Sustainability Report 2020 - REA Group
←
→
Page content transcription
If your browser does not render page correctly, please read the page content below
..
..
Sustainability Report 2020
Introduction Governance Social Environment
Contents
Introduction Social
About REA Group 3 Diversity and inclusion 30
2020 highlights 4 Workplace health, safety and wellbeing 33
CEO message 5 Talent development and management 34
Materiality assessment 6 Employee Engagement 38
Bushfires in Australia 8 Customer satisfaction 42
COVID-199 Community investment 45
Governance Environment
Ethics and integrity 11 Climate change 52
Risk management 15 Sustainability working group 53
Cyber security 19 Sustainable buildings 53
Innovation 22 Global Reporting Initiative
Responsible marketing 25 FY20 content index 54
Sustainable procurement 26
Limited Assurance
Human rights and labour standards 27
Independent Limited Assurance Report 62
2 | REA Group
Introduction Governance Social Environment
About REA Group
Headquartered in REA Group operates Australia’s leading
residential and commercial property
franchise group, and Hometrack, a leading
provider of property data services.
Richmond VIC, Australia, websites realestate.com.au and REA Group also holds a significant
realcommercial.com.au. It also operates shareholding in Move Inc., which primarily
REA Group Ltd ACN the leading website dedicated to share operates Realtor.com® in the United
068 349 066 (ASX:REA) property, Flatmates.com.au, and Spacely, States, 99.co, which operates property
a short-term commercial and coworking portals 99.co, iProperty.com.sg and
is a multinational digital property website. In Asia, REA Group Rumah123.com located in Singapore and
advertising business owns a market-leading property portal Indonesia. In addition, the Group holds a
in Malaysia (iproperty.com.my) and significant interest in Elara Technologies
specialising in property prominent property portals in Hong Kong Pte Ltd, which operates Housing.com,
(squarefoot.com.hk) and Thailand Proptiger.com and makaan.com in India.
(thinkingofliving.com), as well as the
www.rea-group.com
Chinese site, myfun.com. REA Group owns
Smartline, an Australian mortgage broking
3 | REA Group
Introduction Governance Social Environment
2020 highlights
Customer satisfaction Environment
COVID-19 resulted in our teams quickly REA Group’s total quantified FY20
mobilising to deliver new product carbon footprint totalled 5,607 tonnes of
innovations to help our customers and carbon dioxide equivalent. We have set
the property industry adapt to the new science-based aligned targets to reduce
rules. This included digital inspections, our footprint by 2030. In FY21, we will
online auctions, inspection bookings and introduce a carbon emissions reduction
COVID-19 property market insights to keep action plan and offset our emissions to
the industry informed. become certified carbon neutral.
Data protection, privacy Innovation Ethics and integrity
and cyber security In May 2020, we held our first entirely We published our first Voluntary Tax
We increased investment in our Cyber virtual REAio (hackathon) due to COVID-19 Transparency report in FY20, providing
Security team with new operational, and saw great national engagement, with a a summary of taxes paid, collected and
engineering and advisory capability. product shipped that following weekend! remitted.
Diversity and inclusion Workplace health,
Of our people across Australia and Asia, safety and wellbeing
50.1% identify as female and 49.9% identify We provided our people with the option
as male. Our Executive Leadership Team to take part in a number of health and
also has 50:50 gender parity. wellbeing activities, including Month of
Mindfulness, Mental Health Awareness
Month, RU OK Day and a Resilience series.
Community investment Employee engagement
In FY20, the National Rapid Rehousing In FY20, our engagement scores in H1
Fund, established by Launch Housing and were 78% for Australia (participation 89%)
REA Group in 2015, provided financial and 79% for Asia (participation 94%). In
support to 686 women and children H2, we conducted a weekly ‘belief’ pulse
at risk of homelessness, to establish or survey over 14 weeks with an average
maintain safe, secure housing free of positive sentiment score of 92%.
violence, across Australia.
4 | REA Group
Introduction Governance Social Environment
CEO message
Welcome to our second Our people provide us with a competitive
edge, and even when faced with the
Housing, Orange Sky Australia and
The Big Issue during FY20.
Sustainability Report. challenges of FY20, we have made terrific
On the environmental front, in FY20 we
progress across the areas of Environment,
calculated REA Group’s carbon footprint.
When I reflect on the Social and Governance (ESG). New
ways of operating, combined with new
With this information, we have set
last 12 months, the products, features and support measures
science-based aligned targets to reduce
our footprint and play our part in limiting
were all successfully introduced to support
overwhelming feeling our people, customers, consumers and
global warming. We will also be offsetting
our FY20 footprint to become certified
I have is pride for the the communities in which we operate.
carbon neutral. You can read more about
way REA Group’s people Looking through the ESG lens, the key our carbon reduction commitments within
to our success in FY20 was the ability the Environment section of this report.
have successfully to effectively implement our continuity
We’ve made improvements to our
navigated a year plans developed as part of our Business
Sustainability Report this year, which has
Continuity and Resilience Framework,
unlike any other, while to quickly move our people to work
been prepared in accordance with the
Global Reporting Initiative (GRI) Standards:
delivering ongoing remotely. We did so with the knowledge
Core option. In addition, we engaged
that we could continue to run our critical
value to our customers, processes and serve our customers with
independent professional services firm
KPMG to undertake Limited Assurance
consumers and minimal interruption.
over selected information within this
shareholders A number of key highlights were delivered Report. KPMG’s assurance opinion is
provided on page 62.
throughout the year, including the
expansion of our Cyber Security team,
As we enter a new decade, we look
progress towards our gender diversity
forward to our increased focus on
targets and the steps we’ve taken to
ESG being a driving force behind
minimise our environmental footprint.
REA Group’s ongoing success. We
Our focus on gender diversity is appreciate you taking the time to read
unwavering, with 50.1% of our people our FY20 Sustainability Report and
across Australia and Asia identifying welcome any feedback via our mailbox:
as female, and 49.9% of our people
sustainability@rea-group.com
identifying as male. Our target to have
50:50 gender representation across
REA Group’s Leadership Group (RLG)
in Australia has been achieved.
We remain humbled by the work of our
charity partners, who play a material role Owen Wilson
in driving and advocating for scalable Chief Executive Officer
solutions to end homelessness. We were
proud to extend our financial and in-kind
support of our charity partners Launch
5 | REA Group
Introduction Governance Social Environment
Materiality
assessment
In FY19, REA Group Materiality matrix
undertook a materiality VERY HIGH
assessment to establish
Diversity &
Ethics & Integrity
Inclusion
HIGH Data
the most relevant areas Human Innovation
Protection
& Security
Rights
of focus related to MODERATE
Community Partnerships
Customer Satisfaction HS&W
sustainability Employee Engagement
Service Quality
& Safety
Sustainable Procurement
We reviewed the findings of the materiality
Importance to stakeholders
Responsible Talent
assessment internally at the beginning of Marketing Development
FY20 against the activity of our business
Waste
over the last 12 months. From this, we
Water
concluded that the top eight issues
Public Policy Responsible
remain the most relevant and in the right Use of Media
order for our business to focus on.
Energy
The issues were determined as part Climate Change Adaptation
of a review process undertaken by an
GHG Emissions
independent sustainability consultancy. LOW
It included researching issues relevant
to REA Group and benchmarking our
sustainability performance against peers,
competitors and leaders.
The issues were prioritised following
internal and external issue surveys,
interviews and workshops. The data Current or potential impact on business
ENVIRONMENT
gathered was then analysed and SOCIAL
GOVERNANCE
consolidated to produce a prioritised
list of material issues. The top eight
issues identified for REA Group from the We plan to conduct our next materiality assessment in FY22 to ensure we are
materiality assessment, and where you continuing to prioritise the most relevant areas of focus for REA Group in relation
can find content on each, are featured to sustainability.
in the following issues navigator.
6 | REA Group
Introduction Governance Social Environment
Materiality assessment
continued
Materiality assessment – top eight sustainability issues navigator
Ethics and integrity
Conducting all business activities in line with the highest ethical and Ethics and integrity, page 11
legal standards is central to the company’s purpose and values.
Human rights and labour standards, page 27
Diversity and inclusion
Providing a fair and equitable workplace, free from discrimination. Diversity and inclusion, page 30
Data protection, privacy and cyber security
Safeguarding data and networks from corruption, loss and cyber Cyber security, page 19
attacks, and ensuring privacy of personal information.
Privacy at REA Group, page 12
Health, safety and wellbeing
Preventing work-related injuries, illnesses and accidents in the Workplace health, safety and wellbeing, page 33
workplace, and promoting the wellbeing of our employees.
Product quality and safety
Setting and maintaining high standards of products and services, Cyber security, page 19
such as preventing cases of scams, fraudulent listings, mislabelling
of properties and false advertising. Responsible marketing, page 25
Innovation, page 22
Employee engagement
Creating a culture and workplace where employees have a positive Employee engagement, page 38
attitude towards the organisation and its values.
Innovation
Investing in new ideas, solutions and innovations to create better Innovation, page 22
products and services.
Customer satisfaction
Meeting customers’ expectations through superior product and Customer satisfaction, page 42
service quality, as well as enhancing their user experience.
7 | REA Group
Introduction Governance Social Environment
Bushfires in Australia
In 2019 and 2020, Our Flatmates.com.au platform,
which connects people who need
on 30 June 2020). This saw employee
donations through our Matched Payroll
bushfires spread accommodation with those who have Giving program matched dollar for
a spare room or vacant property, also dollar up to AUD $1,000 per employee,
across Australia with extended an offer to waive all fees for and up to a company cap of AUD $150k.
devastating impacts those who opened their homes rent-
Our employees embraced this opportunity,
free for people seeking emergency
– including to our accommodation. More information is
with up to 27% of our people in Australia
opting to donate this way, with donations
customers available at:
peaking in February 2020.
In January 2020, we created a Bushfire REA Group’s Bushfire Crisis Support site
Donations for charities responding to the
Relief Support Package for impacted
Through our Advantage Community Grant bushfires were also generated through
customers to access when the time was
program, we prioritised grant applications the Community Café between November
right for them to do so. The package
benefiting bushfire-impacted regions, 2019 and February 2020, as well as an
included the following:
to help them get back on their feet. In employee-driven painting and bake-sale.
FY20, of the 96 agencies awarded a The bake-sale saw team members bring
Re-upgrades, at no additional cost, grant throughout Australia, 54 agencies baked goods from home and another
for properties that were within an nominated bushfire-affected causes. Read team member created water paintings of
affected bushfire area, and where more about the Advantage program on Australian wildlife to sell, generating further
the existing marketing campaign page 44. donations for the Australian Wildlife charity.
needed to be extended.
REA Group’s people were also eager to Together, REA Group and its people
Refunds on paid advertising for help out and in February 2020, REA Group donated more than $200k to charities
properties that were within an doubled the Matched Payroll Giving supporting communities and wildlife
affected bushfire area, and which caps for employee and company for the impacted by the bushfires.
needed to be taken off the market remainder of financial year (concluding
due to fire damage.
For businesses that operated within
$200k+
affected bushfire areas, and which
were experiencing significant impact
to their operations, realestate.com.au
or realcommercial.com.au
subscription fees (or other recurring
Donated by REA Group
product fees) were waived from
1 January to 31 March 2020. and employees to charities
supporting bushfire-
For businesses that operated within
affected bushfire areas, and which
impacted communities
were experiencing negative impact
to their operations, we provided
extended payment plans for
outstanding accounts.
8 | REA Group
Introduction Governance Social Environment
COVID-19
The impacts of customers had access to the insights and
learning required to run their businesses
COVID-19 have been successfully.
felt around the world Overall customer sentiment and feedback
towards our efforts was extremely positive,
During this time, REA Group focused on
and we continue to deliver support in
the health and safety of our employees,
affected areas.
their families and our local communities.
Our customers and partners remain We’ve also shared information around
front and centre in all our thinking as we financial assistance available to individuals
continue to monitor and respond to the and businesses, as well as tips on working
situation as it evolves. from home with kids.
In response to COVID-19, REA Group In addition, we provided a range of health
delivered new product innovations to help and wellbeing initiatives, including access
our customers and the property industry to uncapped personal leave to support
adapt to the new rules including digital our people with their transition to working The focus of the Major Incident Response
inspections, online auctions, inspection from home during the restricted periods. Team in January was on the continuity
bookings and COVID-19 property market and safety of our lines of business based
insights to keep the industry informed. We have been able to manage the
in Asia. As the pandemic spread and
business through the COVID-19 pandemic
Our focus was clear: forced Australia into Stage 3 lockdown in
via implementation of continuity
March, we enacted the Crisis Management
plans developed under our Business
Team to forecast market impact and,
To provide our customers with Continuity and Resilience Framework.
1 therefore, revenue impact to REA Group,
ongoing flexible support measures Prior to the global pandemic, we had an
take action to sure up liquidity and roll out
understanding of our most important
To launch new features and services a series of customer support packages
2 processes, and the plans required to
to provide Australians with the ability for our customers. During the period
continue the operation of those processes
to buy, sell and rent that remote working was extended, we
under multiple risk scenarios that included
have focused on Workplace Health and
a pandemic.
To ensure property seekers were kept Safety, specifically ergonomic and mental
3
well informed with regular insights Testing these plans was an expectation health impacts, and we have continued
into the property market under the Business Continuity and to adapt our customer support packages
Resilience Framework, which enabled accordingly.
We pivoted our entire sales teams to us to quickly move our people to work
provide virtual customer support, deliver A more detailed overview of REA Group’s
remotely, knowing that we could continue
flexible solutions ensure listings and COVID-19 response can be read on
to run our critical processes and serve
campaigns were treated sensitively, and page 16 of our FY20 Annual Report.
our customers with minimal interruption.
provide relief measures for those going The framework has also provided the
through financial hardship. guidelines by which we have run our Major
Incident Response Team to manage our
In addition, we shifted our education and
COVID-19 response since January 2020.
learning event series in both Australia
and Asia to online, ensuring all of our
9 | REA Group
Introduction Governance Social Environment Governance Good governance is essential to protect and enhance the long-term performance and sustainability of our company. It also supports the interests of our shareholders, employees, customers, consumers and the broader community 10 | REA Group
Introduction Governance Social Environment
Ethics and integrity
Conducting all business Compliance risk When new people join REA Group, we
share our digital Employee Handbook
activities in line with the Doing business transparently and in a with them, which provides insight into
way that promotes the highest levels of the following:
highest ethical and legal business ethics and integrity is central to
standards how we operate at REA Group. As part
Values
of the company’s approach to risk and
REA Group’s most recent materiality assurance, we have a Compliance Risk
assessment created a prioritised list of framework in place that spells out the Conducting ourselves professionally
sustainability issues for REA Group and steps to be taken for ongoing assessment
Ensuring everyone’s safety,
‘ethics and integrity’ was the number of our compliance risk for all of our
wellbeing and inclusion
one ‘issue’ identified. This section of our regulatory and legislative obligations.
Sustainability Report outlines the programs, Our framework includes Anti-Bribery Using technology safely
practices and policies REA Group has in and Corruption, Privacy, Competition and
place to ensure ethics and integrity is at Consumer, Employment Act, Occupational
Engaging with social media
the forefront of everything we do. Health and Safety, Corporations Act, ASX
listing requirements and Financial Services.
Building a high-performance culture
Avoiding conflicts of interest
How to raise concerns
Our policies are reinforced with mandatory
online training for all new people who
join REA Group to create awareness and
understanding, and foster a culture of
respect, diversity and inclusion. Our Legal
team also runs face-to-face refresher
compliance training annually across
the company. Additional compliance
training has been rolled out in Asia to
cover ‘Preventing Bribery and Corruption’,
with ‘Workplace Safety and Violence’,
‘Competition, Antitrust and Fair Dealing’
and ‘Cybersecurity’ planned for roll out
in FY21.
11 | REA GroupIntroduction Governance Social Environment
Ethics and integrity
continued
Privacy at REA Group only stored securely, but also purged in
accordance with our retention policies. Conflicts of interest
At REA Group, we do our best to
personalise the service that every person A key focus of REA Group in FY21 will be
receives, so we are providing them with to improve our privacy practices to provide
the most relevant property suggestions, users with further transparency and control
articles and guides. We are only able over their personal information. We have
to provide such a personalised service a dedicated consumer privacy working
as a result of our ability to track certain group aimed at ensuring our privacy
personal information of our users. This practices are considered best practice
may include information that the user has and to ensure that REA Group will be
disclosed to us about their demographic well placed to comply with: REA Group maintains a ‘Managing
profile, but may also include information Conflicts of Interest’ Policy, which
a) the proposed changes to the
we have deduced about the user based applies to all REA Group directors,
Australian privacy laws that were
on their behavior on our website. employees, contractors, consultants
first recommended by the Australian
Competition and Consumer and visitors working for REA
We understand that the information we
Commission (ACCC) in its Digital Group. Directors are required on
collect from our users is personal. We
Platforms Inquiry Report in 2019 an ongoing basis to disclose to the
aspire to be as transparent as possible in
Board relevant personal interests
our privacy policy as to what information
b) Thailand’s new Personal Data and conflicts of interest that may
we collect, how we use it and how we
Protection Act, which is scheduled have an impact on their actual or
disclose it.
to be fully implemented in 2021. perceived independence. These
Privacy by design is at the forefront of are recorded and reported to each
REA Group introduced its first Privacy
the minds of our developers and product board meeting.
Policy in 2001, when the Privacy Act 1988
managers. The importance of handling
(Cth) was extended to cover the private The Audit, Risk and Compliance
personal information appropriately is
sector. REA Group’s Privacy Policy (ARC) Committee supports the
reiterated by our Privacy Officers and
has evolved over almost 20 years, in Board with oversight on related
is part of our mandatory on-boarding
line with our data collection and usage party transactions. Where
training for all new employees, our one-
practices, to continually provide up-to- transactions with related parties
hour mandatory annual legal training
date and transparent information to our take place, REA Group complies
for all employees in Australia, and our
customers and consumers. In FY20, REA with the relevant provisions of the
mandatory online compliance training
Group introduced a Cookie Policy to Corporations Act. Transactions
for all employees in REA Group Asia. We
provide greater transparency about how it with related parties are disclosed
conduct privacy impact assessments on
uses cookies and similar technologies for in REA Group’s Annual Report on
all new products and systems that handle
website analytics and targeted advertising. A page 112.
personal information, and we take care
similar Privacy Policy and Cookie Policy also
to ensure all personal information is not
apply to our businesses in REA Group Asia.
Whistleblower policy
Our Whistleblower Policy and keep things confidential and protect the
process provides a way to confidentially whistleblower. There are internal and
and anonymously report any suspected external channels for making a report,
instances of wrongdoing. This may include including through an independent third-
illegal, unethical or inappropriate conduct. party whistleblower service, which can
It is accessible to current and former be accessed online or by telephone.
employees, contractors, suppliers and
Whistleblowers are protected from
external parties.
victimisation, adverse action or
The policy provides details of what a intimidation. Our Board, via the ARC
wrongdoing is, how to make a report Committee, receives regular updates
and the steps REA Group will take to on ‘whistleblower’ matters.
12 | REA GroupIntroduction Governance Social Environment
Ethics and integrity
continued
Tax transparency
As part of REA Group’s commitment
to pay the right amount of tax and
comply with all tax laws, we support
the Board of Taxation’s Voluntary Tax
Transparency Code (TTC).
In 2020, REA Group published its
first voluntary Tax Transparency
Report, providing a summary of the
$276.4 million in taxes paid, collected
and remitted by REA Group for FY19.
The report provides disclosures under
the Voluntary TTC, and is in addition
to tax information that is reported to
the Australian Taxation Office (ATO),
Australian State Revenue Offices
and foreign revenue authorities on
a regular basis.
Our Voluntary Tax Transparency
report includes information in relation
to REA Group’s approach to tax
governance, tax risk management and
international-related party dealings.
REA Group and its subsidiaries comply
Group of 100 (G100)
with all applicable tax laws and
regulations. REA Group’s Chief Financial Officer (CFO), Janelle Hopkins, was named the first
female chairman of the G100 in February 2020. The G100 is the peak body for
Our Tax Governance policy reinforces
CFOs and works to ensure Australia’s commercial and regulatory environment
our objectives:
is one that advances the interests of Australian businesses, as well as one that
• We pay the legally correct amount encourages private and public enterprises to grow and compete in today’s highly
of tax and do not knowingly partake competitive environment.
in tax avoidance/fraud.
• We assess tax effective positions
Financial services support their goals – whether that’s the
that are supportable, founded in suburban dream, a weekend getaway, a
prevailing commercial rationale and Home loans play an important part in property empire or just something to call
that do not damage our corporate bringing property dreams to life and their own. Our content and tools help
reputation. REA Group’s Financial Services team is everyday Australians to understand their
• We engage with regulators, tax committed to making this part of the options in the comfort and privacy of
authorities, external advisers, and property journey easier. Whether it’s their home or office. We understand that
industry groups the transition from renting to buying, our consumers have unique needs and
in an ethical, upgrading, investing or refinancing to we’re all about options and choices. When
transparent and a better deal, consumers need advice they’re ready to take the next step, we
professional they can trust. Smartline and our banking can connect them directly to our banking
manner. partner NAB, work together to provide the partner, or to a mortgage broker. Helping
right information and service. consumers get financially ready is great for
our vendors and agents too. Getting our
By bringing the financial lens to property
audience ready to make their next move
listings we believe consumers can build
increases the quality of conversations at
their understanding and confidence. With
each step of the process.
this they can make the decisions that
13 | REA GroupIntroduction Governance Social Environment
Ethics and integrity
continued
Smartline
In February 2020, Smartline and Our Smartline team won Franchise of
realestate.com.au brokers all came the Year for the 10th time in 11 years
together under the one brand – Smartline in FY20. A number of our franchisees
personal mortgage advisers. Processes, were recognised as finalists at various
platforms and websites were all integrated industry awards events – the Better
and accreditation for all our brokers was Business Summit, MFAA State Awards,
gained under the new brand. Australian Broker Awards and Women
in Finance Awards.
Smartline is a financial member of the
Mortgage and Finance Association of Smartline updated its responsible lending
Australia (MFAA) and the Combined policy and procedures to align with the
Industry Forum. Smartline holds a Credit ASIC Regulatory Guide RG209 Credit
Licence that is issued by the Australian licensing: Responsible lending conduct.
Securities and Investments Commission The new policy went live on 1 July 2020.
(ASIC) and, as such, also falls under the
Australian Financial Complaints Authority
(AFCA) external dispute resolution scheme.
Responsible lending Hometrack Hometrack renewed all of its relationships
with its major customers that were due
Smartline has always placed customers After being acquired by REA in June 2018, for renewal in FY20, and added many
at the heart of all interactions. Smartline’s Hometrack is now fully integrated into REA new services to its valuations platforms
policies and procedures set out the across all areas and functions, including throughout the year.
standards by which the team (Smartline data services, systems engineering,
and its network of brokers) aims to conduct security, people and culture. The full Hometrack is being rebranded to
themselves when dealing with customers. integration of Hometrack ensures the team a permanent new brand under the
Smartline is committed to upholding has access to the up-to-date technologies REA Group umbrella of brands in FY21.
industry standards of practice and services and ways of working.
outlined by regulators, the MFAA and the
Given the sensitive customer data that
Banking Code of Practice. This requires
Hometrack is trusted with, data protection
Smartline, and its network of brokers,
is critical for the sustainability of the
to meet a standard of ethical behaviour,
business. Hometrack is currently certified
ensure responsible lending obligations are
ISO 27001 and aligned with the National
met and place the customer’s best interest
Institute of Standards and Technology
at the centre of every decision.
(NIST) Cybersecurity Framework. The
Part of Smartline’s responsible lending Hometrack team has strict policies
approach is to ensure brokers offer around storage and purging of personally
customers exceptional advice by providing identifiable information (PII) data,
quality mortgage broking services. This is encryption of data (both in transit and at-
about providing personal and proactive rest) and policies outlining access control
communication to customers, as well as to the Hometrack systems. Hometrack
giving consideration to the individual needs has in place data loss prevention
of each customer. When a Smartline broker (DLP) solutions for the protection
recommends a product to a customer, of customer data.
they are required to ensure the product
Hometrack has long-term recurring
meets the customer’s individual needs, is
revenues with its major bank customers.
suitable and in the customers best interest.
14 | REA GroupIntroduction Governance Social Environment
Risk management
Taking the right risks, To achieve this, REA Group follows
accepted standards and guidelines for
on an annual basis. At REA Group, risk
appetite is defined as ‘the amount and
at the right time, for managing risk. We are committed to type of risk that an organisation is willing
ensuring that a consistent and integrated to take in order to meet its strategic and
the right return, while approach to risk management is business objectives’. While risk appetite
doing the right thing established and embedded across all is about the pursuit of risk, risk tolerance
levels of the business. This is driven by is about what an organisation can cope
The team at REA Group is driven by our REA Group’s Risk Management Framework with. REA articulates risk tolerances as ‘risk
purpose to ‘change the way the world that is regularly reviewed and updated limits’. Risk appetite and an associated
experiences property’, which encompasses to reflect best practice, industry and set of risk limits provide the business
everything from product innovation to community standards. with a framework to make risk-based
international investments. Having a clearly decisions – in the context of the type
defined purpose provides REA Group Board of risks to accept, or not to accept and
with opportunities to drive further value. the areas of the business that require
We believe effective risk management is Our Board reviews and approves the
immediate attention because operational
about taking the right risks, at the right REA Group Risk Management strategy that
performance is not in line with Board
time, for the right return, while doing the outlines how we manage and govern risk,
expectations.
right thing. and the Risk Appetite Statement
REA Group Board Charter
15 | REA GroupIntroduction Governance Social Environment
Risk management
continued
Board Audit, Risk &
Compliance Committee
n
tio
Once risk appetite is set by the Board, the it va Le
o ad
Board Audit, Risk & Compliance Committee m ycle Tone
e
d lifec from
yee the
an
plo
rs
(ARCC) monitor that the performance of to
p
Em
hi
es
p
the organisation remains within those limits
tiv
en
by receiving and reviewing management
Be
Inc
reporting that is tabled regularly throughout
ha
vio
s
the year. If limits are breached or look
ard
ura
Rew
like being breached, the ARCC require
l mo
management to take decisive action to
del
address the control environment in a timely
Overall
fashion and will receive updates on how
risk culture
actions are progressing.
R is k t
ce
The ARCC will also approve the annual
n an
ra n
audit plan, ensuring it focuses on key
v er
spa
nt
areas of risk to the business, while also
Go
ren
me
cy
giving consideration to external events and
on
themes. Audit reports are tabled at ARCC
Ri
v ir
y
ili t
sk
meetings following completion of each
en
R is s ib
ka on
fr a
m ppe esp
nd
audit. Regular risk reporting to the ARCC ew tit e nd r a
Roles a n
includes the status of agreed management or io
k
is at
actions to close any control gaps that an
audits identify. Org
The ARCC requires a report to be tabled
and considered following management
review of the REA Group Risk Management Executive Risk Committee In FY20, we executed a comprehensive
review of our Risk Management
Policy (annually) and supporting frameworks We have a formal Executive Risk Strategy and Appetite, Operational Risk
(biennially) to ensure industry and regulatory Committee in place to discuss, monitor Framework and Business Resilience
standards and best practice are achieved as and decide on risk matters regularly. Framework, which was endorsed by our
well as operational effectiveness. This includes the monitoring of our Board of Directors for implementation.
In addition to the regular reporting that risk appetite settings that have been
approved by the Board. This Committee At the commencement of the financial
is tabled at ARCC meetings throughout
consists of member of our Executive year we review and update the risk appetite
the year, the annual audit planning, risk
Leadership Team (ELT), our Chief and internal audit plan, using historical
management strategy and appetite setting
Information Security Officer and our trends, industry insights and input from
process and policy and framework reviews,
Chief Risk Officer. management teams via the ERC and ARCC.
the Chair of the ARCC hosts a Board Risk
We monitor and review continuously
Day once every year where members of The agenda covers our Operational risk throughout the year and also adjust at any
the Board spend a full day considering taxonomy (as defined in our Operational point with Board approval, which allows
strategic risk and emerging risk themes to Risk Framework), Strategic Risk, Regulatory us the flexibility to adapt based on the
formulate the REA Group Strategic Risk Risk, Compliance Risk, Credit Risk, Internal emerging risk landscape.
Profile for the year ahead. Audits and any significant incidents or
events related to these areas that may have Per our Risk Framework, we also perform
Further, the ARCC is kept informed of
occurred. High-risk matters, are escalated ongoing assurance of our key controls
changes in the cyber threat landscape,
to the ARCC. across all operational and compliance risk
security strategy and mitigations directly
types. This includes in-depth testing of key
by the Chief Information Security Officer We also maintain a network of ‘Risk financial controls in line with Sarbanes-
and through our Executive Risk Committee Champions’ within the business to help Oxley requirements, due to NewsCorp
(ERC). with identification and management of being a US-based majority shareholder.
our risk profiles, implementation of our
REA Group Board ARCC Charter
frameworks and embedding a risk culture.
16 | REA GroupIntroduction Governance Social Environment
Risk management
continued
Key risk exposures
Following are the key risk exposures that relate to the most important sustainability ‘issues’ identified in REA Group’s most recent materiality
assessment. REA Group has identified these risks to have the potential to significantly impact our business and the table details how we
manage these potential exposures. These are monitored and discussed regularly as part of the ERC and ARCC.
Key risk Response Materiality assessment – issue
Regulatory landscape
Increased regulation that increases the cost • Compliance Risk Framework updated and
1 Ethics and integrity
of doing business, or makes some parts of implemented
our business unprofitable or unacceptable
• Regulatory and Government Committee
in terms of risk
established to review and action regulatory
changes
Data
Issues with managing integrity and consistency • Implemented a data governance program to
3 D
ata protection, privacy and
of our data, or failure to build services that support both:
cyber security
enable the production of those data assets
- Data defence – minimising risk and ensuring
5 Product quality and safety
integrity of data
- Data offence – enabling data-driven
decision-making and product development
• Our data governance program will evolve
existing data defence programs, such as our
Privacy and Data Retention policies, but the
focus will be on building our data offence to
unlock new value
Customer
Disruption to our customers’ business models • Provide strong support for Agency Principals
8 Customer satisfaction
would have implications for REA Group and Business Owners
• Continuing to increase engagement with
individual agents through tools
Misappropriation, misuse and malicious activity
Losses due to acts of a type intended to • See the Cyber Security section on page 19
3 D
ata protection, privacy and
defraud, misappropriate property or circumvent
cyber security
regulations, the law or company policy
5 Product quality and safety
Key risk exposures continued over page
17 | REA GroupIntroduction Governance Social Environment
Risk management
continued
Key risk Response Materiality assessment – issue
Products, advice and business practices
Losses arising from an unintentional or negligent • User experience testing of new product
1 Ethics and integrity
failure to meet a professional obligation concepts and market research
including duty of care owed to customers, 5 Product quality and safety
• Customer feedback channels and consumer
consumers and/or the market and suitability
satisfaction via Customer Satisfaction council, 8 Customer satisfaction
requirements, or from the nature or design of
surveys and Industry Leadership groups
a product
• Legal review in place for any marketing claims
• Lender education and qualifications for our
Financial Services business
• Smartline Compliance Assurance Program
Execution and delivery
Losses arising from failed transactions • Defined product strategies and roadmaps
1 Ethics and integrity
processing, process management, non-delivery
• Cross functional squads and tribes aligned to
of new/enhanced functionality 5 Product quality and safety
product delivery
• Credit/debtor management processes that 7 Innovation
include credit checks on new customers,
8 Customer satisfaction
delinquency management controls, hardship
programs to responsibly help our customers
through difficult times
People, employment practices and workplace safety
Inability to deliver against strategy due to • Dedicated talent acquisition team
1 Ethics and integrity
ineffective talent management
• REA Uuniversity learning program for
2 Diversity and inclusion
Losses arising from acts that are inconsistent employees
with employment, health or safety laws or • Workplace Health and Safety system and 4 Health, safety and wellbeing
agreements, from payment of personal injury committee in place
6 Employee engagement
claims or from diversity/discrimination events
• Robust performance and remuneration
framework reviewed by the Board of Directors
annually
• Annual engagement survey, supplemented
by regular pulse surveys
Business disruption and system failure
Inability to execute core business processes due • Architect our technology for resilience
3 D
ata protection, privacy and
to systems disruption/outage
• Define operating levels and monitor for events cyber security
that may impact those levels
• Incident Management processes, training and
post-incident reviews performed for lessons
learned
• IT Disaster recovery plans and testing in place
18 | REA GroupIntroduction Governance Social Environment
Cyber security
Building cyber resilience In 2020 the Australian Government
highlighted concerns over advanced
A revised Security Guide for
Property Managers
at REA Group hacking targeting organisations across Targeted awareness for high-risk
the country. users, highlighting risks associated
REA Group’s most recent materiality
with business email compromise
assessment identified ‘data protection, REA Group has responded through its
and fake invoice scams
privacy and cyber security’ as one investment in the Cyber Security team over
of the top prioritised sustainability the last 12 months by adding operational, Product security health checks to
issues for REA Group. This section of engineering and advisory capability. bake security requirements into
our Sustainability Report provides an Additionally, we have brought security new products
overview of how REA Group is continually into our broader technology platform Hands-on developer training in
enhancing and evolving its cyber security and cloud engineering group, providing secure development practices
strategy and activity to benefit all our REA Group with a powerful lever to embed using Open Web Application
stakeholders. security into the fabric of our technology Security Project (OWASP) top 10
building blocks. mitigations
Risks arising from cyber threats is front
The introduction of multi-factor
of mind for REA Group. Cyber security Having a Cyber Security team that works authentication to enhance security
continues to gain attention in both with product managers and technology for employees, customers and
customer-facing and non-customer-facing teams to proactively monitor REA Group consumers, as well as additional
teams across our business. systems for vulnerabilities helps us to security enhancements for our
better mitigate malicious activity and customer and consumer facing apps
Public awareness has been driven by new
threats to our business. This year, we’ve
legislation and the increasing frequency Digital risk management
worked to increase employee and
of publicity surrounding scams and fraud,
customer risk-awareness through a series
particularly resulting from email phishing Board level awareness of
of initiatives, including the following:
and prominent social media activity. cyber security issues
Strategy
Our cyber security strategy continues to be
focused around five simple priorities:
1 Visibility of assets and threats
2 Prioritising good technology hygiene
3 Broad adoption of key security controls
4 Promotion of a risk-aware culture
5 Data protection
Our security program extends to assessing
our business partners and supplier
security posture.
19 | REA GroupIntroduction Governance Social Environment
Cyber security
continued
Multi-factor
authentication
Project Locke:
protecting our customers
We’re passionate about protecting
our customers’ online experience
with us. That’s why we’ve
implemented risk-based, multi-
factor authentication to prevent
unauthorised access to personal
information.
Over the last 12 months we’ve been
Industry Standards Industry collaboration working across our businesses
in Australia and Asia to bring the
REA Group uses the NIST Cybersecurity REA Group’s cyber ecosystem
latest authentication technology
Framework, an internationally recognised extends broadly across industries, and
to life – a capability we call Locke.
approach to the implementation of collaboration with peers is a vital source
Locke isn’t just about sending an
controls to manage risks to our business, of threat intelligence, helping to inform
SMS code, it is using a range of risk
and we measure our maturity against our security strategy. This year, we
factors to detect unusual behaviour
this framework annually. The framework collaborated with a number of Australian
in our online apps. Additionally,
enables us to continually assess where to organisations to publish a guide to inform
we’re able to use identities to create
focus investment. businesses about real-world experiences
more personalised experiences and
influencing security outcomes.
REA Group leverages external expertise issue challenges based on high-risk
where appropriate to augment its security REA Group submitted a response to the activities.
services, including conducting security government’s cyber security strategy
We’ve added social sign-on to our
testing, compromise assessments and update and the Chief Information Security
experience and we are now able to
independent reviews. Officer contributed to a focus group,
leverage the security provided by
providing feedback about concerns and
leading platforms such as Facebook,
Product security recommendations for future national
AppleID and Google, removing the
health checks initiatives.
need to remember extra passwords.
We believe in building security into our REA Group’s Chief Information Security
products and tech upfront, not bolting Officer sits on several executive advisory
it on afterwards. Our Product Security boards for cyber security including Deakin
Health Check (PSHC) is aligned to the NIST University, the Australian Information
Cybersecurity Framework and enables Security Association, and is a CyRise
product managers to self-assess their mentor – an accelerator for Australian
initiatives for security risks. The PSHC cyber security start-ups. He is a co-founder
builds story cards that teams embed into of the Security, Influence and Trust Group,
their delivery roadmaps. This helps deliver a collaboration of leading organisations
their products while meeting our policy committed to influencing and building
requirements without the security team a cyber-aware culture across Australia.
becoming a bottleneck. Our continuous
delivery approach allows for frequent
changes and assessments to occur
throughout the software lifecycle.
20 | REA GroupIntroduction Governance Social Environment
Cyber security
continued
Digital risk management Responsible Disclosure Policy
Anti-bot mitigation
No-one likes scammers and neither do We value the work and effort of the
we. This year we’ve taken down more security research community as it helps
Time’s up for bad robots
than 100 fake mobile apps impersonating make everyone safer online. As part of REA Group has teamed up with one
REA Group on the Android platform. To do our vulnerability management strategy, of the world’s fastest growing anti-
this, we’re using a combination of certificate we have published a policy that outlines bot mitigation companies, Kasada,
transparency monitoring and phishing how researchers can disclose security to protect its digital assets from
takedown services from a leading digital vulnerabilities to REA Group in a safe and malicious automation, unauthorised
risk-management partner. This helps protect responsible way. While we do not offer scraping and brute force attacks.
our customers and brand from abuse. rewards for disclosures, we’re happy to
recognise the contributions of researchers Our partnership is designed to
We have also implemented the Domain- support our data strategy and
in our hall of fame as a special thank you.
based Message Authentication, Reporting, prevent unwanted and unsolicited
and Conformance (DMARC) policy for our Empowering our people to activities on our websites, so they
outbound marketing campaigns, providing are healthy and available for our
confidence that messages originate from,
make good security decisions
customers and audience.
and are digitally signed by REA Group. This Equipping our teams to recognise and
complies with the requirements set out in We believe that exposing our data
respond to cyber risk is an important part
the Request for Comments (RFC) standard. should be on our terms and that
of our strategic priorities at REA Group.
bad robots impose arbitrary costs
This year we have embedded interactive
on our business and expose us to
training modules into a new learning
unacceptable risks.
platform to deliver training and education
to all REA Group employees.
Training in FY20 has been focused on the Outlook and threat horizon
following target audiences:
At REA Group we don’t wait for incidents
to occur before acting. Our security
Developers – secure coding
strategy anticipates and expects us to
practices – leveraging OWASP
face cyber-attacks. We practise for,
Top 10
and experience these events, and we
High-risk employees – tailored
incorporate threat assessments looking
training for executive assistants and
forward by adjusting our responses.
finance highlighting risks related to
business email compromise and Looking forward we are assessing the
fake invoicing scams longer-term security implications of
All employees – security policy remote ways of working, and, the changes
eLearn – aligned to the NIST we may need to make as a result of more
Cybersecurity Framework designed people adopting this practice.
Safer Internet Day 2020 to be a simple guide to security We note the recent government advice
This year on Safer Internet Day 2020 accountabilities on nation state operations, as well as the
REA Group took the opportunity Customers – an updated security changes in cyber threat (e.g. ransomware)
to have a conversation with its guide for property managers, and use this to inform security investment.
customers in Australia about available for download from our
protecting their businesses online. Agent Marketing Centre We will continue to focus on anti-
Customers were encouraged to automation, phishing, reducing the
Tech community – the Tech
visit REA Group’s agent marketing complexity of technology environments and
Community at REA Group runs
centre for security tips and tricks to the rigour of good hygiene as key priorities.
monthly security-orientated
check back regularly for updates. showcases and presentations Our strategy is designed on continual
We added security messages to our for employees improvement, mitigating material risks and
customer Self Service Portal and responding when incidents occur, while
a statement message provided a recognising there are no silver bullets
prompt for action. to security.
21 | REA GroupIntroduction Governance Social Environment
Innovation
Investing in new ideas, Highlights and opportunities Rollout of our personalisation stack
solutions and innovations Agent Match Creating a personalised experience
that adapts to the needs of Australian
to create better products REA Group continued to help prospective property seekers requires the best
sellers evaluate agencies and agents within available technology. By combining what
and services the market. This year we experimented we know about our consumers, we are
‘Innovation’ was identified as one of the with our ‘Agent Match’ service, enabling now able to develop an individual profile
top sustainability issues from REA Group’s sellers to choose their preferred agents of every realestate.com.au user that is
most recent materiality assessment. In and ensuring agents received immediate updated in real-time with our event-based
this section, we provide an overview of notification of a prospective seller. We architecture. These profiles allow us to
the role innovation has played in several made some changes to the way the reach our consumers via omni-channel
of the key sustainability issues identified in Agent Match product worked and we communications in the channel that is most
the materiality assessment, including ‘data received feedback from customers relevant for each consumer, presenting the
protection, privacy and cyber security’ and who indicated there were opportunities next best actions that help navigate their
‘customer satisfaction’. We also provide an for improvement. We listened and, in individual property journey with ease.
overview of the learning opportunities we response to the feedback, changed the
benefited from through innovation in FY20. Agent Match product so that seller leads
are more accessible to customers, while
Our purpose is to change the way the world ensuring that consumers also have a great
experiences property, and we can’t achieve experience. The changes we have made
our purpose with a limited or constrained include removing the charge to customers
set of ideas. That’s why innovation receiving the leads and we will continue to
continues to sit at the heart of both our evolve the product.
purpose and our future growth plans.
At REA Group, innovation is all about
turning an idea into an offering that meets
a genuine need of our customers and
Pay On Sale
consumers. Constant innovation is vital to
adapting the realestate.com.au experiences Driven by COVID-19 and our desire to help our customers and consumers find their
to keep up with consumer expectations way through the tough market conditions, REA released a series of measures aimed
and to stay ahead of the competitive at reducing costs and providing customers with a variety of tools to give vendors
curve. Through innovation, we keep our the confidence to bring properties to market. One of these was an innovative way
position as the largest and most engaged for customers to delay full payment of the campaign until the point of sale, ensuring
property audience in Australia and, that both real estate agents and vendors could manage the market uncertainty.
therefore, we ensure REA Group continues
to thrive.
Innovation begins in our teams. We have
a long history of building diverse and
inclusive teams because we fundamentally
believe that diversity and inclusion are the
engine room of innovation.
22 | REA GroupIntroduction Governance Social Environment
Innovation
continued
languages. This experience also allows
users to search for property in close Data initiatives
proximity to train stations and schools.
In a short amount of time, the explore Over the last two years, REA Group
experience has more than 10% uptake with has invested in building a common
the majority of use coming from mobiles. data platform to be used across
the company. This is built on top
iOS app log out of Google’s BigQuery product and
allows publishing of data to a single
In November 2019 we released a version
location, transforming data for use in
of our iOS app that had an unplanned side
REA Group’s products and business
effect. Some users who were previously
intelligence, and a framework for
logged into their realestate.com.au
powering data science models
account were effectively logged out,
with machine learning. In FY20, we
and had to enter their email address and
launched our REA Insights brand,
password again. While this may seem like
which leverages our audience data
App releases a minor inconvenience, for us it was a
and behavioural market intelligence
really big deal – we have high standards
Through automation and collaboration, to share the latest property market
for the quality of our experiences and
we have accelerated our iOS and Android insights with consumers, customers
we’d let some of our consumers down.
app release frequency from releasing once and the media.
At REA Group, we have an ‘always on’
a month to releasing a new version of our
approach to ensure we learn from every
apps every week. Next we focused on
incident like this. Our process is called
the delay between accepting final code
the Post Incident Review (PIR), which is
changes and the fully tested app bundle
where we get together to understand what
arriving on a consumer’s device. We
happened and why. We then identify as a
focused on simplifying our ‘release train’
team what steps we’ll take to reduce the
procedures such as regression testing and
likelihood of the issue repeating.
reduced the lag time from 10 business
days to six days. Process innovations like
these are part of the REA Group’s DNA and
we’re always on the lookout for ways to
move more quickly and efficiently.
Explore (Asia)
In FY20 the Consumer team released
the ‘explore’ search experience to help
consumers search for property in a new
way. Our new explore feature allows users
to perform a type-less search experience
that you can perform by click or tap. This
is extremely beneficial for people who
need to perform searches in non-English
CIO50
#13 In November 2019, REA Group’s CIO, Tom Varsavsky, was recognised as one of
Australia’s most innovative tech leaders – coming in at number 13 out of 50 senior
tech executives across Australia as part of the CIO50 list, judged by CIO Australia.
The list recognises top tech executives who are driving innovation and influencing
Out of 50 senior
rapid change across their organisations. Tom was recognised for his strategic
tech executives leadership and supporting his team’s delivery of Locke, moving to Cloud-only,
and for championing diversity in technology, as well as other innovative changes.
23 | REA GroupYou can also read
