Managing Risk

The Board has overall responsibility for the determining the Group’s strategy, including the identification and management of risks that could disrupt the delivery of the strategy and the Group’s five key priorities. This is achieved through:

• defining the Group’s overall risk appetite and ensuring risks are managed within this framework; 
• conducting reviews of principal and emerging risks, including feedback from senior management within the Group; 
• monitoring of a range of indicators of risk performance in order to inform strategic decision making;

• ensuring an effective system of internal controls is in place to manage risks to acceptable levels; and
• obtaining assurance on the performance of risk management and internal control processes in the Group’s operations.

• Monitors the integrity of the Group’s financial and non-financial reporting processes.
• Approves the Director of Internal Audit’s risk-based audit plan and monitors the overall effectiveness and independence of internal audit. 
• Monitors the external audit provision, ensuring a high quality of audit is delivered.

• Receives reporting from management and external providers of assurance on the effectiveness of risk management and internal control. 
• Reviews routine risk indicator reports assessing the Group’s performance against risk appetite and target risk levels.

• Supports the implementation of the Group’s strategy and delivery of key priorities.
• Reviews the Group’s operational performance including the routine management of risk.

• Supports the Board in development and oversight of the risk management framework.
• Reviews risk indicator reports and feedback on risk from operational teams.
• Reviews the operational effectiveness of control activities.

• Provides oversight and challenge on external reporting.
• Reviews financial and non-financial reporting ahead of Board and Audit & Risk Committee reviews.

• Provides oversight on all climate and sustainability-related matters.
• Reviews disclosures associated with climate and sustainability, obtaining appropriate assurance where required.

First line

Second line

Third line

 ‘First line’ functions within the Group’s operating companies contribute to effective risk management by:

• managing the day-to-day operational performance of the business, including identification of any changes in key risks affecting operations;
• ensuring the effective implementation of internal controls set by the Board and Group functions within the business;
• addressing Group level priorities as cascaded through regional and Group-wide management meetings; and
• reporting routine operational risks and issues through management forums such as the Land Committee and Regional Boards.

The Group’s ‘second line’ comprises a range of functions with a Group-wide remit, which play a key role in mitigating risk through:

• formulation of Group policies, procedures and control mechanisms designed to mitigate risks;
• conducting routine monitoring and assurance on the implementation of controls within the Group’s operations;
• promoting awareness of key areas of focus in the management of risk to achieve operational objectives;
• supporting steering groups on key risk areas including the Group’s Security Council and GDPR Steering Group; and
• ownership of functional risk registers in key areas of operations.

The Group Internal Audit department is the Group’s independent third line function. Its role includes:

• delivery of a risk-based audit plan to provide assurance on key areas of risk and compliance; 
• administrative maintenance of the Group’s risk registers, including the annual review process with risk owners and relevant subject matter experts; 
• facilitation of the annual principal and emerging risk survey of the Board and senior management;
• Producing routine principal risk reporting for the Board; and
• provision of an annual summary report on the effectiveness of risk management and internal control.