Rand Water | Integrated Annual Report 2025

HOW WE MANAGE OUR RISKS Risk Management remains a cornerstone of good governance and operational resilience within Rand Water. In alignment with our mandate to ensure the sustainable provision of good quality potable water, we continue to embed a robust risk management culture across all levels of the organisation. Our risk management practice is aligned with the International Organisation for Standardisation 31000 (ISO 31000) as amended, which provides best practices and guides the identification, assessment, mitigation, and monitoring of risks that could impact our strategic objectives. The Board has committed Rand Water to a process of Risk Management that is aligned to the principles of good corporate governance, as supported by the PFMA, National Treasury Regulations, King IV Report and International Organisation for Standardisation 31000 (ISO 31000) as amended. HOW RAND WATER IDENTIFIES RISKS AND OPPORTUNITIES Rand Water has established processes and structures directed towards the effective management of potential opportunities and adverse effects within Rand Water’s environment. Rand Water’s mission and vision are an expression of an organisation that seeks future opportunities whilst managing environmental risks to ensure a sustainable supply of water. Effective risk management necessitates being actively aware that the business environment is constantly changing and undertaking an environmental scan of risks important to the organisation. On an annual basis, Risk Advisory Services facilitates a Corporate Risk Assessment Workshop with the aim of reviewing existing strategic risks, identifying new and emerging strategic risks benchmarked against external sources (such as the Institute of Risk Management South Africa Risk Report and the World Economic Forum Risk Reports). The participants of the above-mentioned workshop are Rand Water’s Corporate Risk Committee (CRC) members, who are subject matter experts and a representative sample of the organisation’s various disciplines. The CRC members play a crucial role in the risk identification process because they provide insight into the risks that are being faced by the organisation and assist in defining new and emerging risks. As much as the organisation can identify adverse effects that may impede its ability to achieve its strategic objectives, it also recognises that there is always opportunity for improvement in the form of further mitigation actions that will assist in intensifying existing risk mitigation strategies. All identified risks are required to have detailed controls in place. Further mitigating actions provide an opportunity for the business to enhance its mitigation strategies. The annual State of the Nation Address and Minister of Finance’s Annual Budget Speech are also source documents that are used as part of the environmental scan to identify new and emerging risks. ENTERPRISE RISK MANAGEMENT The nature, size, and complexities of the organisation’s operations necessitate a solid and effective Enterprise-Wide Risk Management (EWRM) approach that ensures proactive risk management as a means of building and maintaining the organisation’s resilience. A holistic approach of EWRM is embedded within Rand Water. The Risk Advisory Services department develops and manages the organisation’s risk management framework, policies, and processes to enable the consolidation, monitoring, and reporting of risks and mitigation measures throughout the business that affect objectives. This means ensuring that there is continuous monitoring and reviewing of the risks as well as continuous communication and consulting by consolidating quarterly risk mitigation strategy updates and tabling them at CRC, Top Management Committee (TMC), EXCO, GARC, and the Board of Rand Water that ultimately approves and adopts the Strategic Risk Register. EWRM is a continuous process that allows for coordinated and effective risk management across the organisation. The tools used to manage and mitigate risk include policies, procedures, risk reports and a defined risk management governance structure.

28

Rand Water | Integrated Annual Report 2025