What are the material issues the company has identified?             

In its 2020 Sustainable Development Report Mediclinic identified a range of material issues, such as climate change, human rights, supply chain management, employee wellness and safety, waste and hazardous waste management. Among these, promoting information security stands out as a key material issue for Mediclinic.

Stakeholder engagement in accordance with the GRI Standards              

The Global Reporting Initiative (GRI) defines the Principle of Stakeholder Inclusiveness when identifying material issues (or a company’s most important impacts) as follows:

“The reporting organization shall identify its stakeholders, and explain how it has responded to their reasonable expectations and interests.”

Stakeholders must be consulted in the process of identifying a company’s most important impacts and their reasonable expectations and interests must be taken into account. This is an important cornerstone for CSR / sustainability reporting done responsibly.

Key stakeholder groups Mediclinic engages with:

To identify and prioritise material topics Mediclinic engaged with its stakeholders through the following channels: 

Stakeholder Group	Method of engagement
Clients	·      Press Ganey® patient experience index surveys ·      Disclosure of clinical performance results ·      Systematic patient rounds during hospital stay ·      24-hour helplines ·      Health awareness days ·      Brochures and magazines ·      Websites and blogs offering health-related information ·       Social media ·      Client alliance programmes
Communities	·      Corporate social responsibility (‘CSR’) initiatives ·      Supporting employee volunteer initiatives ·      Participation at national level in health training and education ·      Public-private initiatives and joint ventures at Hirslanden, Mediclinic Southern Africa and Mediclinic Middle East ·      Participation in the Public Health Enhancement Fund (‘PHEF’) in South Africa
Employees and potential applicants	·      Annual Gallup® employee engagement surveys ·      Training and development ·      Growth opportunities ·      Intranet and social media ·      Newsflashes and regular electronic updates ·      Performance reviews and formal recognition ·      Leadership video conferences and roadshows ·      Employee wellness programmes ·      Magazines and newsletters ·      Non-executive director for workforce engagement
Governments and authorities	·      Regular meetings ·      Participation in conferences and seminars ·      Representation on industry bodies and government boards ·      Participation in PPPs to enable healthcare, training and research
Healthcare insurers	·      Regular meetings regarding possible cost savings, clinical quality and healthcare delivery improvements ·      Annual tariff negotiations in a fair and transparent manner
Industry associations	·      Membership of industry associations and representation on governing bodies ·      Participation in research commissioned by associations ·      Participation in conferences
Industry partners	·      Direct engagement based on industry knowledge and market reputations ·      Cooperation and PPPs ·      Introductions through advisors ·      Industry conferences and events
Investors	·      Investor Relations department ·      Shareholder annual general meetings ·      Financial results reporting and presentations ·      Investor meetings, roadshows and conferences ·      Operational site visits ·      Stock exchange announcements ·      Sell-side analyst and salesforce meetings ·      Corporate website
Media	·      Media releases ·      Press conferences ·      Financial results reporting and presentations ·      Interviews and responses to media enquiries ·      Paid advertisements ·      Monitoring industry-related news and proactive response ·      Social media ·      The Future of Healthcare blog
Medical practitioners	·      Regular meetings ·      Participation in hospital clinical committees ·      Continuous professional education events ·      Electronic newsletters ·      Networking and know-how exchange events at Hirslanden ·      Dedicated medical practitioner portals at Hirslanden and Mediclinic Southern Africa ·      Medical practitioner participation in hospital boards ·      Biannual engagement events at Mediclinic Middle East ·      Annual Research Day at Mediclinic Middle East
Suppliers	·      Regular meetings and business reviews ·      Contract negotiations and management post-signature ·      Electronic product approval processes ·      Product demonstrations and evaluations ·      Training on product specifications ·      Attendance at trade fairs ·      Factory visits ·      Annual Modern Slavery Act due diligence questionnaire

What actions were taken by Mediclinic to promote information security?

In its 2020 Sustainable Development Report Mediclinic reports that it took the following actions for promoting information security:

• Implementing a Group InfoSec programme
• Mediclinic implements an elaborate Group InfoSec programme to optimally manage, monitor, detect and respond to InfoSec. The Group InfoSec Committee is represented by all divisions through dedicated Divisional Information Security Officers, while the proceedings of this committee are governed and informed through information security best practices sourced from several internationally acclaimed information and cyber security institutions. The Group InfoSec programme is based on the following guiding principles:
  • Adopting a risk-based approach towards cyber threats, which considers the likelihood of any risk materialising as well as its potential impact and measures for prevention and detection.
  • Expanding responsibility for cyber security beyond ICT to the whole organisation.
  • Ensuring end-to-end security across business processes, for mobile workers and teams as well as for data flows across geographic borders.
  • Implementing cyber-security-by-design, i.e. provision for effective protection against cyber threats from the outset when ICT capabilities are acquired or developed.

• Promoting data privacy
• Mediclinic reaffirmed its commitment to protecting the personal data of its stakeholders by embarking on an extensive Group-wide data privacy project to align and ensure compliance with all relevant data protection legislation, as may be applicable in the various countries of operation, including the EU’s General Data Protection Regulation (‘GDPR’), widely regarded as the gold standard for data protection. The Group Privacy and Data Protection Policy has been reviewed to ensure alignment to the GDPR standards and various initiatives are underway to ensure that core components are compliant with the GDPR framework. The project has been rolled out to the entire Group to ensure that other applicable data protection legislation is also complied with, or where no such specific legislations exist (i.e. Namibia), GDPR standards are complied with as a minimum.

Which GRI Standards and corresponding Sustainable Development Goals (SDGs) have been addressed?

The GRI Standard addressed in this case is: Disclosure 418-1 Substantiated complaints concerning breaches of customer privacy and losses of customer data

Disclosure 418-1 Substantiated complaints concerning breaches of customer privacy and losses of customer data corresponds to:

• Sustainable Development Goal (SDG) 16: Peace, Justice and Strong Institutions
• Targets: 16.3, 16.10

 

78% of the world’s 250 largest companies report in accordance with the GRI Standards

SustainCase was primarily created to demonstrate, through case studies, the importance of dealing with a company’s most important impacts in a structured way, with use of the GRI Standards. To show how today’s best-run companies are achieving economic, social and environmental success – and how you can too.

Research by well-recognised institutions is clearly proving that responsible companies can look to the future with optimism.

7 GRI sustainability disclosures get you started

Any size business can start taking sustainability action

GRI, ISEP, CPD Certified Sustainability courses (2-5 days): Live Online or Classroom  (venue: London School of Economics)

• Exclusive FBRH template to begin reporting from day one
• Identify your most important impacts on the Environment, Economy and People
• Formulate in group exercises your plan for action. Begin taking solid, focused, all-round sustainability action ASAP. 
• Benchmarking methodology to set you on a path of continuous improvement

See upcoming training dates.
References:

1) This case study is based on published information by Mediclinic, located at the link below. For the sake of readability, we did not use brackets or ellipses. However, we made sure that the extra or missing words did not change the report’s meaning. If you would like to quote these written sources from the original, please revert to the original on the Global Reporting Initiative’s Sustainability Disclosure Database at the link:

http://database.globalreporting.org/

2) https://www.globalreporting.org/standards/gri-standards-download-center/

Note to Mediclinic: With each case study we send out an email requesting a comment on this case study. If you have not received such an email please contact us.

What are the material issues the company has identified?

In its 2019 Sustainability Report Alperia identified a range of material issues, such as security of supply, innovation, research and development, health and safety at work, asset integrity, energy consumption. Among these, promoting cybersecurity stands out as a key material issue for Alperia.

Stakeholder engagement in accordance with the GRI Standards              

The Global Reporting Initiative (GRI) defines the Principle of Stakeholder Inclusiveness when identifying material issues (or a company’s most important impacts) as follows:

“The reporting organization shall identify its stakeholders, and explain how it has responded to their reasonable expectations and interests.”

Stakeholders must be consulted in the process of identifying a company’s most important impacts and their reasonable expectations and interests must be taken into account. This is an important cornerstone for CSR / sustainability reporting done responsibly.

Key stakeholder groups Alperia engages with:

Stakeholder Group

Customers

Workforce

Suppliers

Owners and Investors

Interest groups

Citizens

Research institutes

Community

How stakeholder engagement was made to identify material issues

To identify and prioritise material topics Alperia engaged with its stakeholders though an anonymous online survey which 176 participants answered.

What actions were taken by Alperia to promote cybersecurity?

In its 2019 Sustainability Report Alperia reports that it took the following actions for promoting cybersecurity:

• Introducing new and better performing management systems
• In 2019, Alperia introduced new and better performing management systems both inside and outside the Alperia world, also including Artificial Intelligence (AI) platforms. Attacks are becoming more frequent and high risk. Most are perpetrated by extremely sophisticated AI software, which is why it is necessary to use the same language in defence. In 2019, Alperia did not suffer from any significant cybersecurity incidents, but is aware of how important it is to protect yourself with increasingly sophisticated barrier systems. This is why Alperia introduced a double layer antivirus system for email and all the documents are classified according to a specific confidentiality level (public, restricted, confidential). Updating activities continue with trials of the disaster recovery plan and adoption of protection systems against ransomware threats.

• Renewing the ISO 27001 certification
• In 2019, Alperia renewed its ISO 27001 certification, which was extended to include even more stringent checking. This international standard recognises the group’s adoption of a secure system for the management of company information systems (IT and documentary), to monitor and reduce management costs, ensure adequate service levels and monitor and reduce the risk of possible outages. The certification is subject to an annual audit, with additional checks carried out by the group’s Internal Audit. During 2019, Alperia’s business continuity plan was also developed to be activated in the event of attacks. In compliance with the requirements of Europe’s GDPR regulation, a Data Protection Officer (DPO) was appointed external to the IT department. A new privacy-by-design procedure was developed, to be carried out at the start of each new project in order to check if it meets the standards set by privacy and GDPR legislation.

Which GRI Standards and corresponding Sustainable Development Goals (SDGs) have been addressed?

The GRI Standard addressed in this case is: Disclosure 418-1 Substantiated complaints concerning breaches of customer privacy and losses of customer data

Disclosure 418-1 Substantiated complaints concerning breaches of customer privacy and losses of customer data corresponds to:

• Sustainable Development Goal (SDG) 16: Peace, Justice and Strong Institutions
• Targets: 16.3, 16.10

 

78% of the world’s 250 largest companies report in accordance with the GRI Standards

SustainCase was primarily created to demonstrate, through case studies, the importance of dealing with a company’s most important impacts in a structured way, with use of the GRI Standards. To show how today’s best-run companies are achieving economic, social and environmental success – and how you can too.

Research by well-recognised institutions is clearly proving that responsible companies can look to the future with optimism.

7 GRI sustainability disclosures get you started

Any size business can start taking sustainability action

GRI, ISEP, CPD Certified Sustainability courses (2-5 days): Live Online or Classroom  (venue: London School of Economics)

• Exclusive FBRH template to begin reporting from day one
• Identify your most important impacts on the Environment, Economy and People
• Formulate in group exercises your plan for action. Begin taking solid, focused, all-round sustainability action ASAP. 
• Benchmarking methodology to set you on a path of continuous improvement

See upcoming training dates.
References:

1) This case study is based on published information by Alperia, located at the link below. For the sake of readability, we did not use brackets or ellipses. However, we made sure that the extra or missing words did not change the report’s meaning. If you would like to quote these written sources from the original, please revert to the original on the Global Reporting Initiative’s Sustainability Disclosure Database at the link:

http://database.globalreporting.org/

2) https://www.globalreporting.org/standards/gri-standards-download-center/

Note to Alperia: With each case study we send out an email requesting a comment on this case study. If you have not received such an email please contact us.

What are the material issues the company has identified?

In its 2019 Corporate Sustainability Report Sempra Energy identified a range of material issues, such as reliability, affordability, greenhouse gas emissions, public safety, disaster preparedness and response. Among these, promoting cybersecurity stands out as a key material issue for Sempra Energy.

Stakeholder engagement in accordance with the GRI Standards              

The Global Reporting Initiative (GRI) defines the Principle of Stakeholder Inclusiveness when identifying material issues (or a company’s most important impacts) as follows:

“The reporting organization shall identify its stakeholders, and explain how it has responded to their reasonable expectations and interests.”

Stakeholders must be consulted in the process of identifying a company’s most important impacts and their reasonable expectations and interests must be taken into account. This is an important cornerstone for CSR / sustainability reporting done responsibly.

Key stakeholder groups Sempra Energy engages with:

Stakeholder Group	Method of engagement
Customers	·      In-person meetings or phone calls ·      Open houses, town hall meetings ·      Ethics & compliance helpline ·      Website content ·      Surveys ·      Print or social media
Communities	·      In-person meetings or phone calls ·      Open houses, town hall meetings ·      Ethics & compliance helpline ·      Website content ·      Corporate sustainability report ·      Facility tours ·      Surveys ·      Print or social media
Employees	·      In-person meetings or phone calls ·      Open houses, town hall meetings ·      Ethics & compliance helpline ·      Website content ·      Corporate sustainability report ·      Facility tours ·      Surveys ·      Print or social media
Investors and shareholders	·      In-person meetings or phone calls ·      Open houses, town hall meetings ·      Ethics & compliance helpline ·      Website content ·      Corporate sustainability report ·      Facility tours ·      Print or social media
Regulators, elected officials, community leaders	·      In-person meetings or phone calls ·      Open houses, town hall meetings ·      Ethics & compliance helpline ·      Website content ·      Corporate sustainability report ·      Facility tours ·      Print or social media
Suppliers, contractors, business partners	·      In-person meetings or phone calls ·      Open houses, town hall meetings ·      Ethics & compliance helpline ·      Website content ·      Corporate sustainability report ·      Facility tours ·      Print or social media

How stakeholder engagement was made to identify material issues

To identify and prioritise material topics Sempra Energy interviewed stakeholders to gain their perspectives on current and emerging priorities.

What actions were taken by Sempra Energy to promote cybersecurity?

In its 2019 Corporate Sustainability Report Sempra Energy reports that it took the following actions for promoting cybersecurity:

• Establishing an information security team
• Sempra Energy’s information security team conducts regular penetration tests and analyses the results to improve existing controls and identify opportunities for improvement. Members of this team also participate in department staff meetings, safety stand downs and safety congresses to provide perspective and training on cybersecurity issues. Individual employees across the company support these efforts as “cybersecurity champions,” sharing relevant information with their teams.

• Implementing an information security awareness programme
• Sempra Energy’s information security awareness programme includes periodic communications, companywide events and campaigns, mandatory annual web-based training, facility-specific town hall events and a cross-business advocacy programme. Sempra Energy supports these efforts with articles, webpage communications and digital signage.

• Using an automated SPAM reporting button
• An automated SPAM reporting button in Microsoft Outlook allows easy one-click reporting of suspicious and unwanted emails. In fact, to keep this reporting option top-of-mind, Sempra Energy’s cybersecurity team utilises “fake” phishing attempts and sends congratulatory messages when employees take the correct action by clicking the SPAM button. Sempra’s 24/7 Information Security Operations Centre (SOC) also responds to reports of suspicious email. The SOC can pull a suspicious email from the enterprise, reducing the risk of infecting other users or devices.

Which GRI Standards and corresponding Sustainable Development Goals (SDGs) have been addressed?

The GRI Standard addressed in this case is: Disclosure 418-1 Substantiated complaints concerning breaches of customer privacy and losses of customer data

Disclosure 418-1 Substantiated complaints concerning breaches of customer privacy and losses of customer data corresponds to:

• Sustainable Development Goal (SDG) 16: Peace, Justice and Strong Institutions
• Targets: 16.3, 16.10

 

78% of the world’s 250 largest companies report in accordance with the GRI Standards

SustainCase was primarily created to demonstrate, through case studies, the importance of dealing with a company’s most important impacts in a structured way, with use of the GRI Standards. To show how today’s best-run companies are achieving economic, social and environmental success – and how you can too.

Research by well-recognised institutions is clearly proving that responsible companies can look to the future with optimism.

7 GRI sustainability disclosures get you started

Any size business can start taking sustainability action

GRI, ISEP, CPD Certified Sustainability courses (2-5 days): Live Online or Classroom  (venue: London School of Economics)

• Exclusive FBRH template to begin reporting from day one
• Identify your most important impacts on the Environment, Economy and People
• Formulate in group exercises your plan for action. Begin taking solid, focused, all-round sustainability action ASAP. 
• Benchmarking methodology to set you on a path of continuous improvement

See upcoming training dates.
References:

1) This case study is based on published information by Sempra Energy, located at the link below. For the sake of readability, we did not use brackets or ellipses. However, we made sure that the extra or missing words did not change the report’s meaning. If you would like to quote these written sources from the original, please revert to the original on the Global Reporting Initiative’s Sustainability Disclosure Database at the link:

http://database.globalreporting.org/

2) https://www.globalreporting.org/standards/gri-standards-download-center/

Note to Sempra Energy: With each case study we send out an email requesting a comment on this case study. If you have not received such an email please contact us.

What are the material issues the company has identified?

In its 2019 Corporate Sustainability and ESG Supplementary Report Investec identified a range of material issues, such as gender, diversity and transformation, auditor independence, improving and sustainable returns, impact of the political and economic environment. Among these, promoting information security stands out as a key material issue for Investec.

Stakeholder engagement in accordance with the GRI Standards

The Global Reporting Initiative (GRI) defines the Principle of Stakeholder Inclusiveness when identifying material issues (or a company’s most important impacts) as follows:

“The reporting organization shall identify its stakeholders, and explain how it has responded to their reasonable expectations and interests.”

Stakeholders must be consulted in the process of identifying a company’s most important impacts and their reasonable expectations and interests must be taken into account. This is an important cornerstone for CSR / sustainability reporting done responsibly.

Key stakeholder groups Investec engages with:

To identify and prioritise material topics Investec engaged with its stakeholders through the following channels:

Stakeholder Group	Method of engagement
Employees	·      Quarterly magazine ·      Staff updates hosted by executive management ·      Group and subsidiary fact sheets ·      Tailored internal investor relations presentations ·      Induction training for new employees ·      Regular staff communications ·      Dedicated comprehensive intranet ·      Senior management engagement breakfasts
Investors and shareholders	·      Annual general meeting ·      Four investor presentations ·      Stock exchange announcements ·      Comprehensive investor relations website ·      Shareholder roadshows and presentations ·      Regular meetings with investor relations team and executive management ·      Annual meeting with investor relations, group company secretarial, the chairman of the board, senior independent director and chairman of the remuneration committee ·      Regular email and telephone communication ·      Annual and interim reports
Clients	·      Client relationship managers in each business ·      Regular face-to-face, telephone and email communications ·      Meetings with senior management ·      Comprehensive website and app ·      Industry relevant events ·      Client marketing events
Rating agencies	·      Meetings with investor relations team, group risk management and executive management ·      Tailored rating agency booklet ·      Tailored presentations ·      Regular email and telephone communications ·      Annual and interim reports ·      Four investor presentations ·      Comprehensive investor relations website
Government and regulatory bodies	·      Active participation in a number of policy forums ·      Response and engagement with all relevant bodies on regulatory matters ·      Consulted with industry bodies
Equity and debt analysts	·      Four investor presentations ·      Stock exchange announcements ·      Comprehensive investor relations website ·      Regular meetings with investor relations and executive management ·      Regular email and telephone communications ·      Annual and interim reports
Media	·      Regular email and telephone communications ·      Stock exchange announcements ·      Comprehensive website ·      Meetings with executive management, economists and industry spokespersons ·      Dedicated third party public relations teams
Suppliers	·      Centralised negotiation process ·      Ad hoc procurement questionnaires requesting information on suppliers’ environmental, social and ethical policies

What actions were taken by Investec to promote information security?

In its 2019 Corporate Sustainability and ESG Supplementary Report Investec reports that it took the following actions for promoting information security:

• Providing information security training
• During the reporting year Investec ran a modular computer based training (CBT) information security awareness campaign, aimed to educate staff about the threats to Investec’s information, give them insight into the potential risks of data compromise, and to arm them with the knowledge they need to safeguard Investec’s (and their) data. A total of 81% of staff completed the training during the year. The campaign covered a broad range of topics consisting of the following modules:
  • Module 1 – Data protection: The different classifications of information, the importance of protecting it, and how to securely handle the information you access in your role
  • Module 2 – Cybersecurity: The threats you may face when you are online, the dangers of tricks and techniques used by cyber criminals, and how to guard against these
  • Module 3 – Mobile devices and social media: The risks associated with using mobile devices, the potential dangers of social media, and what you can do to keep your data and devices safe
  • Module 4 – Beyond the office: The importance of being vigilant and how to protect information when out of the office – be it at home, in public places, or while travelling
  • Module 5 – Security essentials: The fundamentals of information security, social engineering, and secure use of IT resources to safeguard both corporate and personal data.

• Promoting cybersecurity
• Investec maintains a risk-based strategy incorporating prediction, prevention, detection and response capabilities, to ensure the group is adequately protected against advanced cyber attacks. Continual monitoring provides visibility and enables proactive response to evolving cyber threats. Investec maintains active participation in the global cybersecurity industry to stay current and relevant. Targeted attack simulations by external specialists are performed, to measure and improve cyber defences. These are complemented by non-technical exercises involving the board and senior leadership to evaluate and improve cyber incident response and crisis management.

Which GRI Standards and corresponding Sustainable Development Goals (SDGs) have been addressed?

The GRI Standard addressed in this case is: Disclosure 418-1 Substantiated complaints concerning breaches of customer privacy and losses of customer data

Disclosure 418-1 Substantiated complaints concerning breaches of customer privacy and losses of customer data corresponds to:

• Sustainable Development Goal (SDG) 16: Peace, Justice and Strong Institutions
• Targets: 16.3, 16.10

 

78% of the world’s 250 largest companies report in accordance with the GRI Standards

SustainCase was primarily created to demonstrate, through case studies, the importance of dealing with a company’s most important impacts in a structured way, with use of the GRI Standards. To show how today’s best-run companies are achieving economic, social and environmental success – and how you can too.

Research by well-recognised institutions is clearly proving that responsible companies can look to the future with optimism.

7 GRI sustainability disclosures get you started

Any size business can start taking sustainability action

GRI, ISEP, CPD Certified Sustainability courses (2-5 days): Live Online or Classroom  (venue: London School of Economics)

• Exclusive FBRH template to begin reporting from day one
• Identify your most important impacts on the Environment, Economy and People
• Formulate in group exercises your plan for action. Begin taking solid, focused, all-round sustainability action ASAP. 
• Benchmarking methodology to set you on a path of continuous improvement

See upcoming training dates.
References:

1) This case study is based on published information by Investec, located at the link below. For the sake of readability, we did not use brackets or ellipses. However, we made sure that the extra or missing words did not change the report’s meaning. If you would like to quote these written sources from the original, please revert to the original on the Global Reporting Initiative’s Sustainability Disclosure Database at the link:

http://database.globalreporting.org/

2) https://www.globalreporting.org/standards/gri-standards-download-center/

Note to Investec: With each case study we send out an email requesting a comment on this case study. If you have not received such an email please contact us.

What are the material issues the company has identified?

In its 2019 Sustainability Report BCV identified a range of material issues, such as contributing to Vaud’s economic development, products and services suited to customers’ needs and expectations, retirement, compensation, and other employee benefits, diversity and equal opportunity. Among these, protecting customer privacy stands out as a key material issue for BCV.

Stakeholder engagement in accordance with the GRI Standards              

The Global Reporting Initiative (GRI) defines the Principle of Stakeholder Inclusiveness when identifying material issues (or a company’s most important impacts) as follows:

“The reporting organization shall identify its stakeholders, and explain how it has responded to their reasonable expectations and interests.”

Stakeholders must be consulted in the process of identifying a company’s most important impacts and their reasonable expectations and interests must be taken into account. This is an important cornerstone for CSR / sustainability reporting done responsibly.

Key stakeholder groups BCV engages with:

To identify and prioritise material topics BCV engaged with its stakeholders through the following channels:

Stakeholder Group	Method of engagement
Vaud Cantonal Government and Cantonal Parliament	·      Regular contact with the Vaud Cantonal Government as part of BCV’s information-exchange agreement ·      Responsiveness by the Bank towards BCV-related questions and requests that Vaud’s Cantonal Parliament submits to the Cantonal Government (e.g., motions that ask or require the government to legislate)
Employees	·      Employee engagement surveys
Customers	·      Market research and satisfaction surveys ·      Systematic analysis of customer complaints
Shareholders (apart from the Canton of Vaud)	·      Annual Shareholders’ Meeting ·      Regular meetings with professional investors
Sustainable development interest groups	·      Responding to questions, requests, and comments
Supervisory and federal authorities	·      Regular meetings with the Swiss Financial Market Supervisory Authority (FINMA) and the Swiss National Bank (SNB)
Suppliers and partners	·      Formalised processes for managing relationships with main suppliers
Cultural and sports associations	·      Responding to questions, requests, and comments ·      Numerous exchanges about sponsoring and donations

What actions were taken by BCV to protect customer privacy?

In its 2019 Sustainability Report BCV reports that it took the following actions for protecting customer privacy:

• Tackling cybercrime
• The growth of digital banking services means that cybercrime is an increasingly pressing concern, especially for a bank the size of BCV. Accordingly, BCV has assessed potential threats to its businesses, including cyberattacks and other security risks, and taken appropriate measures to protect its IT systems, data, and operations. BCV monitors these threats around the clock and because the methods used by cybercriminals are changing constantly, BCV regularly upgrades its practices and tests its capacity to withstand cyberattacks. Additionally, BCV works closely with specialised partner firms and Swiss government agencies in charge of combating cybercrime, such as the Reporting and Analysis Centre for Information Assurance (MELANI). BCV’s business continuity plans are also tested at regular intervals.

• Keeping data secure
• BCV makes sure that both customers and employees are guaranteed full confidentiality, in accordance with the law and established practices. If required to collect personal data about customers or employees, whether by law or by circumstances, BCV handles such data in compliance with data protection requirements. And whenever BCV shares data with authorised third parties, it adheres to the law and BCV’s General Conditions. Appropriate organisational and technical measures are also in place to prevent documents and records from being viewed, used, modified, or destroyed by unauthorised persons. In 2019, no legal action was taken against BCV for breach of confidentiality or customer data loss.

Which GRI Standards and corresponding Sustainable Development Goals (SDGs) have been addressed?

The GRI Standard addressed in this case is: Disclosure 418-1 Substantiated complaints concerning breaches of customer privacy and losses of customer data

Disclosure 418-1 Substantiated complaints concerning breaches of customer privacy and losses of customer data corresponds to:

• Sustainable Development Goal (SDG) 16: Peace, Justice and Strong Institutions
• Targets: 16.3, 16.10

 

78% of the world’s 250 largest companies report in accordance with the GRI Standards

SustainCase was primarily created to demonstrate, through case studies, the importance of dealing with a company’s most important impacts in a structured way, with use of the GRI Standards. To show how today’s best-run companies are achieving economic, social and environmental success – and how you can too.

Research by well-recognised institutions is clearly proving that responsible companies can look to the future with optimism.

7 GRI sustainability disclosures get you started

Any size business can start taking sustainability action

GRI, ISEP, CPD Certified Sustainability courses (2-5 days): Live Online or Classroom  (venue: London School of Economics)

• Exclusive FBRH template to begin reporting from day one
• Identify your most important impacts on the Environment, Economy and People
• Formulate in group exercises your plan for action. Begin taking solid, focused, all-round sustainability action ASAP. 
• Benchmarking methodology to set you on a path of continuous improvement

See upcoming training dates.
References:

1) This case study is based on published information by BCV, located at the link below. For the sake of readability, we did not use brackets or ellipses. However, we made sure that the extra or missing words did not change the report’s meaning. If you would like to quote these written sources from the original, please revert to the original on the Global Reporting Initiative’s Sustainability Disclosure Database at the link:

http://database.globalreporting.org/

2) https://www.globalreporting.org/standards/gri-standards-download-center/

Note to BCV: With each case study we send out an email requesting a comment on this case study. If you have not received such an email please contact us.

What are the material issues the company has identified?

In its 2019 Sustainability Report SCB identified a range of material issues, such as corporate governance and risk management, customer experience, financial inclusion, responsible lending. Among these, promoting cyber security stands out as a key material issue for SCB.

Stakeholder engagement in accordance with the GRI Standards                        

The Global Reporting Initiative (GRI) defines the Principle of Stakeholder Inclusiveness when identifying material issues (or a company’s most important impacts) as follows:

“The reporting organization shall identify its stakeholders, and explain how it has responded to their reasonable expectations and interests.”

Stakeholders must be consulted in the process of identifying a company’s most important impacts and their reasonable expectations and interests must be taken into account. This is an important cornerstone for CSR / sustainability reporting done responsibly.

Key stakeholder groups SCB engages with: 

Stakeholder Group	Method of engagement
Customers	·      Customer relationship-building activity ·      Information sessions on SCB financial products and services ·      Providing financial advice and knowledge to customers through online media, branch network and other electronic channels ·      Customer satisfaction surveys through telephone, questionnaire and electronic channels ·      Complaint and service channels through Customer Centre, Branch network and SCB Easy app
Employees	·      Meetings and online channels for policy and news announcement ·      Employee meetings, seminars and CSR activities ·      Annual performance evaluation ·      Employment engagement survey ·      Employee development programme ·      Employee recognition programme ·      Employee hotline
Shareholders	·      Annual general meeting ·      Extraordinary general meeting ·      56-1 Report ·      Annual report (Form 56-2) ·      Press release ·      Quarterly financial report ·      Investor meeting/conference ·      Investor call ·      Equity analyst meeting ·      Global roadshow event
Society and Environment	·      Projects and initiatives by SCB and the Siam Commercial Bank Foundation ·      Community and social surveys ·      Community engagement activities
Regulators	·      Assign Compliance unit to serve as SCB’s regulatory liaison ·      Attend meetings and hearings on regulatory policies and guidance from relevant authorities ·      Attend forums on regulatory compliance ·      Seek feedback and guidance on regulatory compliance ·      Offer feedback on regulations through public hearings ·      Prepare and provide support for regulatory audit

How stakeholder engagement was made to identify material issues

To identify and prioritise material topics SCB conducted in-depth interviews with selected groups of stakeholders to collect suggestions, feedback and information on economic, social and environmental material topics.

What actions were taken by SCB to promote cyber security?

In its 2019 Sustainability Report SCB reports that it took the following actions for promoting cyber security:

• Implementing an Information Security Policy
• Based on the Confidentiality-Integrity-Availability (CIA) triad, the SCB Financial Group Information Security Policy is communicated to all employees, including those in probationary periods and on temporary contracts, suppliers and consultants, from whom strict compliance is expected. The Policy also assigns the Audit Unit to perform an audit and make recommendations for further improving cyber security. SCB has adopted a proactive approach to cyber security by focusing on developing technology and processes for cyber threat detection, such as the Cybersecurity Threat Intelligent Surveillance system and machine learning technology to study the pattern of cyber-attacks, both internally and externally. This proactive approach enables SCB to assess the situation and be ready to respond and prevent potential losses. Additionally, for data storage with comparable effectiveness to on-premise storage, SCB uses Cloud Computing Technology to keep potential risk under its risk appetite level, to increase operational speed, and to lower the cost of maintaining the internal computer network and systems. Moreover, cyber security performance is regularly reported to senior management in a dashboard format. To be ready for an emergency situation and make sure that systems can be recovered back to normal service and operation in an appropriate timeframe, SCB has also established a policy and guideline for preparing an IT Contingency Plan, which is aligned with its Business Continuity Plan. This contingency plan defines processes, practices and the roles and responsibilities of the relevant business units in executing, testing, reviewing and revising the IT Contingency Plan according to the business context.

• Integrating cyber security into software development and operations
• In 2019, SCB upgraded its software development approach from DevOps to DevSecOps (Development Security Operations), whereby cyber security is integrated as part of SCB’s development and operations life cycle. This means that cyber security control measures are embedded throughout SCB’s software development life cycle to enhance the ability to create innovation and make further product and service improvements to deliver even greater speed, effectiveness, and security. Through this approach, SCB added security automation tools in the software development process to make security testing faster and more effective. The automation tools allow SCB’s software developers and system administrators to perform security testing on their own and detect any vulnerability after the software launch, receiving timely reports on potential problems.

• Building a data and cyber security culture
• In parallel with continuously investing in technology and developing cyber security systems that meet global standards, SCB is committed to building a data and cyber security culture for employees at every level. SCB uses work processes, training and internal communication to promote awareness on appropriate and secure data handling, data protection, cyber risk, and cyber threat prevention. Accordingly, SCB provides a data classification training course on its e-learning system to promote appropriate and secure data usage throughout the organisation and offers a cyber security course to senior executives which covers topics such as causes of cyber-attacks and impacts of cyber threats. Employees at all levels are also required to take the mandatory course on cyber security on the system which focuses on basic knowledge regarding data protection, on understanding the forms and impacts of cyber threats through simulation, and on how to prevent and report an incident. Throughout 2019, SCB organised “Don’t Let It Happen” activities to promote awareness on cyber threats, cyber risks, and data security protection with an emphasis on safeguarding the data of both customers and SCB and building awareness on risk behaviours that may cause damage to the business or SCB ‘s One of the highlights that attracted many participants was the “Cybersecurity Awareness Day 2019,” which featured talks by external experts regarding cyber security on topics such as knowing tricks of cyber criminals inside out, understanding data risk, and using personal information on social media.

Which GRI Standards and corresponding Sustainable Development Goals (SDGs) have been addressed?

The GRI Standard addressed in this case is: Disclosure 418-1 Substantiated complaints concerning breaches of customer privacy and losses of customer data

Disclosure 418-1 Substantiated complaints concerning breaches of customer privacy and losses of customer data corresponds to:

• Sustainable Development Goal (SDG) 16: Peace, Justice and Strong Institutions
• Targets: 16.3, 16.10

 

78% of the world’s 250 largest companies report in accordance with the GRI Standards

SustainCase was primarily created to demonstrate, through case studies, the importance of dealing with a company’s most important impacts in a structured way, with use of the GRI Standards. To show how today’s best-run companies are achieving economic, social and environmental success – and how you can too.

Research by well-recognised institutions is clearly proving that responsible companies can look to the future with optimism.

7 GRI sustainability disclosures get you started

Any size business can start taking sustainability action

GRI, ISEP, CPD Certified Sustainability courses (2-5 days): Live Online or Classroom  (venue: London School of Economics)

• Exclusive FBRH template to begin reporting from day one
• Identify your most important impacts on the Environment, Economy and People
• Formulate in group exercises your plan for action. Begin taking solid, focused, all-round sustainability action ASAP. 
• Benchmarking methodology to set you on a path of continuous improvement

See upcoming training dates.
References:

1) This case study is based on published information by SCB, located at the link below. For the sake of readability, we did not use brackets or ellipses. However, we made sure that the extra or missing words did not change the report’s meaning. If you would like to quote these written sources from the original, please revert to the original on the Global Reporting Initiative’s Sustainability Disclosure Database at the link:

http://database.globalreporting.org/

2) https://www.globalreporting.org/standards/gri-standards-download-center/

Note to SCB: With each case study we send out an email requesting a comment on this case study. If you have not received such an email please contact us.

What are the material issues the company has identified?

In its 2019 Sustainability Report MKB identified a range of material issues, such as customer satisfaction, increasing the accessibility of services, economic efficiency, professional development and training of employees. Among these, promoting information security stands out as a key material issue for MKB.

Stakeholder engagement in accordance with the GRI Standards              

The Global Reporting Initiative (GRI) defines the Principle of Stakeholder Inclusiveness when identifying material issues (or a company’s most important impacts) as follows:

“The reporting organization shall identify its stakeholders, and explain how it has responded to their reasonable expectations and interests.”

Stakeholders must be consulted in the process of identifying a company’s most important impacts and their reasonable expectations and interests must be taken into account. This is an important cornerstone for CSR / sustainability reporting done responsibly.

Key stakeholder groups MKB engages with:

Stakeholder Group	Method of engagement
Customers	·      Customer service, including development of the network of branch offices ·      Receiving queries ·      Remote banking service (mobile banking, contact centre, internet banking) ·      Information about bank products, reporting, availability of branch offices of the Bank, environmental plans and actions, and other important information as published on the MKB website (Russian or English version) ·      Analysis of customer satisfaction
Employees	·      Advanced training ·      Benefits package ·      Support and assistance in developing internal corporate sports clubs and events for the company employees ·      Participation in sports events, charitable, and other public and environmental events ·      Corporate portal ·      The hotline that allows sending complaints and queries to the members of the Audit and Risk Committee under the MKB Supervisory Board
Society	·      Participation in social and environmental projects of the Russian Government, other governmental bodies, and development of its own projects ·      Development of financial products for different categories of people ·      Support of small and medium business entities ·      Development of a regional network of offices and creation of additional jobs in the regions ·      Interaction with higher educational institutions, probation programmes, training
Shareholders and investors	·      Meetings of shareholders ·      Communication using different channels (including conference calls, meetings, correspondence via email, webcasts) ·      Disclosure of information important for shareholders and investors on the electronic page for investors (in Russian and English) ·      Publication of financial and nonfinancial reports
Counterparties and partners	·      A transparent competitive procurement system
Governmental bodies and regulators	·      Information disclosure and compliance with all legislative requirements in the field of banking activities ·      Participation in projects and work meetings on the improvement of laws in different areas (expert councils, work groups, round-table discussions, and other forms of communications) ·      Contribution to the development of regions with the extension of the regional network of presence
Mass media	·      Regular communications with the key media, prompt response to incoming questions ·      A high level of content mobility on the MKB website, in social networks, and other sources of communication

How stakeholder engagement was made to identify material issues

To identify and prioritise material topics MKB engaged with its stakeholders through an interactive survey tool.

What actions were taken by MKB to promote information security?

In its 2019 Sustainability Report MKB reports that it took the following actions for promoting information security:

• Combating fraud
• MKB pursues a zero-tolerance policy toward illegal actions against its customers. For this purpose, MKB:
  • has implemented and maintains fraud monitoring processes for remote banking;
  • investigates any attempts of stealing funds from the bank’s customers;
  • interacts with the Bank of Russia and other credit institutions, communication service providers, and law enforcement agencies for the exchange of information about the actions of fraudsters and for the timely prevention of fraudulent activities;
  • implements the programme for enhanced protection of systems and data, which is reviewed annually and updated completely every three years.
• The above activities resulted in dozens of prevented attempts of stealing funds from legal entities and individuals, which saved them dozens of million rubles. The only loss by a legal entity because of the fraudster’s actions in the remote business education system (RBES) in 2019 amounted to RUB 3,000; the transaction was marked as suspicious but was additionally confirmed by the customer itself.

• Promoting cybersecurity
• MKB pays much attention to information security and resistance to cyber threats. The following biggest threats for MKB were identified within the frames of its information security strategy:
  • External attacks as a result of actions of hacker groups, which are aimed at stealing data or money via payment systems
  • Attacks aimed at customers and stealing customers’ funds via remote banking services
  • Fraudulent actions of the bank’s employees or counterparties, which may cause data leaks or thefts using authorised access to MKB’s information systems
  • Logical attacks at ATMs (use of special software for money disbursement without using cards and for debiting accounts) and payment terminals (use of special software to reload cards without cash)
• The following projects were initiated and successfully finished for the implementation of measures to prevent the materialisation of threats:
  • Implementation of the next generation firewall as a basic element of protection against external attacks
  • Implementation of a solution to counter targeted attacks made using malicious emails or malicious websites, which use 0-day vulnerabilities and are not detected by standard means of protection, for example, antivirus software (as a result of system operation, over 650 targeted attacked were repelled)
  • Implementation and development of the personnel training system simulating sending of malicious attachments and fishing links by hackers and appointing testing automatically if an employee opens such attachments or types a password to their account on the websites available at the fishing links
  • Development and implementation of an antifraud system to identify abnormal and illegal payments sent to the Bank of Russia or to the international data transfer and payment system SWIFT

• Identifying and eliminating vulnerabilities
• To minimise the probability of merely technical vulnerabilities typical of information systems and logical vulnerabilities affecting customer service processes and products, MKB started supporting the following processes in 2019:
  • External scanning of vulnerabilities; full coverage was reached for all 179 publications of MKB’s services on the web and external networks, scanning results are recognised by auditors as performed by the Approved Scanning Vendor as part of the PCI DSS (Payment Card Industry Data Security Standard) standard conformity audits.
  • A red team was set up—that is, a group of specialists with qualifications similar to hackers, whose main task is to conduct penetration tests and identify vulnerabilities through the eyes of hackers for the purpose of thorough identification of vulnerabilities that cannot be identified instrumentally.
  • The Information Security Department participates in, and controls, all tasks of IT development, including the following:
    • Analysis of business requirements
    • Analysis of technical assignments
    • Formation of a set of requirements for the implementation of security-by-design and security-by-default concepts for all services and products developed by MKB
    • Verification of the fulfilment of requirements before bringing the implemented tasks in action
    • Participation of red team specialists for the purpose of vulnerability analysis in any services published on the web and in any payment applications
  • External penetration tests organised by the internal audit are performed by specialised companies with highly proficient specialists.

• Responding to information security incidents in a timely manner
• To monitor and provide timely response to information security incidents, MKB has a security incidents response team. In 2019, the work of this team, operating as part of the Information Security Department, resulted in the creation of the monitoring system architecture, implementation of the subsystem of collection and primary analysis of incidents, implementation of the incident response platform, and automation of the formation of any incidents as tasks for the team members in the implemented platform. The ongoing processes are built so that the time from the attack to the analysis of the processes within the attack and to the termination of the attack usually does not exceed 4 hours.

Which GRI Standards and corresponding Sustainable Development Goals (SDGs) have been addressed?

The GRI Standard addressed in this case is: Disclosure 418-1 Substantiated complaints concerning breaches of customer privacy and losses of customer data

Disclosure 418-1 Substantiated complaints concerning breaches of customer privacy and losses of customer data corresponds to:

• Sustainable Development Goal (SDG) 16: Peace, Justice and Strong Institutions
• Targets: 16.3, 16.10

 

78% of the world’s 250 largest companies report in accordance with the GRI Standards

SustainCase was primarily created to demonstrate, through case studies, the importance of dealing with a company’s most important impacts in a structured way, with use of the GRI Standards. To show how today’s best-run companies are achieving economic, social and environmental success – and how you can too.

Research by well-recognised institutions is clearly proving that responsible companies can look to the future with optimism.

7 GRI sustainability disclosures get you started

Any size business can start taking sustainability action

GRI, ISEP, CPD Certified Sustainability courses (2-5 days): Live Online or Classroom  (venue: London School of Economics)

• Exclusive FBRH template to begin reporting from day one
• Identify your most important impacts on the Environment, Economy and People
• Formulate in group exercises your plan for action. Begin taking solid, focused, all-round sustainability action ASAP. 
• Benchmarking methodology to set you on a path of continuous improvement

See upcoming training dates.
References:

1) This case study is based on published information by MKB, located at the link below. For the sake of readability, we did not use brackets or ellipses. However, we made sure that the extra or missing words did not change the report’s meaning. If you would like to quote these written sources from the original, please revert to the original on the Global Reporting Initiative’s Sustainability Disclosure Database at the link:

http://database.globalreporting.org/

2) https://www.globalreporting.org/standards/gri-standards-download-center/

Note to MKB: With each case study we send out an email requesting a comment on this case study. If you have not received such an email please contact us.

What are the material issues the company has identified?

In its 2019 Sustainability Report Bank Muscat identified a range of material issues, such as customer relationship management, employee training and development, responsible investing, Anti-Money Laundering and Anti-Financing of Terrorism (AML and AFT). Among these, promoting cybersecurity stands out as a key material issue for Bank Muscat.

Stakeholder engagement in accordance with the GRI Standards             

The Global Reporting Initiative (GRI) defines the Principle of Stakeholder Inclusiveness when identifying material issues (or a company’s most important impacts) as follows:

“The reporting organization shall identify its stakeholders, and explain how it has responded to their reasonable expectations and interests.”

Stakeholders must be consulted in the process of identifying a company’s most important impacts and their reasonable expectations and interests must be taken into account. This is an important cornerstone for CSR / sustainability reporting done responsibly.

Key stakeholder groups Bank Muscat engages with:                    

Stakeholder Group	Method of engagement
Employees	·       Annual performance reviews ·       Regular dialogue and interaction with employees ·       Training and education programmes ·       Grievance mechanism ·       Polls and survey
Customers	·       Call Centre Feedback Management System (FMS) ·       Company website ·       Focus groups ·       Customer networking events for specific customer segments ·       Branches and access points including ATMs and CDMs ·       Media and social media channels ·       Annual report and sustainability report ·       Other bank publications including investor presentations
Government (Including Regulatory Bodies)	·       Government Business Division ·       Investment in the national economy ·       Supporting initiatives of national importance
Correspondent / Other Banks / International Entities	·       Financial Institutions Group (FIG) ·       Company website and other publications ·       Roadshows and presentations
Shareholders/ Investors	·       Investor Relations Department ·       Shareholder meetings ·       Roadshows and presentations ·       Company website and other publications
Local, Regional & International Media	·       Media, social media and other publications ·       Press conferences ·       Media networking events

How stakeholder engagement was made to identify material issues

To identify and prioritise material topics Bank Muscat engaged with its stakeholders through interviews and surveys.

What actions were taken by Bank Muscat to promote cybersecurity?

In its 2019 Sustainability Report Bank Muscat reports that it took the following actions for promoting cybersecurity:

• Identifying and addressing cybersecurity risks
• Bank Muscat continuously invests in maintaining and updating the systems and processes that are designed to ensure the security of the Bank’s computer systems, software, networks and other technology assets. Bank Muscat’s information/cybersecurity risk management function focuses on the following key aspects:
  • Cybersecurity incident response plans in order to implement effective management of cybersecurity incidents
  • Information security governance through security policies, procedures, guidelines and standards
  • Information security monitoring using the latest solutions and tools, including real time as well as fixed frequency monitoring
  • Implementing a robust security defence network as well as maintaining strong internal controls
  • Information security reviews comprising new and existing technologies, solutions, networks and also the various processes/ operations within each and every department of the Bank

• Improving cybersecurity measures
• In 2019, Bank Muscat partnered with the Information Technology Authority (ITA) to improve cybersecurity measures. The Bank took part in a series of cybersecurity events organised by the ITA, including the 8th Regional Cybersecurity Summit, FIRST & International Telecommunication Union Arab Regional Cyber Security Centre (ITU-ARCC), and the 7th Regional Cyber Drill. Bank Muscat also participated in the Cybersecurity Readiness drill, held under the theme “Intelligence of Malware” and organised by the National Computer Emergency Readiness Team (OCERT) to assess cybersecurity readiness in Organisation of Islamic Cooperation (OIC) countries.

• Launching an anti-fraud public awareness campaign
• In 2019, the Royal Oman Police (ROP) and Bank Muscat launched an anti-fraud public awareness campaign. The campaign focused on educating the community not to share their personal details or their banking/card details with anyone over the phone, and not to input them on links received through social media or messaging.

Which GRI Standards and corresponding Sustainable Development Goals (SDGs) have been addressed?

The GRI Standard addressed in this case is: Disclosure 418-1 Substantiated complaints concerning breaches of customer privacy and losses of customer data

Disclosure 418-1 Substantiated complaints concerning breaches of customer privacy and losses of customer data corresponds to:

• Sustainable Development Goal (SDG) 16: Peace, Justice and Strong Institutions
• Targets: 16.3, 16.10

 

78% of the world’s 250 largest companies report in accordance with the GRI Standards

SustainCase was primarily created to demonstrate, through case studies, the importance of dealing with a company’s most important impacts in a structured way, with use of the GRI Standards. To show how today’s best-run companies are achieving economic, social and environmental success – and how you can too.

Research by well-recognised institutions is clearly proving that responsible companies can look to the future with optimism.

7 GRI sustainability disclosures get you started

Any size business can start taking sustainability action

GRI, ISEP, CPD Certified Sustainability courses (2-5 days): Live Online or Classroom  (venue: London School of Economics)

• Exclusive FBRH template to begin reporting from day one
• Identify your most important impacts on the Environment, Economy and People
• Formulate in group exercises your plan for action. Begin taking solid, focused, all-round sustainability action ASAP. 
• Benchmarking methodology to set you on a path of continuous improvement

See upcoming training dates.
References:

1) This case study is based on published information by Bank Muscat, located at the link below. For the sake of readability, we did not use brackets or ellipses. However, we made sure that the extra or missing words did not change the report’s meaning. If you would like to quote these written sources from the original, please revert to the original on the Global Reporting Initiative’s Sustainability Disclosure Database at the link:

http://database.globalreporting.org/

2) https://www.globalreporting.org/standards/gri-standards-download-center/

Note to Bank Muscat: With each case study we send out an email requesting a comment on this case study. If you have not received such an email please contact us.

What are the material issues the company has identified?

In its 2018-2020 Sustainability Report Vodafone Egypt identified a range of material issues, such as Covid-19 pandemic and crisis management, market leadership, business continuity, customer service excellence, community development. Among these, promoting data security and privacy stands out as a key material issue for Vodafone Egypt.

Stakeholder engagement in accordance with the GRI Standards             

The Global Reporting Initiative (GRI) defines the Principle of Stakeholder Inclusiveness when identifying material issues (or a company’s most important impacts) as follows:

“The reporting organization shall identify its stakeholders, and explain how it has responded to their reasonable expectations and interests.”

Stakeholders must be consulted in the process of identifying a company’s most important impacts and their reasonable expectations and interests must be taken into account. This is an important cornerstone for CSR / sustainability reporting done responsibly.

Key stakeholder groups Vodafone Egypt engages with:               

To identify and prioritise material topics Vodafone Egypt engaged with its stakeholders through the following channels:

Stakeholder Group	Method of engagement
Employees	·       Daily direct communication ·       Digital Communication ·       Workplace and Workchat ·       Annual surveys ·       Events and newsletters ·       Emails ·       Meetings ·       Social media
Consumer and enterprise customers	·       Call centres ·       Satisfaction surveys ·       Website ·       Social media ·       Sales channels and retail stores ·       My Vodafone application ·       Advertisements ·       Digital marketing
Shareholders, investors and Vodafone Group	·       Financial information disclosure ·       Annual reports ·       Quarterly updates ·       General assembly meetings ·       Website
Suppliers and partners	·       Direct communication channels ·       Suppliers events ·       Trainings and awareness campaigns ·       Evaluation and qualification
Regulator	·       Public forums ·       Meetings ·       Industry consultations ·       Financial information disclosure ·       Audits ·       Participation in public policies
Local communities	·       Vodafone Foundation’s activities ·       Employees volunteering activities ·       Community partnerships ·       Public participation ·       Social media ·       Events ·       Word of mouth
Civil society and NGOs	·       Vodafone Foundation’s activities ·       Events in universities ·       Partnerships and collaborations ·       Social media

What actions were taken by Vodafone Egypt to promote data security and privacy?

In its 2018-2020 Sustainability Report Vodafone Egypt reports that it took the following actions for promoting data security and privacy:

• Implementing the Vodafone Group GDPR Programme
• Vodafone Egypt follows and implements the Vodafone Group GDPR (General Data Protection Regulation) Programme to ensure compliance with the new European GDPR, since it is mandated by Vodafone Group even for non-European Markets that do not primarily deal with European personal data and are not directly impacted by the new regulation. This direction ensures consistency, maturity and standards for the Vodafone Privacy Programme across Vodafone’s global footprint, to meet the requirements of the changing global regulatory and reputational privacy landscape. In addition, it puts Vodafone Egypt in the leading position in the Egyptian Market, being pioneers in this field and allows Vodafone Egypt to be the first compliant telecom operator with the intended Data Protection Law that is adopting GDPR, to be released soon in Egypt. Vodafone sets the required controls for protection against transactions with a sanctioned entity in breach of the sanctions legislation, potentially resulting in reputational damage, large fines, criminal penalties for individuals, and termination of the Vodafone Group’s financing arrangements. The objective is to make sure that Vodafone Egypt has a clear and robust set of controls in place, to minimise the risk of Vodafone breaching sanctions legislation.

• Applying a Privacy Programme
• Vodafone Egypt has initiated a customised Privacy Programme to ensure compliance with GDPR and with the planned Egyptian Data Protection Law through its various domains that correspond to GDPR’s requirements. The Privacy Programme assumes 10 basic commandments, reflecting Vodafone Egypt’s obligations according to the legal and global standards:
  • Design for Privacy
  • Protect Confidentiality
  • Collect relevant data
  • Provide a Privacy Notice
  • Provide Choices
  • Manage Data Carefully
  • No unauthorised disclosure
  • Secure Data
  • Protect Children’s Privacy
  • Respect Individual Rights

• Implementing a Privacy Policy
• Vodafone Egypt’s Customer Privacy Policy concerns the handling of Data Subject’s personal information, including the collection, storage, access, use, updating, disclosure, disposal, destruction, or any other processing of such information. Gathering information from customers serves the purpose of operating Vodafone Egypt’s business and enhancing its customer experience. Vodafone Egypt’s Privacy Notice was updated in April 2020.

Which GRI Standards and corresponding Sustainable Development Goals (SDGs) have been addressed?

The GRI Standard addressed in this case is: Disclosure 418-1 Substantiated complaints concerning breaches of customer privacy and losses of customer data

Disclosure 418-1 Substantiated complaints concerning breaches of customer privacy and losses of customer data corresponds to:

• Sustainable Development Goal (SDG) 16: Peace, Justice and Strong Institutions
• Targets: 16.3, 16.10

 

78% of the world’s 250 largest companies report in accordance with the GRI Standards

SustainCase was primarily created to demonstrate, through case studies, the importance of dealing with a company’s most important impacts in a structured way, with use of the GRI Standards. To show how today’s best-run companies are achieving economic, social and environmental success – and how you can too.

Research by well-recognised institutions is clearly proving that responsible companies can look to the future with optimism.

7 GRI sustainability disclosures get you started

Any size business can start taking sustainability action

GRI, ISEP, CPD Certified Sustainability courses (2-5 days): Live Online or Classroom  (venue: London School of Economics)

• Exclusive FBRH template to begin reporting from day one
• Identify your most important impacts on the Environment, Economy and People
• Formulate in group exercises your plan for action. Begin taking solid, focused, all-round sustainability action ASAP. 
• Benchmarking methodology to set you on a path of continuous improvement

See upcoming training dates.
References:

1) This case study is based on published information by Vodafone Egypt, located at the link below. For the sake of readability, we did not use brackets or ellipses. However, we made sure that the extra or missing words did not change the report’s meaning. If you would like to quote these written sources from the original, please revert to the original on the Global Reporting Initiative’s Sustainability Disclosure Database at the link:

http://database.globalreporting.org/

2) https://www.globalreporting.org/standards/gri-standards-download-center/

Note to Vodafone Egypt: With each case study we send out an email requesting a comment on this case study. If you have not received such an email please contact us.

What are the material issues the company has identified?

In its 2020 Sustainability Report Challenger identified a range of material issues, such as long-term risk management, better customer outcomes, changing operating environment, public policy settings, economic uncertainty. Among these, promoting business integrity stands out as a key material issue for Challenger.

Stakeholder engagement in accordance with the GRI Standards             

The Global Reporting Initiative (GRI) defines the Principle of Stakeholder Inclusiveness when identifying material issues (or a company’s most important impacts) as follows:

“The reporting organization shall identify its stakeholders, and explain how it has responded to their reasonable expectations and interests.”

Stakeholders must be consulted in the process of identifying a company’s most important impacts and their reasonable expectations and interests must be taken into account. This is an important cornerstone for CSR / sustainability reporting done responsibly.

Key stakeholder groups Challenger engages with:

To identify and prioritise material topics Challenger engaged with its stakeholders through the following channels:

Stakeholder Group	Method of engagement
Customers	·       Survey ·       Call centre ·       Website and social media ·       Presentations
Shareholders	·       Regular financial reporting ·       Investor Days ·       Management meetings with investors and prospective investors ·       Chair engagement with significant investors
Employees	·       Intranet and Yammer ·       Employee briefings ·       Surveys ·       Senior leadership forums ·       ESG workshops ·       Ongoing team meetings
Government & regulators	·       Policy analysis ·       Government and industry submissions ·       Industry forums and conferences ·       Ongoing meetings
Communities	·       Strategic partnership ·       Volunteering ·       Workplace giving & matching ·       Fundraising initiatives ·       Shared research activities

What actions were taken by Challenger to promote business integrity?

In its 2020 Sustainability Report Challenger reports that it took the following actions for promoting business integrity:

• Implementing a Code of Conduct
• In February 2020 Challenger refreshed and updated its Code of Conduct. The Code sets out expectations for how Challenger acts, solves problems and makes fair and balanced decisions. It brings together Challenger’s corporate values and its group policies and statements, outlining what is expected of leaders, how consequences are managed, and where employees can go to speak up. Challenger’s Code of Conduct sits across all areas of its business and applies to everyone, irrespective of their role, seniority or any other factor, and all Challenger employees have a shared Delivering on the UN SDGs responsibility to apply it consistently.

• Applying a Political Donations policy
• Challenger has taken the approach of not making political donations and understands the importance of following best practice approaches and remaining flexible to changing community expectations. At the same time, Challenger engages actively with politicians and other government representatives to contribute to effective public policy outcomes in a way that meets the expectations of its stakeholders and supports its customers and business.

• Implementing a Privacy policy
• Challenger follows a ‘privacy-by-design’ approach, where privacy drives decision-making processes. This approach applies to every stakeholder and is used throughout Challenger’s Challenger’s Privacy policy sets out its approach for making sure it manages its customers’ information in a way that meets existing privacy regulations and customers’ expectations. Challenger has had no significant privacy complaints or breaches during the 2020 financial year and was not required to make any data breach reports to the Office of the Australian Information Commissioner under Australia’s Notifiable Data Breaches scheme during the year.

• Developing a Whistleblower policy
• Challenger is committed to demonstrating transparency and enhancing stakeholder trust. Through its whistleblower provisions, employees, contractors, former employees, suppliers, service providers and relatives are encouraged to speak up. Challenger’s Whistleblower policy outlines the process for raising concerns and the protections and support available to whistleblowers. Challenger provides an independent whistleblower service so users can easily raise concerns through multiple channels and be assured of their anonymity if they desire.

Which GRI Standards and corresponding Sustainable Development Goals (SDGs) have been addressed?

The GRI Standards addressed in this case are:

1) Disclosure 415-1 Political contributions

2) Disclosure 418-1 Substantiated complaints concerning breaches of customer privacy and losses of customer data

3) Disclosure 419-1 Non-compliance with laws and regulations in the social and economic area

 

Disclosure 415-1 Political contributions corresponds to:

• Sustainable Development Goal (SDG) 16: Peace, Justice and Strong Institutions
• Targets: 16.5

Disclosure 418-1 Substantiated complaints concerning breaches of customer privacy and losses of customer data corresponds to:

• Sustainable Development Goal (SDG) 16: Peace, Justice and Strong Institutions
• Targets: 16.3, 16.10

Disclosure 419-1 Non-compliance with laws and regulations in the social and economic area corresponds to:

• Sustainable Development Goal (SDG) 16: Peace, Justice and Strong Institutions
• Targets: 16.3

 

78% of the world’s 250 largest companies report in accordance with the GRI Standards

SustainCase was primarily created to demonstrate, through case studies, the importance of dealing with a company’s most important impacts in a structured way, with use of the GRI Standards. To show how today’s best-run companies are achieving economic, social and environmental success – and how you can too.

Research by well-recognised institutions is clearly proving that responsible companies can look to the future with optimism.

7 GRI sustainability disclosures get you started

Any size business can start taking sustainability action

GRI, ISEP, CPD Certified Sustainability courses (2-5 days): Live Online or Classroom  (venue: London School of Economics)

• Exclusive FBRH template to begin reporting from day one
• Identify your most important impacts on the Environment, Economy and People
• Formulate in group exercises your plan for action. Begin taking solid, focused, all-round sustainability action ASAP. 
• Benchmarking methodology to set you on a path of continuous improvement

See upcoming training dates.
References:

1) This case study is based on published information by Challenger, located at the link below. For the sake of readability, we did not use brackets or ellipses. However, we made sure that the extra or missing words did not change the report’s meaning. If you would like to quote these written sources from the original, please revert to the original on the Global Reporting Initiative’s Sustainability Disclosure Database at the link:

http://database.globalreporting.org/

2) https://www.globalreporting.org/standards/gri-standards-download-center/

Note to Challenger: With each case study we send out an email requesting a comment on this case study. If you have not received such an email please contact us.