Risk Management and Internal Controls

In today’s environment, emerging risks in the telecommunications sector include cybersecurity threats, changes in legislation and regulatory frameworks, as well as technological challenges such as the deployment of 5G and the Internet of Things (IoT). The increasing number of cyberattacks on communication networks poses risks of confidential data breaches, service disruptions, and significant implications for both business operations and society at large.

As the largest telecommunications operator in Kazakhstan, Kazakhtelecom JSC plays a key role in advancing telecommunications infrastructure and ensuring the security of communications across the country. The Company actively adopts modern technologies and strives to enhance the cybersecurity of its networks to protect customer data and ensure the uninterrupted delivery of communication services. These efforts are supported by the functioning of the Corporate Risk Management and Internal Control System CRMS and IC) at Kazakhtelecom JSC, which is designed to safeguard assets, improve business processes, enhance operational efficiency, and ensure compliance with applicable legal requirements.

The Company has developed and regularly updates internal regulatory documents that define the procedures and principles governing the internal control system, including the Internal Control System Policy and the Internal Control System Management Rules. The updated documentation outlines the following:

• The objectives and principles for building the internal control system;
• The allocation of responsibilities among internal control system participants;
• The main steps and procedures of the internal control process, including responsibilities and timelines for implementation, enhancement, and diagnostics;
• The procedure for updating business process descriptions within the internal control system;
• The process for diagnosing (assessing the effectiveness of) the internal control system and preparing and submitting reports on its current status, including the identification of weaknesses in the internal control system over financial reporting;

At Kazakhtelecom JSC, a formalized internal control system over the financial reporting process has been established. The key stages in building and maintaining this system include:

• Describing key business processes involved in financial reporting;
• Identifying and assessing risks at the business process level that could affect the reliability of reporting, and delineating responsibilities for managing these risks;

The risk map of Kazakhtelecom JSC, developed in accordance with the Risk Register, includes 24 risks that take into account the probability of occurrence and the magnitude of impact. The development of the risk map allows the Company to:

• Identify key risks and develop action plans for their effective management;
• Prioritize risks and allocate financial resources optimally.

Environmental/Climate Risk Factors

The Company’s Risk Register includes an “Environmental/Climate Risk,” which comprises the following factors:

• Low fuel quality, malfunctioning vehicles and boiler equipment;
• Non-compliance with environmental protection legislation and sanitary regulations, as well as limited employee awareness;
• Breaches in waste and wastewater management requirements;
• Lack of a dedicated structural unit responsible for environmental issues;
• Accumulation of mercury-containing lamps, vehicle tyres and other materials that are not being disposed of;
• Insufficient funding for proper disposal;
• Absence of employee training on environmental matters.

Identified risks in the Register are categorized as follows:

• Financial risks — related to capital structure, market volatility, liquidity, credit risks, and fluctuations in foreign exchange and interest rates;

The Risk and Internal Control Management Department conducts regular monitoring of changes in key risks and oversees the implementation of measures aimed at their mitigation. The results of this monitoring are reflected in risk and internal control management reports, which are submitted quarterly for review by the Company’s Board of Directors.

To ensure preventive risk management measures, the following emerging risks have been identified. These risks are not yet reflected on the risk map, but may be included in the future.

Currently, there is a growing focus on cyber risks, which are considered among the most significant global risks for the financial sector and the economy as a whole. The information and communication technology (ICT) risks faced by enterprises are steadily increasing in both the frequency and severity of cyberattacks. Data breaches aimed at stealing personal information occur daily across the world, although only the largest incidents make media headlines.

In the context of an unpredictable business environment where we face new challenges and high volatility, we recognise the need to continuously improve our risk management model and internal controls. We have clearly defined our objectives and direction based on fundamental concepts and standards. We are active to implement improvements and recognise where we are going and how to achieve our risk management and internal controls objectives.