Adcock Ingram Integrated Report 2018

FIRST LINE SECOND LINE THIRD LINE THREE LINES OF DEFENCE The Group manages risk by employing the three lines of defence strategy. This demonstrates how the Board ensures that risk is treated as integral to the way it makes decisions and executes its duties and promotes transparency and accountability. FIRST: DIVISIONAL MANAGEMENT u u Day-to-day management, identification, monitoring and tracking of risks u u Design and implement the system of internal control with regard to the division’s operations in response to risks u u Appropriate escalation of material risks via relevant governance structures SECOND: EXECUTIVE MANAGEMENT u u Challenging and overseeing activities of first line of defence u u Design and implementation of policies and procedures as well as strategy u u Assurance providers to regulators as well as to the Board of Directors through the Risk and Sustainability Committee THIRD: INDEPENDENT ASSURANCE PROVIDERS u u Internal audit u u External audit u u Other independent service providers The independent assurance providers were recently reviewed. The Committee is satisfied they objectively provide assurance regarding the activities of the first and second lines of defence. ENTERPRISE RISK MANAGEMENT The diagram below depicts Adcock Ingram’s model for risk management The Head of IT presents to the Committee how the related risk is assessed and managed within the Company. Information Technology is an integral part of the operations as an enabler and the Group has implemented a number of arrangements governing and managing technology and information, including but not limited to: u u an IT strategy that underpins the business strategy; u u an IT Governance framework to ensure relevant processes and structures are in place that meet the business requirement; u u implementing relevant IT best practises; u u implementing a validation policy in terms of which technology and systems implementation are validated according to the Good Manufacturing Practices (GMP) and Pharmaceutical Inspection Co-operation Scheme (PICS) principles that also covers requirements from other pharmaceutical companies that makes use of the Adcock Ingram facilities; u u Internal Audit performs audits on different parts of the Company to test the effectiveness of internal controls; u u Group Quality Assurance audits incorporate industry’s best practices to ensure constant and continuous improvement of Adcock Ingram’s quality systems, processes, technologies, infrastructure, regulatory compliance and technical support; and u u audit procedures conducted by the External Auditors in support of their audit opinion. Key areas of focus during the reporting period were as follows: u u The IT policy was reviewed to align to the requirements of the King IV; u u Application systems enhancements and expansions; u u Infrastructure upgrades were undertaken; u u Cyber security was upgraded. Adcock Ingram uses a multi layered IT security framework to detect and prevent, as far as possible, cyber security attacks. The IT security environment is in a continuous process of improvement to address potential issues identified through a variety of audits, attack and penetration testing, and the latest IT security guidelines; and u u Phase 1 of the new Quality Assurance system and Transportation management systems went live. Key areas of focus in the future include: u u Integration of the IT environments of recently acquired businesses (Virtual Logistics and Genop); u u The optimisation of the forecasting and planning systems, as well as the implemented process manufacturing systems, forms part of an operational continuous improvement process; u u Further enhancements to the IT security environment; u u Ensuring POPIA readiness; and u u Implementation of a new laboratory information management system, a new pharmacovigilance system, digitisation of business processes and finalising the last phase of the new quality assurance system. ADCOCK INGRAM  Integrated Report 2018 47