CHIEF RISK OFFICER REPORT

FOR THE PERIOD ENDING 30 JUNE 2020

ABACUS HOLDCO (PROPRIETARY) LIMITED

ABACUS LIFE LIMITED

ABACUS INSURANCE LIMITED

("ABACUS")

COMBINED RISK COMMITTEE MEETING ON 3 SEPTEMBER 2020

1. INTRODUCTION

The most material threat to Abacus’ sustainability and solvency currently remains the potential
financial consequences resulting from the impact on the South African economy of the National
Lockdown imposed by Government in order to curtail the spread of the COVID-19 virus.

Since the last Risk Committee, the FY29021 Budget and 3-year projections have been prepared
taking into account the current and expected economic environment. This budget and 3-year
projections allows on an expected basis for additional death and retrenchment claims, reduced
new business, increased policy lapses and the cost-saving effect of:

 Abacus’ new target operating model; and

 The organisational design optimization.
The new target operating model and organisational design are aligned with the strategic direction
recently obtained from Abacus’ shareholder.

2. RISK MANAGEMENT PROCESS

The Risk Management process followed to confirm existing risks and to identify new, and
emerging risks is as follows:

Page 1 of 10
  Monthly the management attestation documents, which is in essence extracts from the
risk registers, are forwarded to each risk owner to confirm that the risks are still relevant,
controls are complete, that they did perform the control and to identify any new risks;
 The CRO attends various forums such as the Abacus Manco, Abacus EXCO, project
meetings, industry forums as well as the receipt of information from multiple resources
such as the regulators, industry bodies like SAIA, risk and fraud forums, where new and
emerging risks are being identified. Other sources of potential new risk are identified from
interactions with the Group CRO as well as interactions with 3 rd party intermediaries and
binder holders. Regular interaction with Directors, Actuaries, Internal and External Audit
also reveals potential risks. The CRO considers whether these risks apply to Abacus and if
so include in the risk registers after discussion and agreement with the risk owners.
 Risk matrices are reported quarterly to the Abacus Risk Committee, and residual risks that
remain within Abacus’ risk appetite is managed by the Abacus management team. Risks
that are not adequately mitigated and outside of the approved Risk Appetite level for
Abacus, are subject to further remedial action and feedback ahead of the quarterly risk
meeting
 Risks identified are categorised as follows and managed accordingly:
o Strategic,
o Operational,
o Legal, Compliance and Conduct
o Reputational
o Insurance,
o Market,
o Liquidity, and
o Credit.

3. RISK ASSESSMENT RESULTS

1.1 Risk Measured against the Risk Appetite and Risk Tolerances

From the June 2020 quarterly submission to the PA, it was evident that Management adhered to
the Risk A and Risk Tolerance levels. The SCR cover ratio for Abacus Insurance was 2.4 compared

Page 2 of 10
 to 1.68 in the previous quarter. For Abacus Life, the SCR cover ratio was 3.11 compared to 3.04 in
the last quarter. This position is, however, expected to deteriorate in the next quarter due to the
financial impact of the COVID-19 pandemic.

Any potential breach of the Risk Appetite or the Risk Tolerance levels is closely monitored, and if
possible, comprehensive actions implemented to avoid any breach.

1.2 Composite Risk Rating

The Composite Risk Rating includes a review of the capital and earnings of Abacus, considering the
quality, quantity, and availability of externally and internally generated capital and funds.

As at the end of July 2020, considering the current earnings patterns and capital, as well as the
overall Risk Assessment as per the Risk Register, the Composite Risk is assessed as High, compared
to the previous quarter's High. It is anticipated that for the period July 2020 to September 2020
the Composite Risk will remain high mainly due to the expected increase in particular
retrenchment claims and the impact thereof on cashflows and available capital. For a detailed
analysis of the potential impact of the economic consequences of the National Lockdown imposed
to control the COVID-19 virus. Refer to draft ORSA report section 5.1 of the Risk Committee pack.

1.3 Capital rated Acceptable but declining

Abacus Life and Abacus Insurance are in a financially sound condition at the end of July 2020 with
adequate capital in place. This position is anticipated to deteriorate due to the decline in new
business, increase in lapses and increase in claims.

1.4 The rationale for the rating:

For the period ending 31 July 2020, adequate capital was available to meet the Risk Appetite level
(SCR 1.5). Gross written premiums are trailing behind the budget by 3.5%, while net profit before
tax, is also trailing ahead of budget by 19.3%. These trends will continue to put pressure on
cashflows and capital. Therefore, the Overall Residual Risk has been assessed as high.

Page 3 of 10
1.5 Overall Residual Risks

The average Overall Residual Risk rating for the period ending 30 June 2020 has been assessed as
High remaining unchanged from the previous quarter. As previously stated the COVID-19
Pandemic impacted Abacus and the JD Group, in terms of reduced new business, increase in
lapses (bad debt write-offs) and increase in claims.

1.6 Top inherent risks

Residua
Inherent
l risk
Main risks/ Description Likelihood Impact risk Direction Commentary
Rating
Rating
06/2020
COVID-19 pandemic The recent COVID-19 pandemic has
resulting in an economic been identified as one of the top risks
downturn for Abacus. The residual risk has been
assessed as high due to the
immediate and future impact on the
business in terms of reduced new
business, increased lapse risk as well
as increases in claims and specifically
the retrenchment risk component. A
similar effect is experienced on the JD
side, which is one of the major
5 5 25 25 Stable sources of business for Abacus.
Increased write-offs have also been
experienced. The residual risk remains
high due to the reasons mentioned
above. Management has embarked on
processes to reduce the costs in the
business to counter the effect of
COVID-19. Key economic variables are
monitored on a continuous.
Investments are held in short-duration
instruments which are not materially
affected by market movements
Adverse trading The inherent risk has been assessed as
conditions at JD that high since more than 90% of our
affect Abacus business is linked to the JD Group.
Thus, a reduction in the results of the
JD Group as our only client will have a
significant impact in the form of
reduced new business and reduced
premium income for Abacus. The
5 5 25 15 Increasing residual risk increased due to the
COVID-19 implications for JD in the
form of reduced new business
written, bad debt write-offs due to the
economic downturn effect. The direct
impact on JD will directly impact
Abacus. Management regularly
engages with JD management to
understand trading conditions.
Loss of JD Group as a The inherent risk has been assessed as
client 5 5 25 15 Increasing high as JD is our only client. Any
reduction in the profitability and or
Page 4 of 10
 Residua
Inherent
l risk
Main risks/ Description Likelihood Impact risk Direction Commentary
Rating
Rating
06/2020
sustainability of JD will impact Abacus.
Change in strategic direction on the JD
side, for instance, decisions to move
to insurance business to another
insurer, will have a direct impact on
Abacus. Management regularly
engages with JD management to
understand trading conditions.
Market research is conducted
periodically to ensure products
offered are still acceptable to clients
from a design and cost point of view.
Reputational risk Being a regulated company, non-
because of customers compliance to TCF/ Conduct risk could
not given clear have a material impact on the
information and kept business both from a reputational and
appropriately informed product take-up perspective. The
before, during and after likelihood of not giving customers
the time of contracting, clear information and the resultant
policy lapses and cancellations can
have a material impact on business
before implementing any controls. It
also gives rise to material reputational
risk. The residual risk has been rated
as low due to the following key
controls in place:
Analysis of complaints trends monthly
relating to information supplied to
customers before, during and after-
sale (KC);
Analysis of claims rejections (KC):
Product training provided to the
selling agents (KC). The training
initiatives, as well as roadshow to JD
5 4 20 2 Stable
Stores, have proven effective as a real
change in product mix, have been
experienced during the past two
quarters.
Risk and Compliance monitoring to
ensure compliance by the
Intermediaries and call centre agents
(KC). The frequency of the Risk and
Compliance monitoring at the
Intermediaries are as per the
approved Compliance Monitoring
Plan. Monitoring takes place on a
rotational basis wherein one quarter
the focus is on TCF, 2nd quarter on
fraud risk, and IT risks, Cyber risks and
BCP/DR processes.
Good results were received over the
previous quarters, confirming
compliance by all the Intermediaries.
KID documents, welcome booklets,
fulfilment documents, monthly SMSs
to members.
Failure of the BCP and The fact that we rely on IT systems
DRP 4 5 20 12 Stable and infrastructure of 3rd party service
Page 5 of 10
 Residua
Inherent
l risk
Main risks/ Description Likelihood Impact risk Direction Commentary
Rating
Rating
06/2020
providers makes us susceptible to
system failures that could cripple the
business. The likelihood of system
failures before any controls is high,
and the resultant impact is also high.
The residual risk has been rated as a
medium due to the limitation of the
key controls in place:
 BCP/ DR plans in place at Abacus
and Intermediaries and
simulation testing taking place; As
reported at a previous Risk
Committee, BCP and DRP plans
are in place at the Intermediaries,
were tested, network penetration
testing was performed and found
to be effective.
 Independent audits conducted;
 Independent Network
penetration and vulnerability
testing conducted.
Non-compliance to the This risk was rated as inherently high
Insurance Act, Financial because we operate in a highly
Sector Regulations Act, regulated industry, and any non-
and related legislation, compliance could result in the
resulting in penalties and suspension or withdrawal of the
loss of license Insurance and FSP licenses. The
residual risk has been rated as low
due to:
 Abacus has sufficient skills and
expertise to implement the
necessary legislative
requirements.
5 4 20 6 Stable
 Monitoring of compliance with
the legislation by the Abacus Risk
and Compliance team.
 Internal audit review on
compliance with legislation.
 Legislative impact assessments
are done as and when new
legislation is promulgated and
reported to the Risk Committee.
 Specialist attorneys contracted in
drafting and reviewing of legal
agreements and policy Ts and C's.
Reliance on Binder 5 4 20 9 Stable The reliance on 3rd party
Holders and Outsource Intermediaries and Binder holders
partners resulting in non- increase the likelihood of non-
compliance by Abacus compliance. Having the Insurance and
giving rise to FSP licenses suspended or withdrawn
reputational risk, will have a material impact on the
penalties, and loss of business. The residual risk was
licenses. assessed as a medium due to:

 Risk and Compliance performs an

Annual review of the compliance
with all Binder Agreements,
Intermediary Agreements and
Page 6 of 10
 Residua
Inherent
l risk
Main risks/ Description Likelihood Impact risk Direction Commentary
Rating
Rating
06/2020
Outsourcing Agreements
according to the Compliance Risk
Management Plan
 Internal Audit provides legislative
assurance compliance as per
approved Audit plan.
 All Binder, Intermediary and
Outsourcing agreements drafted
and aligned to regulatory
requirements by a specialist
Attorney Firm.
The probability of the 3rd party
providers not complying is rated as
high; however, the impact would be
low. The above controls will mitigate
the risk.

In the future a checklist/ attestation

will be provided by each
Intermediary/ Binder holder,
attesting that the responsibilities in
terms of the agreements have been
adhered to. This will be a self-check
by the 3rd party.

1.7 Top residual risks

Inheren
Residual Risk
Risk Commentary/Control Measure in place Direction t Risk
06/2020
05/2020
COVID-19 pandemic The recent COVID-19 pandemic has been
resulting in an economic identified as one of the top risks for Abacus. The
downturn residual risk has been assessed as high due to the
immediate and future impact on the business in
terms of reduced new business, increased lapse
risk as well as increases in claims and specifically
the retrenchment risk component. A similar
impact is experienced on the JD side, which is
one of the major sources of business for Abacus.
25 Stable 25
Increased write-offs have also been experienced.
The residual risk remains high due to the reasons
mentioned above. Management has embarked
on processes to reduce the costs in the business
to counter the effect of COVID-19. Key economic
variables are monitored on a continuous.
Investments are held in short-duration
instruments which are not materially affected by
market movements
The inherent risk has been assessed as high since
more than 90% of our business is linked to the JD
Adverse trading conditions Group. Thus, a reduction in the results of the JD
Group as our only client will have a significant 15 Stable 15
at JD that affect Abacus
impact in the form of reduced new business and
reduced premium income for Abacus. The

Page 7 of 10
 Inheren
Residual Risk
Risk Commentary/Control Measure in place Direction t Risk
06/2020
05/2020
residual risk increased due to the COVID-19
implications for JD in the form of reduced new
business written, bad debt write-offs due to the
economic downturn effect. The direct impact on
JD will directly impact Abacus. Management
regularly engages with JD management to
understand trading conditions.
The inherent risk has been assessed as high as JD
is our only client. Any reduction in the
profitability and or sustainability of JD will impact
Abacus. Change in strategic direction on the JD
side, for instance, decisions to move to insurance
business to another insurer, will have a direct
Loss of JD Group as a client 15 Stable 15
impact on Abacus. Management regularly
engages with JD management to understand
trading conditions. Market research is conducted
periodically to ensure products offered are still
acceptable to clients from a design and cost
point of view.
An IT Disaster Recovery Plan (DRP) has been
established as required by legislation by all 3rd
party providers.
The IT DRP is reviewed and tested for Abacus and
3rd parties on an annual basis as well as
independent assurance providers.
All result of the test is reported to the Risk
Risk of the failure of the
Committee on an annual basis. 12 Stable 20
BCP and DRP plans
3rd Party providers perform regular back-ups and
testing of the system data and provide proof
monthly to Abacus.
The risk is spread as the data is housed by
various services providers such as JD, Phakama.
Penetration testing performed by Intermediaries.
Internal and External Audit reviews.
Risk and Compliance performs an Annual review
of all Binder Agreements, Intermediary
Agreements and Outsourcing Agreement
according to the Compliance Risk Management
Plan
Internal Audit provides legislative assurance
compliance as per approved Audit plan.
Risk & Compliance Report and Internal Audit are
Reliance on Binder Holders,
submitted to the Risk and Audit Committee for a
Outsourced Partners, 9 Stable 20
review and enforcement of actions
leading to financial losses
recommended.
Compliance Department has developed a
Compliance Management Plan. The plan sets out
the review date of the agreement.
All Binder, Intermediary and Outsourcing
agreements drafted and aligned to regulatory
requirements by a specialist Attorney Firm.

Non-compliance to POPI The President of South Africa has proclaimed 9 Stable 12

Act, resulting in penalties, that POPIA (the POPI Act) will commence on 1
reputational damage and July 2020. This means that Abacus will have 12
financial losses due to months from 1 July 2020 to comply with POPIA.
claims against the The current project plan will be reviewed, and
company. key elements to support the implementation of
POPIA will be updated to ensure Abacus is
Page 8 of 10
 Inheren
Residual Risk
Risk Commentary/Control Measure in place Direction t Risk
06/2020
05/2020
compliant by 1 July 2021.
Abacus has the current controls in place:
 HR: Employment data is secured with user-
specific access
 Operations: Policyholder information used to
process claims by Abacus and the Vendor,
Phakama is user-specific
 Abacus only use consented information in
Call Centre.
POPI steering committee has been created,
ensuring compliance to POPI and readiness by
Abacus. POPI policy in place and awareness
created with all employees. POPI clauses
included in all legal agreements with
Intermediaries and Binder holders requiring
compliance to POPI.
POPI clauses included in all employment
contracts of Abacus employees. Data Privacy
Officer appointed/ allocated, ensuring
compliance with POPI.

4. SYSTEMIC RISK

Abacus Management considers the following systemic risks in the bigger Pepkor Group, could
potentially impact Abacus:

 Material reliance by Abacus on the JD Group; and

 Any potential major event at Pepkor level, impacting the liquidity and solvency of the
Pepkor Group, might result in the inability of Pepkor to re-capitalise Abacus when required.

The systemic risks at Abacus which might impact the bigger Pepkor Group:

 Any regulatory requirements at Abacus might have an impact on Pepkor including potential
reputational risk for the Pepkor Group; and
 Potential solvency and liquidity requirements at an Abacus level.

5. EMERGING RISKS AND POST QUARTER EVENTS

Page 9 of 10
 The following three emerging risks have been identified for consideration:

 The economic impact of COVID-19 in terms of reduced consumer spending resulting in a

decrease in new business, an increase in claims as a result of job losses.

 In view of the multiple press reports that Steinhoff is endeavouring to settle its debt in cash
and Pepkor Shares, and the fact that both Abacus Life and Abacus Insurance qualify as
Financial Institutions more specifically as “Eligible Financial Institutions” as defined in the
Financial Sector Regulations Act (FSRA), Abacus Management highlighted the insurance
compliance requirements to be adhered to in the event that it is possible that any legal
personae could fall within the definition of a “Significant Owner” in the FSRA due to a
Steinhoff debt settlement agreement.

 It has come to Abacus’ attention that the JD Group are consolidating the Abacus financial
results 100% in their financial records and eliminate all cross charges. These consolidated
results are then reported to Pepkor Group. This is in direct violation of the approval
conditions relating to the change of Shareholder as approved by the Prudential Authority.

6. REQUIREMENTS FOR AN OUT OF CYCLE ORSA

Management considered whether the current economic downturn experienced resulting from the
COVID-19 pandemic triggered an out of cycle ORSA. Management concluded the events does
trigger an out of cycle ORSA and has therefore decided to include the draft annual ORSA report for
consideration in the risk committee pack under section 5.1.

Riaan Cromhout
Chief Risk Officer
Abacus Life and Abacus Insurance
22 August 2020

Page 10 of 10