Company: KARO
Filing Date: 2025-06-09
Form Type: 20-F
Source: 0001213900-25-052372
Chunk: 178

Company: Karooooo Ltd.
Filing Date: 2025-06-09
Form: 20-F
Item: Item 16K
Chunk 178
---
Item 16K. CYBERSECURITY

Risk Management and Strategy

While the Board has delegated
risk management responsibilities to the Audit and Risk Committee, the Board remains ultimately responsible for the governance of risk,
including cybersecurity risk. The enterprise risk management framework defines Karooooo’s risk management philosophy and encourages
a risk-conscious business culture through agreed internal controls and commitment to mitigating actions. Karooooo’s risk management
framework implements a bottom-up and top-down approach and has been reviewed to specifically consider the governance of risk to support
the achievement of strategic objectives, including compliance and performance- related matters.

The risk management framework
ensures an effective system of risk identification, analysis, evaluation and treatment throughout the Group. Major risk categories have
been identified as financial risk, operational risk, business risk, legal and regulatory risk and information technology risk. A dashboard
of significant risks is compiled through the internal risk function from risks identified by business. Individual risk ratings are determined
by the probability and impact of each risk.

Appropriate risk response planning
is ascribed to each risk and mitigating actions are monitored. This report is regularly reviewed and interrogated by the Audit and Risk
Committee.

A system of internal controls,
designed to protect value and enable business growth in a sustainable manner, encompasses financial, operational, compliance and sustainability
issues. This system includes a documented organisational structure and division of responsibility, clarity of accountability, established
policies and procedures which are communicated throughout the Group, and the careful selection, training and development of people.

The internal audit function has
been outsourced to BDO. An annual internal audit plan, containing a programme of financial and operational audits and reviews for the
Group, including information technology, is agreed with the Audit and Risk Committee. This plan is developed by applying a risk-based
approach and is reviewed and ultimately approved by the Board on recommendation of the Audit and Risk Committee. It is regularly revised
to ensure that it remains relevant to the key business priorities and changing risk environment.

Information Technology (IT) Governance

In view of its importance as
a key driver of Karooooo’s strategy and value proposition, the governance of IT, including the identification and management of
risks, is managed through a separate management structure, the IT Steering Committee, that reports to the Audit and Risk Committee. Governance
is achieved through the adoption and implementation of appropriate policies and procedures and the management and monitoring of compliance.

The IT Steering Committee is
responsible for the effective supply and use of