XML 82 R46.htm IDEA: XBRL DOCUMENT v3.25.1
Cybersecurity Risk Management and Strategy Disclosure
12 Months Ended
Dec. 31, 2024
Cybersecurity Risk Management, Strategy, and Governance [Line Items]  
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block] AngloGold Ashanti’s cybersecurity governance employs a comprehensive and integrated approach to risk management,
engaging both internal teams and third-party service providers. The Company has established protocols for continuous
monitoring and proactive management of cybersecurity threats through daily and weekly meetings and continuous interactions
with its third-party around-the-clock Cyber Security Operations Centre (the “SOC”). In addition to maintaining security scores
above industry benchmarks according to third-party rating services, the SOC regularly engages in discussions with AngloGold
Ashanti’s internal cyber safety team and other digital technology stakeholders to address identified threats and vulnerabilities.
The Company’s strategy includes monthly cross-departmental cyber risk management meetings and maintenance of a detailed
cyber risk register, continuously updated for thorough risk assessment. Annually, the Company conducts external penetration
tests and monthly internal phishing simulations to evaluate and enhance its incident response capabilities and employee
alertness to cyber threats. Regular tabletop exercises further reinforce the Company’s preparedness in responding to potential
cyber incidents, ensuring the security and trust of its stakeholders in its robust cyber governance practices.
The Company’s cybersecurity processes are integrated into its broader enterprise-wide risk management systems. The routine
engagement between AngloGold Ashanti’s internal cyber safety team and other digital technology stakeholders, other internal
departments and the SOC underscores the Company’s comprehensive approach to risk assessment and mitigation. To better
integrate with the Company’s risk management systems, weekly and monthly meetings between the cyber safety team and
representatives from the digital technology function and Group Risk Management, respectively, have been implemented.  The
Chief Information Security Officer (“CISO”) (designated the Vice President Cyber Safety) meets with the Chief Information Officer
(“CIO”) (designated the Senior Vice President Digital Technology) on a weekly basis. In addition, there are monthly Cyber Risk
Committee working group meetings involving members from Group Internal Audit, Group Risk Management, Group Security,
Group Safety and Group Compliance.
The Company routinely engages third parties in its cybersecurity operations. This engagement includes:
Periodically consulting with external experts to provide specialised services on cybersecurity (such as penetration test
exercises).
Annual reviews conducted by AngloGold Ashanti’s Group Internal Audit, using the Center for Internet Security (“CIS”)
framework as a benchmark to gauge the Company’s cybersecurity readiness.
Utilising a third-party training platform to conduct and report upon cyber safety awareness training, which includes a
range of predefined training modules (“Cyber Safety Awareness Training”). This mandatory training is designed to
ensure staff remain updated on the latest cyber safety practices.
Collaboration with a dedicated partner focused on operational technology cybersecurity. The Company believes
partnerships of this type are essential for addressing specific cybersecurity challenges in operational technology
environments.
Outsourcing AngloGold Ashanti’s SOC to a managed service provider. The SOC operates around the clock, offering
continuous monitoring and proactive response to potential cybersecurity threats.
AngloGold Ashanti has subscribed to well-established third-party risk management solutions to fortify its oversight of third-party
cyber risks, utilising their continuous monitoring and risk rating system to preemptively address and mitigate potential threats in
its vendor network. In addition to these proactive measures, the Company has reached out specifically to vendors with access to
the AngloGold Ashanti network, ensuring they comply with its mandatory Cyber Safety Awareness Training mandate. This
initiative emphasises the importance of completing training campaigns and increasing cyber awareness about various cyber
risks, such as clicking on malicious links. This targeted outreach to the Company’s vendors with access to the AngloGold Ashanti
network forms a vital part of AngloGold Ashanti’s strategy to manage cybersecurity threats from third-party service providers.
Further, starting from the first quarter of 2023, the Company has initiated a process to include a cybersecurity clause in new
vendor contracts to assert a proactive cyber defence posture, ensuring service level agreements, roles and responsibilities for
managing cybersecurity threats are established from the outset of its commercial relationships. For contracts that were in place
prior to this initiative, the Company expects to incorporate cybersecurity clauses upon their amendment and/or renewal. This
initiative is part of a broader effort to embed AngloGold Ashanti’s cybersecurity standards into all third-party relationships.
As of the date hereof, AngloGold Ashanti is not aware of any cybersecurity threats or incidents that have materially affected or
are reasonably likely to materially affect AngloGold Ashanti’s business strategy, results of operations or financial condition.
AngloGold Ashanti continually assesses and monitors potential threats and vulnerabilities. For additional information regarding
how risks from cybersecurity threats or incidents could materially affect AngloGold Ashanti’s business, financial condition, results
of operations, cash flows, ability to pay dividends and/or stock price, see “Item 3D: Risk Factors—Breaches in cybersecurity and
violations of data protection laws may adversely impact or disrupt AngloGold Ashanti’s business”.
Cybersecurity Risk Management Processes Integrated [Flag] true
Cybersecurity Risk Management Processes Integrated [Text Block] AngloGold Ashanti’s cybersecurity governance employs a comprehensive and integrated approach to risk management,
engaging both internal teams and third-party service providers. The Company has established protocols for continuous
monitoring and proactive management of cybersecurity threats through daily and weekly meetings and continuous interactions
with its third-party around-the-clock Cyber Security Operations Centre (the “SOC”). In addition to maintaining security scores
above industry benchmarks according to third-party rating services, the SOC regularly engages in discussions with AngloGold
Ashanti’s internal cyber safety team and other digital technology stakeholders to address identified threats and vulnerabilities.
The Company’s strategy includes monthly cross-departmental cyber risk management meetings and maintenance of a detailed
cyber risk register, continuously updated for thorough risk assessment. Annually, the Company conducts external penetration
tests and monthly internal phishing simulations to evaluate and enhance its incident response capabilities and employee
alertness to cyber threats. Regular tabletop exercises further reinforce the Company’s preparedness in responding to potential
cyber incidents, ensuring the security and trust of its stakeholders in its robust cyber governance practices.
The Company’s cybersecurity processes are integrated into its broader enterprise-wide risk management systems. The routine
engagement between AngloGold Ashanti’s internal cyber safety team and other digital technology stakeholders, other internal
departments and the SOC underscores the Company’s comprehensive approach to risk assessment and mitigation. To better
integrate with the Company’s risk management systems, weekly and monthly meetings between the cyber safety team and
representatives from the digital technology function and Group Risk Management, respectively, have been implemented.  The
Chief Information Security Officer (“CISO”) (designated the Vice President Cyber Safety) meets with the Chief Information Officer
(“CIO”) (designated the Senior Vice President Digital Technology) on a weekly basis. In addition, there are monthly Cyber Risk
Committee working group meetings involving members from Group Internal Audit, Group Risk Management, Group Security,
Group Safety and Group Compliance.
Cybersecurity Risk Management Third Party Engaged [Flag] true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] false
Cybersecurity Risk Board of Directors Oversight [Text Block] The Company has set up mechanisms to regularly inform both the board of directors and the Audit and Risk Committee about
any potential cybersecurity threats and the measures and strategies taken to counteract them. The Audit and Risk Committee
charter has been tailored to grant the committee specific responsibilities in monitoring and reviewing the Company’s
cybersecurity programme. This includes active engagement in discussions with management on material cybersecurity incidents,
related threats, vulnerabilities, defences and planned responses. The quarterly committee meetings are designed to ensure
ongoing diligence in managing cybersecurity risks. Integral to this process is the role of the CIO. The Company’s CIO, who is
regularly updated about cybersecurity matters in weekly Digital Technology Management Committee meetings (when required)
and/or in weekly one-on-one meetings with the CISO, serves as the primary interface to the board of directors via the Audit and
Risk Committee. To this end, the CIO attends the Audit and Risk Committee meetings, accompanied by the CISO as required.
The CIO reports any questions and advice from the Audit and Risk Committee back to the management experts, providing for a
responsive approach to cyber risk management. Together, when appropriate, the CIO and CISO provide a robust channel of
communication with the board of directors through the Audit and Risk Committee, facilitating the escalation of cyber risks to the
board of directors where necessary via the Audit and Risk Committee. This approach aims to keep the board of directors
consistently informed about the state of cybersecurity threats and the strategies employed to tackle them. Furthermore, the Head
of the Company’s Group Internal Audit team (which has cybersecurity within its purview) also has a direct line of communication
with the Audit and Risk Committee as well as the Chairperson of the board of directors, which structure complements the
Company’s reporting mechanism in order to keep the board of directors informed from multiple perspectives about cybersecurity
matters.
Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] AngloGold Ashanti has established governance procedures to manage cybersecurity threats. Several individuals in management
positions, including the CIO, the CISO and specific management committees are tasked with gauging cybersecurity threats and
formulating strategies to counteract them.
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block] There are well-defined processes in place through which these individuals and management committees are kept informed about
cybersecurity matters. This includes regular updates on the prevention of potential threats, detection of actual threats, mitigation
strategies, and post-incident remediation efforts. These processes are designed so that the Company’s management is aware of
the current threat landscape and the actions being taken to address it. The CIO is consistently kept informed of any cyber-related
topics by the CISO during the weekly Digital Technology Management Committee meetings (when required) and/or in their
weekly one-on-one meetings. The CISO develops a comprehensive understanding of all activities within the cyber safety team
through weekly one-on-one meetings with each team lead. This structured and layered approach of communication is designed
to ensure that the CIO is equipped to provide updates on cybersecurity matters directly to the Audit and Risk Committee.
Cybersecurity Risk Role of Management [Text Block] Management at AngloGold Ashanti plays a pivotal role in both assessing and managing the Company’s risks stemming from
cybersecurity threats. The Company’s CIO is accountable for the Company’s digital technology function. The Company’s CISO
leads the Company’s cybersecurity strategy and initiatives. Alongside internal legal expertise, the Company has engaged
external counsel for cybersecurity legal matters to provide specialised knowledge and legal insight. This partnership enhances
the Company’s cybersecurity framework and prioritises the Company being at the forefront of legal compliance and risk
management. Specialised management working groups such as the Cyber Risk Committee working group also play a pivotal
role, possessing a mix of technical cybersecurity skills and broad risk management capabilities to address the complexities of
cybersecurity challenges. With this collective expertise, both internal and external, each individual and committee member is
strategically positioned to further AngloGold Ashanti’s efforts against potential cybersecurity threats.
Cybersecurity Risk Management Positions or Committees Responsible [Flag] true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block] The CIO is consistently kept informed of any cyber-related
topics by the CISO during the weekly Digital Technology Management Committee meetings (when required) and/or in their
weekly one-on-one meetings. The CISO develops a comprehensive understanding of all activities within the cyber safety team
through weekly one-on-one meetings with each team lead. This structured and layered approach of communication is designed
to ensure that the CIO is equipped to provide updates on cybersecurity matters directly to the Audit and Risk Committee.
The Company’s Group Risk Management and Group Internal Audit functions have also incorporated cybersecurity into their
mandate, reinforcing the importance of cybersecurity across all levels of the Company. Members from Group Internal Audit and
Group Risk Management participate in monthly Cyber Risk Committee working group meetings together with members from
Group Security and Group Compliance. From a disclosure perspective, the Company assesses the materiality of reported
cybersecurity incidents exclusively through its Disclosure Committee, which provides a focused and expert evaluation of such
incidents against the relevant disclosure standards.
Cybersecurity Risk Management Expertise of Management Responsible [Text Block] Robin Fell (47)
Bsc (Hons), Physics, Durham University
TOGAF Certification Programme, The Open Group
Project Management Professional (PMP), Project Management Institute
Chief Information Officer (Senior Vice President Digital Technology)
Robin Fell was appointed as CIO of the Company with effect from 1 April 2022 and is the Company’s Senior Vice President
Digital Technology.
Mr. Fell is responsible for planning, implementing, managing and overseeing the overall use of digital technology across
business units, development projects and corporate offices within the Company. A key strategic aspect of his role is to manage
the successful convergence of information and operational technology to protect the business and achieve crucial competitive
advantage. Mr. Fell is also responsible for determining how various emerging digital technologies can benefit the Company and
improve business processes and outcomes. Mr. Fell is the owner of the Company’s “Digital Technology Roadmap” and
responsible for ensuring its alignment with the overall business strategy.
Mornay Walters (55)
PG DIP Information Systems, Leeds Becket University UK
Chief Information Security Officer (Vice President Cyber Safety)
Mornay Walters was appointed CISO of the Company with the effective date of 1 September 2017 and is the Company’s Vice
President Cyber Safety. Mr. Walters is responsible for the global Cyber Safety Strategy and Operations within the Company.
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block] There are well-defined processes in place through which these individuals and management committees are kept informed about
cybersecurity matters. This includes regular updates on the prevention of potential threats, detection of actual threats, mitigation
strategies, and post-incident remediation efforts. These processes are designed so that the Company’s management is aware of
the current threat landscape and the actions being taken to address it.
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] true