive audit procedures were required to address the additional risks of material misstatement, specifically as it relates to the:

• The design and implementation of automated controls relating to the restored IT systems;
• The design and implementation of manual controls relating to the manual capturing of transactions;
• Completeness and accuracy of data in the financial reporting systems affected by the cyber incident, before and after the incident; and
• Testing key controls that were implemented by management to enhance the control environment.

Due to the pervasive nature of the cyber incident to the southern African operations, the length of system down time and the resulting manual record keeping and subsequent electronic re-capturing of transactions, this was considered a key audit matter.

Our response required involvement of our senior personnel and specialists to understand management's response, the governance around this response, as well as procedures to restore normal operations.

Our procedures included the following:

• Engaged our IT and Cyber specialists to assess the extent of breach and data compromise;
• Reviewed management's experts' reports on the incident, including recommendations for data protection and understanding the extent of the cyber breach;
• Assessed management's experts' independence and competence;

• On a sample basis, re-performed procedures performed by management's experts to ensure reliance could be placed on their procedures and conclusions reached;
• As part of our continuous risk assessment procedures, re-tested the design and implementation of certain general IT controls post the cyber incident;
• Tested the newly implemented and hardening controls that had been implemented by management (Multifactor authentication and revised firewall rulesets);
• Performed additional procedures to ensure the completeness and accuracy of the electronic capturing of transactions accounted for manually during the system down time;
• Reviewed correspondence with legal advisors confirming the reporting requirements to the relevant authorities;
• Inspected correspondence with relevant authorities, notifying them of incident;
• Engaged our legal specialists to ensure appropriate governance processes were followed; and
• Performed manual audit procedures including reconciling certain monthly results on the restored systems to the manual versions of previously approved management accounts to ensure no changes to data had been made.

Based on the testing performed, the data in the financial reporting systems appear to be materially complete and accurate and appropriate corporate governance processes were followed.