Development and periodic update of the key areas for the Internal Control System (ICS), in line with the Company’s needs and stakeholder requirements
5.9. Risk management and internal controls
The CRMS and IC is aimed at ensuring reasonable confidence in the achievement of the goals set before Kazakhtelecom JSC by the management body.
Kazakhtelecom JSC — the largest communications operator in Kazakhstan — plays an important role in the development of telecommunications infrastructure and ensuring the security of communications in the country. The Company actively introduces modern technologies and strives to strengthen the cybersecurity of its networks in order to protect the information of its clients and to ensure the uninterrupted functioning of communications services. This is ensured, among other things, by the functioning at Kazakhtelecom JSC of the corporate risk management and internal control system (CRMS and IC), aimed at the protection of assets, the improvement of business processes, the enhancement of the effectiveness of activities and compliance with the regulatory acts of applicable legislation.
The timely identification of non-conformities and sources of inefficiency, the analysis and forecasting of various scenarios of development of events, the development of measures on the timely prevention or reduction of the influence of risks make a substantial contribution to the achievement of the operational and strategic goals of the Company.
5.9.1. Model of the risk management and internal control system
The model of the CRMS and IC involves all levels of corporate governance in the identification of risks, their management and the control of non-conformities and includes the building of components of the CRMS and IC at the strategic and tactical levels of management, as well as ensuring independent assessment and supervision of its functioning.
One of the key elements of this model is the determination and application of the risk appetite, the main principles of which are set forth in the Methodology of calculation and cascading of risk appetite of Kazakhtelecom JSC, approved by the Board of Directors on 13.01.2020 (Protocol No. 1).
Aspects that should be taken into account upon the determination and application of risk appetite:
- The Company’s risk appetite shall correspond to the vision of shareholders and the expectations of stakeholders (for example, key clients, suppliers, the Government, banks, rating agencies and others);
- The risk appetite is determined with account for the key strategic and operational goals of the company. The risk appetite shall represent clear guiding principles for decision-making, however shall not contain detailed instructions or replace key performance indicators.
Formation of the risk appetite
The risk appetite (the risk appetite statement) is formed by the Risk subdivision with account for the Company’s own holding capacity in respect of investment, financial and operational activities in the context of the creation, preservation and realisation of the value of the Company’s assets. The parameters and indicators of the risk appetite may be revised by the Board of Directors of the Company, including on the recommendation of the Risk subdivision.
Main principles of clear and effective determination of the risk appetite:
Simplicity
use of simple expressions understandable for a wide circle of persons, without specific terms.
Practicality
emphasis on key aspects of the Company’s activities and its main risks.
Connection with strategy
determination of the desired approach to risk related to the achievement of the corresponding strategic goals of the Company and the protection of its main values.
Account of opportunities
to take into account not only negative risks and their consequences, but also opportunities for the Company.
Measurability
inclusion of indicators and threshold values for the measurability of risk and the prevention of violations.
Main tasks aimed at achieving the goals of the Internal Control System
Assessment of business process risks, and the design, implementation and execution of control procedures, including a unified methodological framework for the organization and effective operation of the ICS in the Company and its subsidiaries
Identification of gaps in existing control procedures, development and implementation of corrective actions, as well as standardization and formalization of control procedures
Development and implementation of interaction and information-sharing mechanisms on internal control among the subjects of the risk management and internal control system, to build a preventive system for identifying operational risks, including through the use of information systems
Within the framework of the above-mentioned tasks, the Company conducts work on the identification of risks of business processes, the development and introduction of control procedures, as well as the timely revision of their relevance, which contributes to the enhancement of the efficiency and manageability of business processes, ensuring the reliability of financial statements, compliance with the requirements of legislation and local regulatory documents of the Company.
The organizational structure of the CRMS and IC of the Company is represented at several levels and includes the following participants of the risk management process:
The Company is aware that effective risk management is achieved only when every employee is involved in the process. Therefore, we continuously develop a risk-oriented culture, the key aspects of which are:
“Tone at the Top”
The Company’s management sets an example for employees in discussing, identifying and assessing risks, and actively participates in risk management. The risk management culture is shaped by a strong ERM framework, where the “tone at the top” is complemented by the “tone at the bottom”.
Toolkit
All organizations have a structure and tools in place to identify and manage risks.
- The tools are developed with users’ needs in mind. They should be properly calibrated, focused on material threats, and useful for decision-making.
Cultural Spectrum
The cultural spectrum is shaped by behavioural norms and habits developed over many years.
- The Company supports learning and development, promotes psychological safety, strengthens a constructive and non-punitive approach, and celebrates success.
- Timely reporting of risk-related information is encouraged. Risk-taking is acceptable where risks are not critical and may contribute to business development. Risks are viewed not only as potential negative events, but also as opportunities to improve the Company’s processes.
Engagement
Employees receive training on risk management, accessible methodological materials are developed, and communication and support channels are in place.
5.9.2. Internal control system
At the Company, regulatory documents regulating the order and principles of functioning of the internal control system, including the Policy of the internal control system and the Rules of management of the internal control system, are developed and are updated on a periodic basis. In the updated documentation, the following are determined:
- goals and principles of construction of the internal control system;
- distribution of functions of subjects of internal control;
- main steps and procedures of the process of internal control, responsible persons and periods of their fulfilment (functioning, improvement and diagnostics);
- order of updating of the description of business processes of the internal control system;
- conducting of diagnostics (assessment of effectiveness) of the internal control system and the order of preparation and provision of reporting on the state of the internal control system, including identified deficiencies of the internal control system over the process of preparation of financial statements;
- conducting of an independent assessment of the internal control system over the process of preparation of financial statements and individual components thereof by the internal audit of the organization.
These regulatory documents provide for the order of interaction between subdivisions within the framework of the system of internal controls, including the order of escalation upon identification of violations and deficiencies, as well as a consistent algorithm of actions for the improvement of the control environment.
At Kazakhtelecom JSC, the system of internal control over the process of preparation of financial statements has been formalised. The main stages of construction and maintenance of an effective system of internal control over the process of preparation of financial statements at the Company are:
- description of material business processes of preparation of financial statements;
- identification and assessment of risks at the level of business processes (affecting the reliability of reporting), as well as differentiation of responsibility for the management of these risks;
- description, assessment and introduction of control procedures aimed at the reduction of risks at the level of business processes;
- description, assessment and introduction of control procedures of the corporate level, as well as differentiation of responsibility for their fulfilment;
- description, assessment and introduction of general IT controls, as well as differentiation of responsibility for their fulfilment.
- timely communication of information to interested persons.
At the Company, a process of regular monitoring of the effectiveness of control procedures has been introduced, including both their testing and assessment. The ICS is aimed at the comprehensive analysis of business processes, the timely identification and assessment of risks of process level inherent in the Company’s activities, as well as the determination, assessment and maintenance of effective control procedures ensuring effective management of these risks.
5.9.3. Integration of risk management with the Company’s cross-functional processes
Interrelation of risk management with strategic planning, budgeting, the implementation of investment projects and products and other processes:
Strategic Planning
When developing strategic plans, risks affecting the achievement of strategic goals are identified and analyzed.
Budgeting
Risks related to the failure to achieve key financial KPIs are analyzed and taken into account.
Investment Planning
of Projects and Products
Project and product risks related to the failure to achieve NPV and other indicators are analyzed and taken into account, followed by the development of risk mitigation measures.
Training
Training programs are regularly conducted for employees involved in risk management to improve their qualifications. The training course “Risk Management and Internal Controls” is available to all Company employees. In addition, in 2025, training was organized for the risk coordinators of the Company’s branches.
5.9.4. ICS management in 2025
The ICS is oriented to the integrated study of business processes, the prompt identification and assessment of risks of process level characteristic of the Company’s activities, as well as to the determination, analysis and maintenance of effective control procedures ensuring the management of the indicated risks.
At the Company, a calendar plan-schedule of works on the ICS is annually approved, formed with account for the criticality of business processes and the recommendations of external and internal auditors. In this plan, the periods of conducting verifications, assessments of maturity of business processes, as well as analysis of the effectiveness of design of control procedures are determined.
Formalisation of the system includes the development and regular updating of block diagrams of business processes, matrices of risks and controls, reflecting the current logic of processes and the built-in mechanisms of control.
Based on the results of verifications, assessments of maturity and analysis of the effectiveness of the design of controls, recommendations on the improvement of business processes are formed, and areas for further improvement are also determined. The results of the fulfilment of work on the ICS are submitted on a regular basis to business process owners, the IAS, external auditors, the Management Board and the Board of Directors.
5.9.5. Risk management in 2025
The corporate risk management system identifies and assesses risks, forming an integral risk profile of the Company. In accordance with international standards and practices, the Company annually conducts identification of risks.
The results of identification are reflected in the Register and Risk Map approved by the Board of Directors, including risks capable of affecting the achievement of long-term strategic goals and key indicators of the Development Plan.
The construction of the risk map provides the possibility to:
- determine the list of key risks and to develop plans of measures for their effective management;
- establish the priority of risks and to organise the optimal distribution of financial resources.
Environmental/climate risk factors
In the Company’s Register, the “Environmental/climate risk” is fixed, including the following factors:
- Low quality of fuel, malfunction of vehicles and boiler houses.
- Non-compliance with the requirements of legislation in the area of environmental protection and sanitary norms, insufficient awareness of the company’s employees.
- Violation of the requirements on the handling of waste and wastewater.
- Absence of a separate structural subdivision responsible for environmental issues.
- Accumulation of mercury-containing lamps, automobile tyres and other materials that are not disposed of.
- Insufficient financing for carrying out disposal;
- Absence of training of employees on environmental issues.
The identified risks are systematized in the Risk Register by the following categories:
- strategic risks — the risk of losses arising as a result of changes or errors (deficiencies) in the determination and implementation of the strategy of activities and development, changes in the political environment, regional conjuncture, sectoral recession, new products that should or should not be engaged in, investments in capital expenditures, M&A activity and other external factors of a systemic nature;
- financial risks — include risks related to the structure of capital and the reduction of financial profitability. Financial risks include market risks (fluctuations of interest and exchange rates, fluctuations of prices of natural resources and securities), liquidity risks, credit risks (on corporate counterparties, individuals, second-tier banks and on claims in other countries);
- legal risks — risks of occurrence of losses as a result of non-compliance with the requirements of the legislation of the Republic of Kazakhstan, in relations with non-residents of the Republic of Kazakhstan — the legislation of other states;
- operational risks — risks of occurrence of losses as a result of deficiencies or errors in the course of carrying out internal processes, errors made by employees (including personnel risks), the functioning of information systems and technologies (technological risks), industrial safety, as well as as a result of external events.
In the corporate register, 8 strategic risks have been registered, 6 of which are in the key zone:
- Growth of churn;
- Reduction of the share of the Kazakhtelecom JSC group on the market of fixed communications services;
- Project risks;
- Regulatory risk;
- Risk of loss of radio frequency spectrum;
- Risk of non-competitive ICT services.
For each of the risks of the key zone, plans of measures on risk management have been developed.
The constant development and improvement of the CRMS and IC provides the possibility for the Company to adapt promptly to changes in the external environment and internal business processes, to enhance its efficiency and contributes to the growth of shareholder value.
5.9.6. Key risks of 2025
The Department of Risk Management and Internal Controls carries out regular monitoring of changes in key risks, as well as controls the fulfilment of measures aimed at their reduction. The results of monitoring are reflected in the reporting on risk management and internal controls, which is quarterly submitted for consideration of the Board of Directors of the Company. Below are the key risks of 2025 and the measures taken by the Company for their reduction.
Table 86. Key risks and measures taken on risk reduction
Key risks
Measures taken by the Company to mitigate the risk
Reduction of the share of the Kazakhtelecom JSC group in the fixed communications services market
- Completion of the construction of optical networks in homes from the list of priority new residential developments;
- Launch of a new tariff line for the IE/SME segment;
- Timely implementation of data centre & cloud projects;
- Implementation of a Motivation Programme for sales managers based on sales level;
- Development of a loyalty programme taking into account pricing and other instruments;
- Preservation and maintenance of the quality of services provided;
- Formation of competitive tariffs and products.
Currency risk
- Maintaining the share of the US dollar in the money supply at no less than 50%;
- Placement of dollar liquidity in alternative financial instruments.
Credit risk
- Organization of work to reduce OAR;
- Organization of work to reduce OAR/DAR;
- Organization of controls to prevent growth of OAR;
- Notification of sales employees regarding the need to provide personal files.
Legal risk
- Formalisation of property rights to unregistered sections of cable conduits and land plots, extension of ownership rights to facilities with an expired term of validity;
- Development and implementation of the “Contracts” DB;
- Development of the “Enforcement Proceedings” Regulatory Documents Database;
- Creation of a simplified scheme for the payment of fine amounts under court decisions/writs of execution.
Fraud
- Conduct of prevention and suppression of violations in the area of fraud on the part of the Company’s employees;
- Conduct of inspections of structural divisions of the Central Office and branches of the Company.
IS breaches
- Implementation of the Modernization of Information Security Protection Means project;
- Conduct of measures on the awareness of the Company’s employees about IS rules and requirements.
HR risk
- Implementation throughout the year of the Comprehensive Plan of Measures for Ensuring Social Stability in the Kazakhtelecom JSC group of companies;
- Implementation throughout the year of the Production Safety Action Plan of Kazakhtelecom JSC.
Procurement procedures risk
- Training and testing of procurement participants under the programme “Procurement Procedure of Samruk-Kazyna JSC and price planning for goods in the Fund’s procurement”;
- Correct preparation of documentation, expansion of the range of suppliers, adaptation to changing rules and standardization of tender documentation.
Safekeeping of physical assets
- Provision of security and technical protection systems for the Company’s facilities;
- Implementation of the “Fire Safety” business plan.
Quality risk
- Monitoring of the deterioration/improvement of the repeat appeals indicator;
- Implementation of the “SAPA +” project aimed at improving the Wi-Fi internet connection of Kazakhtelecom JSC’s clients;
- Implementation of the “TAZARTU” project –transition of copper infrastructure to optical networks.
Project risks
- Optimization and monitoring of procurement procedures;
- Control of the elaboration of technical specifications for the purpose of correct reflection of the natural, man-made and infrastructural conditions of the territory of the facilities of the designed construction and the cost of works.
Regulatory risk
- Implementation of the Roadmap for ensuring 100% coverage of fixed-line telephone communications with SORM means;
- Implementation of a domestically produced SORM console.
RFS management risk
- Implementation of measures to preserve unused frequencies.
Risk of non-competitive ICT solutions/services
- Timely implementation of projects, launch of pilot projects. Formation of competitive tariffs and products;
- Monitoring of IT trends and the competitive environment, development of new AI products, improvement of existing products using trends (AI), implementation of an innovation activity assessment system;
- Updating of software and SDN/NFV equipment. Audit of the Service Provision Platform (resources);
- Automation of key processes, personnel training, introduction of changes to the organizational structure of the DBD.
Asset impairment
- Improvement of the EBITDA indicator;
- Strengthening of controls for approved investment projects.
5.9.7. Emerging risks and opportunities
With the aim of ensuring preventive measures on risk management, the following emerging risks have been determined.
At present, there is an increase of attention to cyber risks, which are regarded as one of the main global risks for the financial sector and the economy as a whole. The risks of information and communications technologies to which enterprises are subjected are constantly increasing both in frequency and severity of cyber attacks. Data leakages with the aim of theft of personal information in the world occur daily, but only the largest of them get into media headlines.
Nevertheless, the use of artificial intelligence (AI) also provides a wide range of positive influences:
- Automation and Optimization of processes: AI makes it possible to automate routine tasks, accelerating processes and enhancing the efficiency of work in various areas, from production to client servicing.
- Development of security technologies: AI improves security systems, allowing the detection of anomalous behaviour and the prevention of cyber attacks and other threats to data security.
The use of AI in the CRMS and IC may enhance the accuracy of identification of deviations, automate the control of processes and improve the forecasting of scenarios. These tools will help to develop preventive measures on the reduction of operational risks, to support the achievement of the strategic goals of the Company and to enhance its resilience in conditions of a rapidly changing technological environment.
Emerging risks
Internal
- Environmental/climatic risk;
- Risk of data confidentiality, including when using AI;
- Risk of dependence on international transit telecommunication routes.
External
- World interstate armed conflict;
- Scarcity of natural resources;
- Adverse consequences of artificial intelligence technologies;
- Technological threats and cybersecurity.
Measures on the management of emerging risks
Table 87. Measures on the management of emerging risks
| Emerging risks | Measures on the management of emerging risks |
|---|---|
| Environmental/climate-related risk |
Implementation of projects:
|
| Data confidentiality risk, including in the use of AI |
Implementation of the project:
|
| Risk of dependence of international transit telecommunication routes |
Implementation of the project:
|
5.9.9. Directions for the development of the CRMS and IC
In the context of an unpredictable business environment, the Company continues to improve the model of risk management and internal controls with account for new challenges and requirements. We have clearly determined our goals and direction of movement, based on fundamental concepts and standards. We are actively working on the introduction of improvements, being aware of where we are going and how we will achieve the goals set in the area of risk management and internal controls.
Based on the following components:
- Corporate governance and culture;
- Strategy and goal setting;
- Performance;
- Monitoring and change management;
- Information, communications and reporting;
- Control procedures.
5.9.8. Development of the CRMS and IC in 2025
The continuous development and improvement of the CRMS and IC makes it possible for the Company in a timely manner to respond to changes in the external environment and internal business processes, to enhance the effectiveness of its activities, as well as contributes to the increase of shareholder value of the Company.
Table 88. Main results of measures on the development of the CRMS and IC in 2025
Measures to develop the CRMS and IC
Result
Development and improvement of the RMICS methodology
- The Rules for Identification, Assessment and Monitoring of Risks of Kazakhtelecom JSC were updated;
- The Methodology for the Development, Implementation and Monitoring of the System of Key Risk Indicators of Kazakhtelecom JSC was updated.
Development and implementation of an employee training programme
- For the development of professional competencies of employees, training seminars on the topics of risk management and internal controls were improved and held;
- As part of the adaptation and onboarding process for new employees, completion of the mandatory introductory e-courses on risk management, internal controls and process management developed by the Risk Management and Internal Controls Department was ensured;
- For the purpose of enhancing the risk culture, the Risk Management and Internal Controls Department conducted training on the “Risk Management and Internal Controls Systems” for the Company’s employees.
Development of the risk assessment apparatus using economic and mathematical models and expert assessments
- Models for the quantitative assessment of individual risks have been developed;
- The Methodology for Conducting Risk Expert Review of Investment Projects has been updated.
Improvement and maintenance of ICS
- The Assurance Map of Kazakhtelecom JSC has been updated;
- For the purpose of fulfilling the norms of the Rules on Management of the Internal Control System of Kazakhtelecom JSC, the List of Material Business Processes of Kazakhtelecom JSC was approved.
