Risk Management

Overall responsibility for the oversight of risk sits with the Board. This responsibility is largely discharged with the support of the Audit & Risk Committee, which in turn works closely with the Management Risk Committee as the key business forum for risk oversight. Many of the strategic aspects of risk management are carried out on a ‘top down’ basis, with the Board and Audit & Risk Committee agreeing overall appetites and tolerance for our principal risks, providing challenge to management on their approach to mitigating and monitoring these risks effectively, and ensuring the accuracy and integrity of our risk disclosures. Alongside the strategic consideration of risk, a ‘bottom-up’ approach is in place, with risk management integrated into day-to-day activities at all levels of the Group.

This helps to ensure that risks are effectively mitigated at an operational level, and any emerging risk areas are identified, assessed and escalated appropriately. Risk management activities are also supported by work from both internal and external providers of assurance and independent review. The risk management framework governance diagram provides a schematic of our risk management framework and how the different elements interact.

Our risk management framework has been in place for several years, and continues to evolve in response to increasing complexity and pace of change in the external environment. In this context, the Board has overseen various initiatives within 2025 to enhance the maturity of our risk management processes and support continuous improvement. The role of the Management Risk Committee has expanded, enabling greater focus on key risk areas such as cyber risk and business continuity planning. A new risk management strategy has been developed and agreed with the Audit & Risk Committee, with additional specialist resource deployed within the Group Risk & Internal Audit department to support its implementation. These initiatives will integrate with our work on strengthening internal controls in preparation for the Board’s future effectiveness declaration under Provision 29 of the UK Corporate Governance Code, helping to ensure our ongoing resilience.

The Board, with the support of the Audit & Risk Committee, has developed a Risk Appetite Statement, classifying its principal risks against different appetite categories:

• Averse: Aim to minimise exposure as far as is practically possible, with a low tolerance for potential adverse outcomes. This category is applied to risks that could have severe consequences in areas such as HS&E, compliance, or reputation.
• Cautious: Acceptance of low to moderate levels of risk in areas that are necessary to achieve operational efficiency and strategic initiatives. Risks are carefully managed to avoid significant negative impacts on the organisation.
• Enterprising: Openness to accepting moderate to higher levels of calculated risks when pursuing strategic opportunities that could drive our growth or enhance operational performance.

Risk tolerance is considered against various risk‑specific measures and narrative reporting, reviewed and challenged by the Management Risk Committee before presentation for approval at the Audit & Risk Committee. The articulation of risk appetite also informs the design, operation and targeted maturity of each material control linked to the requirements of Provision 29 and the preparations for enhanced disclosures from 2026.

Emerging risks, defined as those that are known but cannot be assessed in detail at present and could, under certain conditions, evolve to pose a strategic threat as a principal risk, have also been considered by the Board. Emerging risks were reviewed through the normal operation of our risk management framework, with detailed consideration from the Management Risk Committee contributing to a formal annual presentation for review and challenge by the Audit & Risk Committee.

Our 2025 assessment has not identified any new emerging risk areas beyond changes within our existing principal risks. The previously recognised emerging risk of ‘market disruption’, has been retained. This reflects the potential threats to our business model from disruptions such as Artificial Intelligence (’AI’), market consolidation or breakthrough advances in deployment of technology such as modular construction. This risk will be monitored by the Board and, operationally, by the Executive Committee and Management Risk Committee. Mitigation strategies will be kept under review as the risk evolves.