Information and Technology Committee report

The number of meetings and attendance per committee member are shown in Corporate governance.

Regular invited attendees: Chief Executive Officer, Chief Financial Officer, Chief Risk Officer, Chief Information Officer and Chief Commercial Officer.

The summaries in Board of directors provide an overview of the directors' qualifications and experience.

COMMITTEE PURPOSE

The Information and Technology Committee ('the committee') is mandated by the Board to ensure that information and technology is managed, appropriately resourced, and sufficiently defined to enable operations and to achieve the Group's strategic objectives. The committee is responsible for ethical and effective risk and compliance systems for Information, Communication and Technology ('ICT') as defined by King IV principle 12. The EOH exco is accountable to the committee for the implementation, effectiveness of, and adherence with, the EOH Governance Framework.

EOH constituted an IT Council that reports into the IT committee and is responsible for the delivery of the Group IT internal strategy within which the organisation operates. This includes the digitisation of the organisation, compliance with the regulatory framework, policy setting and oversight of the costs of the IT function. The IT  Council meets monthly and provides updates to the committee at  committee meetings.

The committee is responsible for:

• the effectiveness of the EOH Group IT strategy, ensuring that ICT  capabilities support the EOH Group business strategy;
• leading the delivery of ICT capabilities that enable the integration of people, technologies, information and processes across EOH  entities;
• ensuring sufficient ICT management capacity, resources and IT systems, including applications, hardware, software and networks;
• enterprise-wide management of information and technology risk, in line with the EOH Governance Framework, ensuring a road to ISO 27001 compliance;
• proactive monitoring and management of systems to identify and respond to incidents, including cyber-attacks and data security;
• managing the performance of, and the risks pertaining to, third-party and outsourced ICT service providers;
• reviewing ICT capital and operating budgets, assuring value delivered from investments made by the EOH Group in information and technology;
• ensuring the effectiveness of governance relating to systems, programming, network and operations activities;
• ensuring ICT backup procedures, including periodic testing, and disaster recovery planning, to ensure business continuity and resilience;
• ensuring the responsible disposal of obsolete technology and the confidentiality of information, with minimal impact on the environment;
• ensuring that an effective disaster recovery plan is in place; and
• ensuring the responsible use of information and technology, including compliance with statutory and regulatory obligations.

ACTIVITIES DURING THE YEAR

The committee is aligned to deliver against the EOH Governance Framework, which contains measures relating to the ethical and effective oversight of the EOH Group's ICT matters. The committee is required to meet three times a year in terms of its terms of reference. However, in the year under review, the committee met four times due to increased workload given the disruptions during the year and the time taken to establish EOH's first Group IT  strategy.

The committee's key focus areas for the 2021 financial year included:

CONCLUSION

The committee is satisfied that it has discharged its responsibilities during the year, as set out in the terms of reference.

Mike Bosman
Chairperson, Information and Technology Committee

26 October 2021