
Risk management
continued
Responsibility for risk
With respect to risk, we believe the role played
by our operational teams and management
is just as important as the role played by the
Senior Management Team, the Audit & Risk
Committee and the Board. While the Board
has overall responsibility for the management
of risks, it is our open culture of ownership and
responsibility for the governance of risk that
sets the tone across the business.
Risk identification
Our approach to risk combines a top-down
strategic view that meshes with a bottom-up
reporting and escalation culture. It is critical to
empower our people to speak up and to provide
the right conditions for risk identification,
discussion and escalation. The strategic view
involves assessing our external environment
in order to evaluate the risks to which we are
comfortable being exposed, as we pursue our
performance objectives – our risk appetite.
The bottom-up reporting culture allows for the
identification, management and monitoring of
risks in each area of the business, thus ensuring
that risk management is embedded in our
everyday operations.
Once identified, the management, tracking
and control of risks is provided through our
risk register, which in turn helps us to steer the
strategy of the business.
Risk measurement and tracking
We developed our risk register so that the key
risks we identify can be scored, with actions
taken to mitigate and control them tracked and
monitored. The risk register was established
during the IPO process and is owned and
developed by the Senior Management Team.
The risk register sets out the key strategic and
climate-related risks identified by the Senior
Management Team plus those risks identified in
each of our business segments and functions.
The risk register assigns an owner to each risk,
together with an assessment of the impact
and likelihood of occurrence. It scores the risk
in two ways: on an inherent unmitigated basis;
and on a mitigated basis having taken account
of internal controls and appropriate steps
being taken to minimise impact or reduce the
likelihood of occurrence. The register also keeps
a record of actions to be undertaken in the
future to further mitigate the impact of the risk.
The risk register helps to identify the actions
required going forward to:
•
ensure greater consistency of controls across
the business
•
consider the need for additional controls or
a change to current systems and processes
•
protect the business from unexpected events
•
improve the efficiency and effectiveness
of financial and operational systems and
processes
Tracking principal risks and
uncertainties
In the second half of the year, we developed
a new methodology in order to track the
changing risk profile of our principal risks and
uncertainties. Five “indicator risks” from our risk
register have now been assigned to each of our
principal risks and uncertainties. The indicator
risks have been identified by our Senior
Management Team and selected because they
are most closely related to (and contribute
towards) the relevant principal risks. As part of
our quarterly risk review process, we aggregate
the risk scorings for the indicator risks assigned
to each principal risk – giving us an overall risk
score for each principal risk, which is tracked
quarterly to highlight assessment trends. This
is a useful data point that helps our Senior
Management Team and Board monitor the
evolution of our principal risks and uncertainties.
Our Senior Management Team can also replace
the indicator risks at any time if they become less
relevant compared to others, including any new
risks added to the register from time to time.
In the diagram on page 67, we show the current
risk scoring for each of our principal risks and
uncertainties arising from our latest review.
Risk management and monitoring
Performance monitoring of risk management
activity must ensure that the treatment of
risks remains effective and that the benefits of
implementing risk control measures outweigh
the costs of doing so. Performance monitoring is
a continual review not only of the whole process,
but also of individual risks or projects and of
the benefits gained from implementing control
measures. For the year ended 31st December
2022, the Board considered that our risk
management processes remained effective.
Our process for managing risk is:
(i)
Identify realistic risks
This involves looking externally at the
market, and internally at financial and
business operations, to establish the events
and trends that could impact us. This is an
ongoing activity as part of daily
engagement between management and
teams across the business. As part of our
quarterly strategic review, our Senior
Management Team dedicates time to
reviewing and updating our assessment of
existing risks tracked on our risk register
and our principal risks and uncertainties, as
well as horizon scanning for emerging risks
that may impact us in the future.
(ii)
Analyse their potential impact and
likelihood
For all risks identified, we assess the
likelihood of their occurrence and the
potential consequence or impact of that
occurrence on both an inherent
(unmitigated) and a mitigated basis, after
having accounted for appropriate steps
being taken to control, monitor and minimise
their impact.
(iii)
Score risks to prioritise their management
The likelihood and impact of each risk on
business performance is calculated in order
to score each risk and enable prioritisation
of resources towards actions recorded on
the risk register. We also use these scores to
calculate our overall scoring for each of our
principal risks and uncertainties as
described above.
(iv)
Address risks to minimise their impact
Once scored, we establish which risks are
considered acceptable and which need to
be further addressed. For acceptable risks,
appropriate mitigation steps are assigned
for implementation and tracking. For
unacceptable risks, strategies are
developed to avoid them to the extent
possible and plans made so that the
business is ready to deal with them and
minimise their impact should they occur.
The outcome of this step is a prioritised list
of risks and actions which the business can
act upon and allocate resources towards.
(v)
Continually monitor the situation
We continually check for risks occurring,
new risks emerging and changes in the
assessment of existing risks in order that
these can be reviewed and dealt with
competently. The risk register is reviewed
on an ongoing basis by the Senior
Management Team, with a formal quarterly
update and on a biannual basis by the
Board, with the Audit & Risk Committee
conducting an in-depth annual review.
Our risk management framework and internal
control environment can be seen on page 66.
Strategic Report
Governance
Financials
Pod Point
Annual Report and Accounts 2022
65