HealthPlus Retail Group Business Plan › Section 12 › Risk Analysis & Mitigation

12.1 Risk Management Framework

HealthPlus operates an enterprise risk management (ERM) framework
aligned to ISO 31000 and the King IV principles on risk governance.
Risks are identified, scored on a 5×5 likelihood-impact matrix,
mitigated through documented controls, and reviewed monthly by the
executive team and quarterly by the Audit & Risk Committee. The
framework distinguishes between strategic, operational, financial,
regulatory, technology and macro risks.

12.2 Risk Heat Map

Figure 12.1 plots the twelve principal residual risks
(post-mitigation) on the standard likelihood-impact heat map. Five risks
are classified as High residual (red); seven as Medium (amber); none as
Low (green) — a deliberate framing, since material risks should never be
characterised as Low to a sophisticated investor audience.

12.3 Risk Register

The full risk register is set out below. Each risk is identified by a
unique reference (R1–R12), classified, scored on inherent and residual
basis, and assigned a named mitigation owner. The register is a living
document; this presentation reflects the position at financial
close.

Table 12.1 — Risk register summary

12.4 Principal Risks & Mitigation Strategies

12.4.1 R1 — National Health Insurance (NHI)

The NHI Act, signed in 2024, contemplates a single-payer fund
replacing private medical schemes for “comprehensive” services.
Implementation is phased over 8–12 years and subject to ongoing
constitutional and operational challenges. Net effect on retail pharmacy
is uncertain but plausibly positive (broader population access,
formulary-driven volume) if dispensing fees remain economically
viable.

12.4.2 R3 — Pharmacist Labour Supply

South Africa produces ~800 new pharmacists annually against
retail-sector demand for ~2,400 incremental positions through Y5 across
all chains. This is the single most binding operational constraint on
the rollout plan.

12.4.3 R4 — ZAR Currency Depreciation

Approximately 38% of cost of goods is USD-linked (international
beauty brands, pharmaceutical APIs, technology). A 10% ZAR depreciation
translates to ~3.8 ppt of gross margin pressure if unmitigated.

12.4.4 R5 — Load-Shedding

Eskom load-shedding has been a structural feature of South African
operations since 2008. Pharmacies face dual exposure: cold-chain
integrity (vaccines, insulin, biologics) and point-of-sale
availability.

12.4.5 R10 — Civil Unrest / Supply Chain Disruption

The July 2021 KZN/Gauteng unrest demonstrated the asymmetric impact
of civil disruption on retail. HealthPlus has architected its supply
chain explicitly to absorb this risk class.

12.5 Insurance Programme

A comprehensive corporate insurance programme is procured at
financial close, structured across six policy lines and reviewed
annually by an independent broker.

Table 12.2 — Insurance programme structure

12.6 Crisis Management & Business Continuity

A formal Business Continuity Management (BCM) framework — aligned to
ISO 22301 — is implemented in Y1 and tested via tabletop exercises
bi-annually. The framework defines recovery time objectives (RTO) for
each critical business function, named crisis-team roles, and
pre-authorised expenditure thresholds for crisis response.

Confidential — this business plan is provided to prospective investors and lenders for evaluation purposes only and may not be reproduced or distributed without the written consent of HealthPlus Retail Group (Pty) Ltd.