Annual report and accounts
for the year ended 31 May 2023
Protecting clients and
helping to build a more
secure digital future
NCC Group plc Annual report and accounts for the year ended 31 May 2023
In this report
NCC Group is a people-powered, tech-enabled global
Cyber Security and software escrow business. We
harness our collective insight, intelligence and innovation
to power end-to-end cyber services that protect our
clients from cyber threat.
Strategic report
1 Highlights
2 At a glance
4 Our investment case
5 Our strategic roadmap
6 Chair’s statement
9 CEO’s review
14 Our business model
16 Meet the CTO
18 Market dynamics
24 Our strategy
29 Meet the COO
32 Our solutions
35 Meet the Global Managing Director
40 Stakeholder engagement
42 Culture
46 Non-financial and sustainability
information statement
53 TCFD
60 Meet the CFO
61 Financial review
70 Principal risks and uncertainties
81 Viability statement
Governance
84 Chair’s introduction to governance
87 Governance framework
88 Board of Directors
90 Executive Committee
92 Board composition and division
of responsibilities
102 Shareholder engagement
103 Audit Committee report
110 Nomination Committee report
113 Cyber Security Committee report
115 Remuneration Committee report
138 Directors’ report
142 Directors’ responsibilities statement
Financial statements
144 Independent auditor’s report
152 Consolidated income statement
152 Consolidated statement
of comprehensive (loss)/income
153 Consolidated balance sheet
154 Consolidated cash flow statement
156 Consolidated statement of changes
in equity
157 Company balance sheet
158 Company cash flow statement
159 Company statement of changes
in equity
160 Notes to the Financial Statements
Additional information
215 Glossary of terms – other terms
217 Other information
218 Financial calendar
Intelligence
Read more on page 38
Read more on page 30
Read more on page 22
Insight
Innovation
It’s in our DNA
It’s what makes us different. A part of who we are
that underpins everything we do.
View our latest results: nccgroup.com
While the market conditions we announced in our
March Trading Update have impacted our FY23
Mike Maddison
Chief Executive Officer
Highlights
1 Net (debt)/cash excluding lease liabilities, Adjusted operating profit and Adjusted EPS are APMs and not IFRS measures. See Note 3 for an explanation
of APMs and adjusting items. Further information is also contained within the Chief Financial Officer’s Review on pages 60 to 69.
1 Adjusted operating profit is an APMs and not IFRS measure. See Note 3 for an explanation of APMs and adjusting items. Further information is also
contained within the Chief Financial Officer’s Review on pages 60 to 69.
Headlines
Revenue
(£m)
£335.1m
Net (debt)/cash excluding lease liabilities
1
(£m)
£(49.6m)
Adjusted operating profit
1
(£m)
£28.8m
Adjusted EPS
1
(p)
6.1p
Basic EPS
(p)
(1.5p)
263.7
21
21 21 21
21 21
30.7 7.6
9.6 2.3
250.7
20
20 20 20
20 20
33.7 9.2
17.8 4.9
19
19 19 19
19 19
23
23 23 23
23 23
335.1
28.8 6.1
22
22 22 22
22 22
270.5
314.8
83.3 39.2
48.1
9.5
10.8
14.8
31.0 7.4
3.6
(£m)
£(4.3m)
IFRS measures
Alternative Performance Measures
We made significant progress implementing our Next Chapter strategy in a challenging environment:
•
Market dynamics reinforced the need to implement our
new strategy
•
While material clients were retained, we saw delays in buying
decisions and project cancellations in the North American tech
sector and the UK market in general
•
In our Cyber Security business we saw growth in Europe,
and the UK and APAC region with a decline in North America
•
Our Software Resilience business returned to revenue
growth in H2
•
Current trading for the Group is in line with expectations
with cost efficiencies already being realised in FY24. North
America Cyber Security revenue performance experienced in
H2 FY23 is currently annualising through H1 FY24 giving rise
to YoY double digit Q1 revenue decline
•
FY24 revenue and Adjusted operating profit
1
expectations
remain the same
NCC Group plc 1
Strategic report
We protect the development, supply and
use of business critical technology and
software applications:
•
Buyers are safeguarded from supplier failure, software
vulnerabilities and unforeseen technology disruption
•
Our on-premise and cloud offering can demonstrate
robust business continuity and risk mitigation,
and suppliers benefit from enhanced credibility
and intellectual property rights protection
•
Escrow contract services secure the long-term availability
of business critical software data and applications
•
Our verification services assure clients that the
knowledge and guidance are readily available to
manage, maintain or recreate an application from
the original source, should it ever be needed
•
helps clients transition to the cloud securely, so they
can adopt the latest technology with confidence
NCC Group is a global Cyber Security and Software Resilience business operating
across multiple sectors, geographies and technologies.
The trend of technological change within increasingly complex, connected ecosystems, means cyber threats continue
to evolve and grow at pace.
We bring decades of collective experience and expertise across the whole cyber spectrum to assess, manage
and deliver cyber resilience for clients in both the public and private sector.
We are driven by a collective purpose – to help create a more secure digital future.
Our business
We have two distinct businesses, through which we deliver solutions to support our clients’ operational goals, budgets
and risk appetite, providing confidence that their most important assets – business reputation, software and personal
data – are safe and secure. As we went to print we concluded the new distinct brand for our Software Resilience
business to Escode, which will roll out from January 2024. See page 36 for more about this.
We demystify cyber and ensure clients:
•
Understand the cyber threats and vulnerabilities
across their technology environments, supply chains,
processes and products
•
Maintain their licence to do business, having achieved
their governance, compliance and accreditation
objectives in a changing regulatory environment
•
Materially improve their resilience against ever-
increasing cyber threats by implementing remediation
plans and solutions
•
Reduce risk and achieve greater resilience for
less investment
•
Can improve their cyber defence operations and
increase their confidence in detecting and responding
to cyber event
At a glance
Read more on Our solutions on page 32 Read more on Our solutions on page 34
What we do
CYBER SECURITY
NCC Group plc 2
Group revenues
North America
£133.8m
Europe
£57.1m
UK and Asia Pacific
£144.2m
We operate as one global business, with in-country delivery tailored to local needs and
cultures, as well as a global delivery team to respond quickly to our clients’ challenges.
We have a significant market presence in the UK, Europe and North America, and a growing footprint in Asia Pacific,
with offices in Australia and Singapore, and our new global delivery and operations centre in Manila, the Philippines.
Our offices
Key:
Where we operate
Cyber Security revenue
£270.8m
•
Global Professional Services: £199.3m
•
Global Managed Services: £67.8m
•
Products: £3.7m
£64.3m
Software Resilience revenue
•
Escrow contracts: £42.8m
•
Verification services: £21.5m
NCC Group plc 3
Strategic report
Our investment case
With decades of experience and a
We draw on our expertise, capabilities and global footprint to develop sustainable
solutions to help our clients meet their current and future cyber security challenges.
With the ability to attract top talent with both technical expertise and passion,
we continue to deliver results in what is a competitive and dynamic market.
•
Cyber Security is not optional; increasingly it’s a C-suite
and Board issue to operate safely, protect reputation
and comply with growing regulatory requirements
•
The global threat landscape continues to evolve as
new technologies enable even more connectivity in our
day-to-day lives, creating new, larger and more complex
vulnerabilities for threat actors to exploit
•
Global Cyber Security market is expected to exhibit
a CAGR of 10% between 2022 and 2027
1
Structural growth in an addressable market
•
Cyber Security: a global footprint protecting companies
against an evolving spectrum of cyber threats
•
managing commercial risk with software vendors
•
Underpinned by insight, innovation and intelligence
across our whole organisation
Client focused with two distinct businesses
•
Focused on broadening our Cyber Security offer in
priority sectors, ensuring clients address their full
Cyber Security lifecycle
•
Building an alliance ecosystem to enhance routes
to market, and developing our global delivery model
to better serve client needs in the future
•
Complemented by a focused acquisition strategy
where it makes strategic and financial sense
A strategy to enhance growth by focusing
on Cyber Security
•
Investment in professional development with career
paths to promote talent from within
•
Established next generation talent programme bringing
new cyber talent from non-traditional tech backgrounds
•
Partnerships to enhance diversity and make cyber
accessible for all
A hub for both attracting and developing
talent and active alumni network
Read more about our Cyber Security business on pages 32
and 33. Read more about our Software Resilience business
on page 34
Read more on page 27
Read more on page 43
www.expertmarketresearch.com/pressrelease/global-cyber-security-market
4 NCC Group plc — Annual report and accounts for the year ended 31 May 2023
Our aspiration is to move beyond our historical strengths to
become a truly global Cyber Security and Software Resilience
services provider capable of delivering an end-to-end cyber
solution that harnesses our strengths in insight, intelligence and
innovation and is accompanied by a fantastic client experience.
Creating a more secure digital future.
Vision Purpose
Our strategic roadmap
We are guided by our Code of Ethics – treating everyone and everything with respect,
underpinned by common values to bring us together.
Our Code of Ethics and values
Read more on our culture on pages 42 to 45
We embrace difference We take responsibilityWe work together We are brilliantly creative
It is essential that we all proactively manage any risk to our safety and security. Our purpose is to help
organisations to do this by keeping their personal data, and the technology and devices they use, as well
as the critical assets and software they rely on, safe and secure. It’s what drives our strategic roadmap:
We have a relentless focus on creating value for our stakeholders. Guided by our purpose, focused on our vision,
we will continue to evolve and transform with our new growth strategy focused on four core areas:
Insight InnovationIntelligence
adapt to changing environments and deliver exceptional value for our clients.
Creating growth by putting the client experience at the heart of our proposition
Creating value for our clients
Read more on our strategy on pages 24 to 27
Our clients
on the most pressing Cyber
Security needs.
Our capabilities
Broader service portfolio
addressing the full Cyber
Security lifecycle.
Global delivery
Transitioning from an
international to a fully
global business.
Brands
brands for Cyber Security
and Software Resilience.
Read more on our business model on pages 14 and 15
NCC Group plc 5
Strategic report
2022/23 key activities
•
Developed and communicated
the Group’s next chapter strategy
•
Completed the full operational review
of the Software Resilience business
to create additional contribution
•
Commenced a strategic review
of Software Resilience
•
Commenced planning for a new global
delivery and operations centre in Manila
•
Improved Board and executive
management diversity and enacted
succession planning
•
Planning the broad restructuring
of the business
2023/24 priorities
•
Realise cost efficiencies across Cyber
Security and corporate functions
•
Implement our next chapter strategy
with a renewed focus on priority sectors
and development of end-to-end
Cyber Security services
•
Open the new delivery and operations
centre in Manila
•
Complete the rebrand of both
Software Resilience and Cyber
Security businesses
•
Revisit the strategic review
of Software Resilience
Chair’s statement
It has been a challenging
year for NCC Group.
Chris Stone
Non-Executive Chair
Introduction
It has been a challenging year for NCC Group. Despite the
decline in the rate of our revenue growth and the loss for the
year, our new strategy, which gives us a clear direction of travel,
fills me with optimism that we are on track for a brighter future.
This was very much a year of two halves. We enjoyed a strong
first half, which saw us post strong revenues and profits, but our
North American and UK Cyber Security businesses were materially
affected by changes in the macro-economic environment in the
second half. We are trusted partners to the most significant
businesses on the North American West Coast – and each one
of these businesses paused projects as they grappled with their
own costs and made extensive layoffs. This led to a reduction in
our revenues with a direct impact on utilisation and margins.
While this had a considerable effect on our revenues in the year,
it validated the next chapter strategy set out in February 2023
by our new CEO Mike Maddison following his appointment in
July 2022. It’s a strategy designed to set us up for consistent,
global growth creating a sustainable business. By focusing on
clients, our capabilities, global delivery and brand, harnessing
insight, innovation and intelligence, we’ll be more resilient in the
future. A tangible difference to our business will be the creation
of more recurring revenues, giving us a more stable base.
6 NCC Group plc — Annual report and accounts for the year ended 31 May 2023
There were several positives in the year, and we are pleased
with the performance of our Software Resilience business.
Our strategic review announced at our half-year results has
been stopped and will be revisited later in the calender year.
This ensures a focus on navigating the market conditions for
Cyber Security and implementing strategic actions, so the Group
is well positioned to return to growth when the market improves.
In the meantime, the Software Resilience business continues
to grow and reap the benefits of our acquisition of IPM last year
– making us the largest software escrow player globally.
The operational improvement programme and new management
team that we announced last year have delivered the expected
benefits, and we will see the consequent improvement in Software
Resilience operating profit margins flow through into next year’s
results, as well as the benefit we have experienced this year.
In our Cyber Security business, while our financial performance
was ultimately disappointing due to the drop off in short-term
demand from clients in the US West Coast tech sector in the
second half, our underlying technical capability and our next
chapter strategy give us solid foundations to diversify our client
base. There is a reason the biggest brands in the world trust us
to manage their security, and the executive team is building on
this trust while ensuring our Cyber Security offer is wholly
designed around the needs of our clients. This is why the
creation of a new global delivery and operations centre is a
central element of the strategy, reflecting our focus on adapting
to the changing needs of our clients.
Further details on our strategy and business model are provided on
pages 24 to 27 and pages 14 and 15 respectively
Business performance
1
currency
1
decreased by 2.7% pts to 39.4% due to reduced revenue
contribution from Global Professional Services within Assurance
utilisation, offset by an improvement in Software Resilience
revenue contribution.
1
and Adjusted operating profit
1
•
offset by an improvement in Software Resilience profitability
which was driven by improved operating efficiency, as
targeted at the time of the May 2022 operational review
•
and an increase in base interest rates. All of the above, resulted in a
1
of 6.1p
This performance led us to a broad restructuring of the business,
which has been planned and implemented with the assistance of a
third party and has given rise to Individually Significant Items and
cost efficiencies being realised in FY24.
1
1
1
Total borrowings (including lease liabilities) offset by cash and
Our business performance can be found in more detail on page 61
Dividend
the register at the close of business on 10 November 2023.
The ex-dividend date is 9 November 2023.
Board and executive management composition
I am responsible for the leadership of our Board, and I am very
pleased with the progress we have made to increase diversity
across both the Board and the executive team. We appointed
Lynn Fordham to the Board on 1 September 2022 and she
is Head of the Audit Committee as well as the appointed
who joined us in 2022, has taken over as Senior Non-Executive
Committee. In addition, I am very pleased with our internal
promotion of Guy Ellis to Chief Financial Officer following
Tim Kowalski’s decision to step down on 30 June 2023 after
five years in the role.
our Software Resilience business, and most recently as
roles in the retail sector for brands including Asda and
Specsavers. This experience and the recent interim roles in NCC
Group have given him a breadth of understanding of the
commercial drivers and operations across the whole business.
Turning to our executive management team composition, Mike
Maddison has continued to review the organisation and made
good progress in establishing a new Executive Committee, with
Officer). I am confident this diversity of perspectives and
experiences will ensure we make better Board and executive
decisions, particularly as the business starts to execute its next
chapter strategy in earnest.
Further details on our Board composition are provided on pages 92 to 101
Further details of our executive management composition are provided on
pages 90 and 91
NCC Group plc 7
Strategic report
Sustainability
We continue to recognise the importance of an environmental,
operations and measures our sustainability and ethical impact.
The Board had a debrief workshop with our environmental
partner Planet Mark as part of developing our net zero journey.
We also fully supported the partnership with Ever Sustainable to
lead our independent materiality assessment – looking at not
only inward but also outward impacts – addressing future
requirements to comply with the European Corporate
sustainability strategy fully supports and will be integral to our
business strategy and I am proud of the continuous improvement
we make year on year regarding ESG factors.
Further information on risk management and the key risk identification
procedures is set out on pages 70 to 80
Summary
Overall, this year and in particular the second half, has been
challenging. The drop in value of our business has been
disappointing, and the Board and Executive Committee are fully
focused on restoring shareholder value. However, this has also
been a particularly challenging year for our colleagues, and on
behalf of the Board I offer our thanks and appreciation for their
unwavering commitment and focus. As always, I am personally
very grateful for their continuing commitment to NCC Group.
It is through this continued hard work that we will achieve
our vision to become the leading Cyber Security and Software
Resilience provider globally. We move into this next phase
whereby we will realise cost efficiencies across Cyber Security
and corporate functions and implement our next chapter strategy.
Chris Stone
Non-Executive Chair
operating profit, cash conversion and net debt excluding lease liabilities
are APMs and not IFRS measures. See Note 3 for an explanation of APMs
and adjusting items. Further information is also contained within the
Financial Review.
Chair’s statement continued
NCC Group plc 8
2022/23 key activities
•
Completed an operational review
of the Software Resilience business
to create additional Group contribution
•
Introduced the next chapter
of our strategy
•
Created a new executive team
•
Embraced new ways of working
including hybrid
•
Commenced planning for a new global
delivery and operations centre in Manila
•
Planning the Restructuring of the business
following H2 FY23 performance
2023/24 priorities
•
Realise cost efficiencies across Cyber
Security and corporate functions
•
Embed our new strategy with a renewed
focus on our clients, priority sectors and
development of end-to-end Cyber
Security services
•
Open the new delivery and operations
centre in Manila
•
Continue focus on relevant
stakeholder engagement and
evolve our sustainability agenda
CEO’s review
An ever-changing market
There is only one certainty in our industry: change.
I have worked in this space since the 1990s when “computing
security” was a niche specialism. Today, Cyber Security is
high on the risk registers of every enterprise and government
in the world, and this industry will continue to change as Cyber
Security becomes even more fundamental to societies and
economies. Our lives are becoming more digitally connected
each year, cyber criminals and nation states are constantly
innovating and improving their attack capabilities, and AI and
quantum computing have the potential to cause paradigm shifts
that will reverberate around the globe.
As a business we have to be alive to the pace of this change.
If we stand still, we will be left behind.
Our next chapter strategy is designed to address this challenge
head on, creating an organisation that gets ahead of its market
drivers with foundations that are fit for today and the future. It
is relentlessly focused on clients and our ability to address the
issues they face.
I want to thank colleagues
challenges this year. They
and the resilience they have
shown in the circumstances
Mike Maddison
Chief Executive Officer
Strategic report
9NCC Group plc — Annual report and accounts for the year ended 31 May 2023
An ever-changing market continued
It sees us become even more globally integrated, while confidently
telling our story with an energised, simplified brand. This is why
optimistic about where we are heading.
NCC Group exists to make the world safer and more secure.
This purpose remains unchanged. But the market has changed
around us, so as a business we must adapt.
A client-centric approach
When I joined NCC Group I was immediately struck by the breadth
and depth of our technical expertise. It is truly world class. Our
insight, innovation and intelligence are respected globally.
This expertise sits at our core. However, we have to unlock its
potential by harnessing it to create solutions that are designed
around the needs of our clients.
This starts with clarity around the markets we serve. It’s why our
strategy sees us focus on our fastest growing sectors – specifically
those which are highly regulated and most exposed to cyber risk,
like financial services, industrials and technology. We will build
deeper relationships at the C-level within those businesses to
give us the opportunity to move beyond transactional sales and
into the position of trusted advisor. We have brilliant individuals
in our business who are already working at this level, but we will
invest in the right talent to enable scale.
With that in place, we can properly unlock the potential of our
expertise and be a true end-to-end Cyber Security services
partner that can deliver business outcomes.
In practice, this means rather than simply testing a client’s
infrastructure annually, we’ll also work with them to address the
security vulnerabilities we discover. Rather than providing a
one-off incident response to a client following a cyber-attack,
we’ll provide consultancy and remediation after the event to
enable greater resilience – and then manage their Cyber Security
operations 24/7.
This is why we are making targeted investments into specific
capabilities – like building out our consulting team and enhancing
our Managed Services offering. It is all driven by our target
customers and their needs.
We will have all the constituent parts to continually create these
customer journeys. Our strategy sees us knit them together to
ensure consistent, consultative client relationships globally – all
powered by our unrivalled technical expertise.
Further details on this are provided on pages 24 to 27
True global delivery
As our industry continues to change, the way we deliver work is
changing too. A standard penetration test – the evaluation of
software or hardware to identify security vulnerabilities – is
ago. We are now more efficient, there is more automation, and
we can test on a much larger scale.
The need for us to continually adapt was underlined during the
pandemic. A significant amount of testing that previously took
place on site at secure client locations was being delivered
remotely. It showed that some low-level testing could be done in
a different way, and at a lower cost.
Fast forward to 2023 and the cost cutting across the industry,
and layoffs led by North American West Coast tech firms accelerated
this move and we felt this acutely. Clients still need this service,
but they want it delivered in a more cost-effective way.
This shift has informed our strategic focus on global delivery and
flexible resourcing. We can get better at using capabilities in our
expertise for an Australian assignment. Our delivery has been
too local and rigid in the past.
It’s been a driving factor in our decision to open in September
2023 an offshore delivery and operations centre. Some of the
best Cyber Security talent in the world is found in emerging
this investment will mean we can harness that talent and
complement it with our existing colleagues to be more flexible
to
our clients’ needs.
We are trusted by governments and the most highly regulated
organisations to test and manage their security. There will
always be demand for in-market talent to work on sensitive,
complex programmes of work. Our new delivery and operations
centre simply means we can expand our capabilities and provide
more value for our clients.
Further details on this are provided on pages 24 to 27
Communicating with impact
We also have an opportunity to better tell our story and explain
the value we offer.
We provide counsel to governments around the world on high
level Cyber Security issues. We are handpicked by the most
significant businesses globally to protect their digital assets. We
are trusted by critical national infrastructure providers to secure
their systems and keep them running.
This trust has been created through our insight, intelligence and
innovation. It has taken years to build. It enables us to act as a
convenor of decision makers – on policy, regulation and the macro
forces affecting our collective ability to secure our digital future.
This credibility and track record should form the core of our
messaging. We have a unique position in the market. As a client,
this is what you gain access to when you engage with us. Yet we
have been reluctant to talk about it.
We are going to seize this opportunity, with our new Chief
Marketing Officer bringing together our global marketing,
communications and public affairs team to deliver on this
strategy. It starts through the creation of distinct and relevant
brands for Cyber Security and Software Resilience, with clearer,
simpler propositions. From here we will focus on boosting our
profile through marketing programmes designed around the
C-suite in our target sectors. We will become more present,
more active and bolder in our marketing and communications.
We are trusted by the
globally to protect their
CEO’s review continued
NCC Group plc 10
Financial performance summary
It’s been a challenging year for the Group with a decline in the
rate of revenue growth and overall profitability, resulting in a loss
for the year. Our revenue performance and profitability suffered
from the market dynamics within Cyber Security. In particular,
the Group experienced buying decision delays and cancellations
in the North American tech sector and to a lesser extent in our
UK market, effecting our Global Professional Services revenue
and overall gross profit performance. These headwinds have
further reinforced the need to accelerate the implementation of
our next chapter of the Group strategy.
1
prior year Software Resilience fair value revenue adjustment
2
, Group revenues were flat at constant currency
1
at actual rates).
In our Cyber Security business, the Europe and UK and APAC
businesses grew on a constant currency basis
1
currency basis
1
tech sector spend.
constant currency basis
1
1
In our Software Resilience business, following the completion of
the acquisition of IPM in June 2021, we experienced our first full
year of IPM contract renewals which contributed to overall
1
to
total Software Resilience revenue (on an unaudited pro forma
1
pleasing to see that our new leadership team (appointed in November
growth, price rises, and realisation of efficiency contribution
targeted at the time of the May 2022 operational review.
performance of the Cyber Security business and the consequential
and training costs arising from inflationary pressures and further
travel and office costs (including the impact of our NCC
1 Revenue at constant currency is an Alternative Performance Measures
and adjusting items, including a reconciliation to statutory information.
2 See Note 3 for an explanation of unaudited proforma total Revenue and a
Revenue is an APM and not a IFRS measure.
NCC Group plc 11
Strategic report
2023 2022
Cyber
Security
£m
Software
Resilience
£m
Central
and
head office
£m
Group
£m
Cyber
Security
Software
Resilience
Central
and
head office
Group
Revenue 270.8 64.3 – 335.1 –
Cost of sales – –
Gross profit 86.1 45.9 – 132.0 92.3 40.3 – 132.6
Gross margin % 31.8% 71.4% – 39.4% 71.6% – 42.1%
2
Adjusted EBITDA
1
15.4 31.2 41.4 39.1
Adjusted operating profit
1
6.9 30.6 28.8 31.9 22.0
Amortisation of acquired
intangibles
Share-based payments
Individually Significant Items – – –
Operating (loss)/profit 22.3 1.9 16.0 34.7
Operating margin % 34.7% n/a 0.6% 11.2% n/a 11.0%
Finance costs
31.0
Taxation
23.0
EPS
Basic EPS 7.4p
Adjusted basic EPS
6.1p
items. Further information is also contained within the Financial Review.
2 Administrative expenses excludes depreciation and amortisation, Individually Significant Items, amortisation of acquired intangibles and share-based payments.
Assurance business following the recent reduction in spend
reorganisation costs as we reshaped the Group to implement
the next chapter of the Group’s strategy. The impairment of
North American Goodwill has been recognised based on the
annual assessment of circumstances as at 31 May 2023. ISIs
also include costs associated with the strategic review of our
reorganisation. These were partially offset by a profit on
profit performance, increased ISIs (mainly the impairment of
North American Assurance Goodwill) and increased borrowing
1
amounts to 6.1p
At 31 May 2023, our cash conversion
1
Net debt
1
excluding lease liabilities
1
Total borrowings (including lease liabilities) offset by cash and
Financial performance summary continued
1
level,
Adjusted operating profit
1
gross profit and overall profitability and an improvement in Software Resilience gross profit and overall profitability is disclosed below
and reconciled to profit after taxation:
CEO’s review continued
NCC Group plc 12
A global leader
We have faced a number of challenges this year. We’ve had to
make some difficult decisions to ensure we are set up to achieve
our purpose – to create a more secure digital future.
I want to thank colleagues for their support during the
challenges this year. They have been truly remarkable and
the resilience they have shown in the circumstances has been
inspiring. And it’s this resilience, which provides the foundations
for us to execute our strategy and make NCC Group the global
leader in Cyber Security, and Escrow Software Resilience services.
We will emerge as a more confident and sustainable business
built around the needs of our clients – one that is set up to adapt
to our ever-changing industry.
This confidence is already starting to emerge as our strategic
relentless focus on being a global, agile and client focused
business led by my new leadership team with recognised deep
cyber industry experience, is resonating with our stakeholders.
I’m particularly proud of the efforts of a multi-disciplinary team,
who have enabled our new global operations and delivery centre
in Manila to launched in September 2023. Not only do we have a
fully staffed business ready to go, led by Saira Acuna, who
previously ran our sales and client experience team in the APAC
region, but we’ve also won work that we wouldn’t previously
have won as a result.
This is just one example of the progress being made across the
strategy and if we continue to execute on what we said we would
do – the future is bright.
FY24 current trading
Current trading in line with expectations with:
•
Cost efficiencies across Cyber Security and corporate
functions already being realised
•
Global Professional Services sales orders stabilised, no
material clients lost, however North America revenue performance
experienced in H2 FY23 is currently annualising through H1
FY24 giving rise to YoY double digit Q1 revenue decline
•
YoY double digit Q1 revenue growth in Global Managed Services
•
YoY single digit Q1 revenue growth in Software Resilience
against a low comparator
Outlook
•
The Board expects FY24 to be a period of considerable
change for the Group, targeting a modest improvement in
Group Adjusted Operating profit driven by both the Cyber
Security and Software Resilience businesses
In Cyber Security:
•
We expect low single digit revenue growth driven by stronger
This will offset the annualisation of the sales declines in North
American Professional Services and UK Professional Services
experienced during H2 FY23
•
Security) and corporate functions as announced in the June
2023 trading update and are on track to meet these
In Software Resilience:
•
We expect revenue growth in low single digits, underpinned
by sustainable actions successfully taken on pricing and sales
execution. The operating profit growth will be delivered net of
in-year systems investments that will realise newly identified
The Board is confident that continued execution of the strategy
will deliver double-digit revenue growth and mid-teens operating
profit margins from FY26 onwards.
Strategy
•
Execution of the Next Chapter strategy progressing well
following key leadership appointments with deep industry
recognised expertise
•
New global delivery and operations centre opened in Manila
in September 2023
•
New distinct brand for our Software Resilience business will
roll out early in 2024
Mike Maddison
Chief Executive Officer
NCC Group plc 13
Strategic report
Our business model
We draw on our expertise, capabilities and global footprint to develop solutions tailored to
sectors most at risk to meet current and future cyber challenges. We help to educate policymakers
and regulators and we give back to protect our local communities. To address the changing
landscape NCC Group needs to continually evolve. In February 2023 we launched our next
chapter strategy, resetting how we go to market aligned with our clients’ changing needs.
Read more on market dynamics on page 16
Sustainable growth strategy
In a fast-moving and complex environment,
our strategy puts clients’ needs first, with a
roadmap of investments designed to develop
future capabilities and a global delivery model
to provide clients with the best solution.
People-powered, tech-enabled
We are a diverse global community of talented
and creative individuals, working together and
united by the same goal – to make the digital
world safer and more secure.
Culture of innovation
With our roots stretching back to the 1990s
we have a track record of being at the cutting
edge of innovation. NCC Group was created
in 1999 when the National Computing Centre
sold its commercial divisions to its existing
management; from there we continued to
grow through acquisitions. And while history
is important, so is the future, with innovation,
insights and intelligence the core elements
Stronger partner relationships
We are active members of the global cyber
community, working in collaboration and in
partnership with key industry players. Many
successful global partnerships have delivered
integrated, seamless solutions to clients.
Market-leading reputation
We understand our clients’ challenges and the
risks to their business. We continually enhance
our global delivery model to bring our insights,
intelligence and innovation together to help
clients understand and improve the cyber
resilience posture.
Read more on our strategy on pages 24 to 27
environments and deliver exceptional value for our clients.
At the heart of our proposition is a global delivery model, from our
new state of the art centre in the Philippines, to our hubs in Australia,
Europe, North America, Singapore and the United Kingdom. This enables
us to deliver our complete range of cyber and escrow services in the
most efficient and cost effective way for our clients.
I
n
t
e
l
l
i
g
e
n
c
e
I
n
n
o
v
a
t
i
o
n
E
s
c
r
o
w
M
a
n
a
g
e
d
S
e
r
v
i
c
e
s
C
o
n
s
u
l
t
i
n
g
&
I
m
p
l
e
m
e
n
t
a
t
i
o
n
T
e
c
h
n
i
c
a
l
A
s
s
u
r
a
n
c
e
C
y
b
e
r
I
n
c
i
d
e
n
t
R
e
s
p
o
n
s
e
I
n
s
i
g
h
t
How we create value
Inputs
NCC Group plc 14
How we create value
Colleagues
We strive to create a safe and respectful
environment where everyone is empowered
to be their very best, able to follow their
vocation and say with conviction that what
they do helps make our digital society safe
and secure.
Clients
Our resilience solutions enable clients
to confidently innovate and embrace
new technologies, and build responsible,
sustainable and resilient organisations
that thrive and succeed.
Our network
We engage proactively to ensure our insights
and vision deliver the best societal outcomes
in support of our mission. Our expertise provides
access to basic cyber knowledge for the
communities we live and work in.
Shareholders
We operate responsibly aiming to create an
inclusive and diverse workplace, taking action
to reduce our impact on the environment.
We strive to be an ethical, responsible employer
and supply chain partner to ensure future
long-term growth and return on investment
opportunity for our shareholders.
Read more on stakeholder engagement
on pages 40 and 41
Value creation
We operate two distinct businesses offering clients
a range of services to help secure their digital assets:
Specialist solutions that protect business critical technology
and software applications. Our proposition safeguards buyers
from various risks, provides robust business continuity, secures
long-term availability of essential business software, and offers
assurance and guidance for application management. And with
our Escrow-as-a-Service proposition, we facilitate a secure
transition to the cloud, enabling clients to adopt cutting-edge
technology with confidence.
Read more on page 34
Providing clients with a clear understanding of cyber threats and
vulnerabilities. We help them maintain their licence to operate,
by achieving governance, compliance and accreditation objectives.
By implementing remediation plans and solutions, we enhance their
resilience against cyber threats. We offer the option to outsource
cyber defence operations, as well as complementing existing
resources, to reduce risk, achieve greater resilience and give
confidence in detecting and responding to cyber threats.
Read more on pages 32 to 33
CYBER SECURITY
NCC Group plc 15
Strategic report
Meet the CTO
Q&A with Siân John
Siân John was appointed
Chief Technology Officer
NCC Group from Microsoft and
is the current Chair of techUK’s
Cyber Security Management
Committee and a council
member for the Engineering
and Physical Sciences
funding body for engineering
and physical sciences research
in the UK. She was awarded
an MBE in 2018 for services
to Cyber Security.
Q. Tell us a bit about your career so far
I’ve been immersed in technology for over 30 years and 25 of
those in cyber, starting off in the Houses of Parliament looking
after IT for the guys who carry the mace. I’ve since worked for
a number of major technology businesses, most recently with
Microsoft where I had a range of strategic Cyber Security roles.
The pace of change in the industry has been relentless, which
is one of the reasons I find this space so fascinating.
Q. What is your overall approach and ethos when
it comes to Cyber Security?
Security is often seen as a barrier to growth because
of a consensus that you can either be secure or productive.
But that’s simply not true. If we bake security into our products
and processes in a way that reflects the right level of risk,
it will actually unlock productivity. Security becomes
a competitive advantage.
I think it’s incumbent on us as Cyber Security advisors
to have digital empathy – and by that, I mean a real understanding
of the impact security measures have on the user. If we start
from that perspective, we typically end up with better solutions
to challenges that businesses face.
Q. What attracted you to NCC Group?
This is a business that is so well respected in our industry
because of the quality of its people.
NCC Group is known for having technical abilities at the
bleeding edge, and so the opportunity to work with some of the
brightest minds globally was one I simply couldn’t turn down.
Q. Talk to us about NCC Group’s insight, intelligence
and innovation
This is what gives us a position in the market that no one else
can match, and an offer to our clients that is incredibly strong.
Firstly, insight. We work with thousands of clients across
the world. We see directly the challenges they are facing.
We understand their pressures. We have a deep understanding
of what’s happening today, and where it might go tomorrow.
And we bring this to every client engagement.
We then add intelligence – our ability to see what threats are
out there in the wild in real time. What are our adversaries doing?
What techniques are they using? And what is the impact?
This means our advice to clients is solely focused on the
risks that matter.
And finally, innovation. This is where we drive the market
forward through our research – shaped by the challenges
we see our clients facing and the passions of our experts.
This is a combination that is unique to NCC Group and what
gives me so much confidence about our future.
16 NCC Group plc — Annual report and accounts for the year ended 31 May 2023
This is a business that is
so well respected in our
industry because of the
Siân John
CTO
17NCC Group plc
Strategic report
The ever-changing threat landscape and exponential digital transformation, coupled with
society’s continued reliance on digital technologies and increasing regulatory and legislative
requirements, mean investment in Cyber Security and Software Resilience is not optional
and NCC Group’s addressable market continues to grow.
A changing threat landscape
2022 was another year that kept us on our toes. The threat
landscape was heavily influenced by the conflict between Russia
and Ukraine, during which we have seen the whole arsenal of
offensive cyber capabilities, deployed by criminals, hacktivists
and nation state groups. Though perhaps not the “cybergeddon”
that some expected from the next big global conflict, we have
seen state-sponsored attacks ramp up, with cyber warfare
proving to be critical across this hybrid cyber-kinetic battlefield.
The threat from ransomware will remain. However, we are seeing
an evolution in the way groups operate not only because of
law enforcement intervention but also co-operation among
governments and regulations to tackle the problem. Groups will
continue to diversify operations and we have started to see less
focus on encryption of data and more emphasis on exfiltration
of data along with an increase in the use of distributed denial
of service attacks.
Threats will persist and organisations must remain vigilant
and understand how they could be exposed and take steps
to mitigate any risk.
show that successful ransomware attacks (where data encryption
was actually achieved and not just the prior phases) are only slightly
Ransomware: 40%
Business email
Coin mining: 13%
Banking malware: 7%
Data breach: 7%
Total hack and leak cases year on year
begun readjusting after any major internal changes (rebranding or redistributions) and thus are able
to compromise more victims.
350
300
250
200
150
100
50
0
Jan Feb Mar Apr May Jun Jul Aug Sep Oct Nov Dec
2021
2022
Number of hack and leak cases
Market dynamics
NCC Group plc 18
Society’s ever-growing reliance on digital technologies
There is no slowdown of the exponential digital transformation,
with investment continuing to be made in technologies, from the
increasingly ubiquitous use of machine learning and large language
models to significant public and private investment in future
supply chains upon which our connected environment depends
are complex and interdependent, a reality that’s been driven
home, too, by heightened geopolitical tensions and conflicts.
Increasing regulatory and legislative requirements
Governments around the world are trying to respond to a threat
landscape that is more dynamic than ever. We are seeing significant
growth in regulations and legislation globally, creating an ever more
complex environment for organisations to navigate and make sense
of, and we expect them to focus their cyber investments on
meeting growing regulatory requirements.
What is more, we expect the trend of growing cyber regulation
to
continue as thinking converges that: improved cyber resilience
is ultimately an issue of national security; the rising cost of cyber
crime needs to be tackled; and (better) regulation should unlock
growth, as the assured safety and security of digital technology
will drive trust, confidence and therefore uptake.
As a result, we expect to see more coherence and co-ordination
of
policy and regulatory initiatives across like-minded governments
around the world. For example, the governments of the UK, Canada
and Singapore published a joint statement of intent on Cyber
Security for Internet connected products. It signalled the three
governments’ intention to promote global alignment on standards
and security requirements, reducing “duplication of testing and
similar assessments and the challenge for industry of
needing to
apply to multiple schemes underpinned by identical or very similar
requirements”. See pages 22 to 23 for how we are contributing to
the changes to cyber-related policies and regulations across the world.
Hotspot map representing concentration of global attacks
events over the whole of 2022. We can see from the below
graphical representation the proportion of yearly global attacks
levied against the ten most targeted nations.
45.081.06
% of total
NCC Group plc 19
Strategic report
Other common trends include:
•
Shifting the “burden for security” to those with the broadest
shoulders: The US National Cyber Security Strategy announced
a clear shift in responsibility for cyber to software vendors and
manufacturers in March.
•
More confident regulatory interventions to define
dynamically what constitutes critical national infrastructure
in the digital sphere and make it more secure and resilient:
The UK announced plans to move forward with legislation
in November, extending its scope to managed service
providers, and giving the government powers to extend
the scope of NIS more easily.
•
Efforts around improving incident reporting, driven by the
desire to improve visibility and situational awareness of the
threat landscape more holistically: The Australian government
launched an updated Critical Infrastructure Resilience Strategy
and Plan in February, outlining those activities the Cyber and
community will pursue to enhance resilience, with a clear
focus on a greater role for the Trusted Information Sharing
•
Greater emphasis on developing frameworks and principles
for regulating technologies rather than detailed regulatory
proposals per se:
are underway in many jurisdictions – a common trend appears
to be the desire to open AI decision making to greater scrutiny,
as seen in the UK’s AI Paper, the US blueprint for an AI Bill of
Rights, and the AI Risk Management Framework and the
proposals. Similarly, many jurisdictions are working on plans to
develop (and regulate) central bank digital currencies, while global
initiatives are underway by the Financial Stability Board, and the
NCC Group’s continued portfolio evolution
and differentiation
As Cyber Security threats change and technology develops
to counter them, organisations are demanding fewer, more
comprehensive solutions rather than having to manage an
increasing number of interdependent but separate tools.
As client needs change in this fast moving, evolving threat,
technology and regulatory landscape, we are staying agile
to best serve them – and deliver on our purpose.
We are investing in our cyber capabilities. Above all, that means
a broader portfolio addressing the full Cyber Security lifecycle:
•
Maintain our high quality of Incident Response services
to help clients at their critical moments
•
Enhance the suite of Managed Services we offer to deliver
a global, high quality managed security service that is led with
world-class threat intelligence capability, provides transparent
value, and is delivered through a consistent technology stack
and operating model
•
Invest in our core Technical Assurance capabilities, such
as continuous, always-on cyber threat detection and
penetration testing
•
Building additional Consulting & Implementation services
proposition to help C-suite buyers confidently meet
increasing Cyber Security requirements
US National Cyber
Security Strategy
Significant shift away from
voluntary measures to regulation.
Digital Operational Resilience Act
Enacted.
NIS2
Enacted.
Cyber Resilience Act
In progress.
Cyber Solidarity Act
In progress.
Increase in regulatory developments across our key operating regions
Discussion paper on Australia’s
Privacy Act review
Security of Critical Infrastructure
Product Security &
Telecommunications
Infrastructure Act
NIS Regulations
Reforms progressing slowly.
App: Code of Practice
Consulting on software regulation
Market dynamics continued
NCC Group plc 20
As client needs change in this
technology and regulatory
landscape, we are staying
Strategic report
21NCC Group plc
It’s in our DNA
We understand the sectors our clients operate
in, including market trends, regulatory and
overall business environment, and the specific
threat landscape. We do this by investing in
research and data analysis, listening to clients
to understand the intricate details in their field
of operation.
The value to clients is solutions, which are relevant and personalised
and anticipate their current and future requirements. Through our
global capability we provide unique perspectives and strategic
advice to help clients make more informed decisions and ultimately
grow their business responsibly and sustainably.
22 NCC Group plc — Annual report and accounts for the year ended 31 May 2023
How insight supports our strategy
Strategic report
In focus
looms large over the coming years, UK telecoms providers are under
While the UK is, in some ways, leading the charge with its TSA,
it’s actually part of an overall trend in global policymaking aimed at
creating a more secure and resilient telecommunications infrastructure.
Across the globe, governments in Europe, Canada, the United States,
Australia and Singapore have moved, or are moving quickly, to implement
telecoms security standards affecting thousands of industry businesses.
Beyond mandatory compliance, there’s also a compelling business case
for organisations to use the TSA, and its international equivalents, as an
opportunity to build more secure, resilient infrastructure.
Working with NCC Group’s government affairs team, and our industry
partners, our global team brings cyber expertise within the context
of telecoms and cloud services, to simplify these new regulations,
and explain not only what’s required but how achieving compliance
proactively can be a competitive differentiator.
of innovation, it’s important that
government policies and regulatory
Mike Maddison
CEO
Strategic report
23NCC Group plc — Annual report and accounts for the year ended 31 May 2023
Link to risks:
A
Strategy
B
Cyber and information security
C
Innovation and product development
D
People and partners
E
Market and competition
F
Brand and reputation
G
Quality and delivery
H
Our strategy
Our clients
pressing Cyber Security and Software
Resilience needs.
Our capabilities
Offering a broader service portfolio
addressing the full Cyber Security lifecycle.
Read more on page 25
Read more on page 25
Global delivery
Transitioning from an international
to a fully global business.
Brands
Creating distinct and relevant brands for
our Cyber Security and Escrow Software
Resilience businesses.
Read more on page 26
Read more on page 26
In February 2023 we announced our new strategy, signalling the next chapter of NCC
Group’s story and focused on:
This section provides more information on these four
elements, what we’ve achieved so far, how we will
measure progress, and our FY24 priorities in service
of our vision to become a truly global Cyber Security
and Software Resilience services provider capable of
delivering an end-to-end cyber solution that harnesses
our strengths in insights, intelligence and innovation,
accompanied by a fantastic client experience.
Read more on our risks on pages 70 to 80
Read more on our business model on pages 14 and 15
To be more client centric and
operate as a global firm, we are
restructuring how we operate.
This will help us achieve our
ambition, providing clients with
not only the best, but also the
breadth of NCC Group’s
ever-advancing Cyber Security
and Software Resilience solutions.
We are engaging colleagues, helping them to get excited about
NCC Group’s future, building on the past, and identifying the role
they play in delivering for our clients. Every single person at NCC
Group takes responsibility for client delivery.
To co-ordinate, execute and track progress, we have created
a modest transformation office – bringing together, for the first
time, central co-ordination of strategy delivery for the Group.
This will help us continue to deliver value – creating a bright
new future for colleagues, clients and shareholders alike.
Over the next couple of pages, we outline each of our strategic
pillars, what we’ve achieved since the launch in February 2023
and what is coming up in the near to mid-term future.
Diji Akinwale
Director of Strategy and Transformation
NCC Group plc 24
Deeper client engagement on the most pressing
Cyber Security and Software Resilience needs
What we said we would do:
In February 2023 we announced our plan to concentrate on
the rapidly growing, highly regulated sectors most vulnerable to
cyber risk. These sectors include financial services, technology,
media, telecommunications, government and public sector,
infrastructure, and industrials.
To implement this we are restructuring the organisation. This
means moving away from the previous regional P&L model to
establishing a global, revenue-focused team, aligned by regions
and the sectors identified above.
The aim of this restructure is to enhance our client relationships
through targeted expertise, while consistently assessing our
impact across different regions. This strategy will expand our
range of services within existing client relationships and better
capture the global scale of the insight, innovation and
intelligence we have historically delivered to clients.
What we have done:
Since initiating our strategy in February 2023, we’ve streamlined
our market approach by implementing a sales structure that
aligns our major regions by verticals. We have successfully
established this vertical alignment in the UK, and the same
structure is currently being scaled in North America.
For our smaller regions, we’ve strategically aligned them with
a country-centric focus, incorporating elements of the vertical
structure where suitable. This restructuring forms a crucial part
of our commitment to meet our clients’ needs more effectively
across various geographies and sectors.
We have also invested in Cheltenham and New York offices to
ensure our property portfolio echoes our commitment to client
service and reflects both the needs of our business and our colleagues
.
We have also further established our strategic partnerships.
We have accelerated our strategic relationship with Microsoft
‘Global Validation’ status from Microsoft, enabling greater
access to discount and Microsoft sellers and been awarded
a ‘managed account’ status by Microsoft, recognising our
investment and growth.
Beyond Microsoft, we have now signed a global partnership with
Splunk that enables better pricing for our clients and access to
wider Splunk sales teams.
Link to risks:
A
Strategy
B
Cyber and information security
D
People and partners
E
Market and competition
F
Brand and reputation
G
Quality and delivery
H
Offering broader service portfolio addressing
the full cyber security lifecycle
What we said we would do:
We proposed that in the coming years, we would look to build
out a broader service portfolio addressing the full cyber security
lifecycle, including:
•
Continuing to invest in our core Technical Assurance capabilities
•
Maintaining high quality of Incident Response services to help
clients at their critical moments
•
Further development of our Managed Services offering,
•
Building an additional Consulting & Implementation services
proposition to help C-suite confidently meet increasing
cyber security requirements
What we have done:
Since February 2023, when we announced our next chapter
strategy, we’ve actively sought to enhance global alignment
across our cyber security capabilities by establishing three
global capability groups, spearheaded by our new Chief Operating
Officer, Kevin Brown; see page 29. This structural shift aims to
better manage our global cyber security capabilities and our
global delivery and operations centre in Manila (see global delivery
pillar). This setup plays a vital role in driving global growth by
creating the capacity and ability to cater to our clients’ needs.
Our Managed Services sector was the first to align globally, and
has seen revenue growth of c.16% in FY23. This underpins the
positive impact of a more globally centred focus, particularly
the second half of the financial year.
Our ongoing reputation for cyber can be seen in our recent
announcement to be one of the first six providers for the
UK NCSC’s new Level 2 Cyber Incident Response scheme.
This recognises our ability to help private and public sector
organisations (big or small) as well as charities recover from
cyber-attacks and should give buyers confidence about the
breadth of our capabilities.
Read more about this story on our newsroom: www.newsroom.nccgroup.
com/news/ncc-group-announced-as-an-assured-service-provider-in-
latest-ncsc-cyber-incident-response-cir-scheme-470825
Link to risks:
A
Strategy
B
Cyber and information security
C
Innovation and product development
D
People and partners
E
Market and competition
F
Brand and reputation
G
Quality and delivery
H
NCC Group plc 25
Strategic report
Our strategy continued
Transitioning from an international to a fully
global business
What we said we would do:
We promised we would globalise our delivery capabilities.
This would allow us to move from an international to a truly
global business and would involve building a global delivery
organisation with new leadership tasked with developing the
best skills through flexible resourcing, including a new global
delivery and operations centre, with implementation in FY24.
What we have done:
We have concluded our search process for a new global delivery
and operations centre and selected Manila as the location for our
new office. A sustainable site has been secured, with recruitment
(both internally and externally) underway and on track to be
operational in 2023.
To drive this accelerated launch, our experienced leadership
and implementation team have developed local relationships
with universities to attract the best skills that will complement
recruitment of experienced hires, alongside our global delivery
capability, and help deliver existing and new services to clients.
This launch of a global delivery centre has required us to rollout
a new scheduling system, Kantata, to our US region as the
precursor to a global rollout. Putting this system in place will
allow us to seamless schedule and allocate work from clients in
any region to any of our global delivery colleagues, whether they
are based in Manchester or Manilla.
Link to risks:
A
Strategy
B
Cyber and information security
D
People and partners
G
Quality and delivery
Creating distinct and relevant brands for our
Cyber Security and Escrow businesses
What we said we would do:
In February 2023, we announced we would create distinct
and relevant go-to-market brands for both our Cyber Security
and Software Resilience businesses. These would help to us
to differentiate and grow our brand profile.
As part of our broader brand and marketing programme, we said
we would increase our focus at key industry events and be more
visible in market, and invest in sustained activity to build and
strengthen relationships at C-suite level in our target markets.
Finally, we said that we would better leverage our world-class
insight and intelligence, such as our regular research from
consultants or monthly Threat Intelligence reports.
What we have done:
We undertook the work to rebrand the Software Resilience
business and it will rollout from January 2024. You can read
more about this on page 34. Work is also underway for our Cyber
Security rebrand.
We’ve invested in significant presence at key cyber events such
as Gartner’s EU Risk and Security Summit 2023, and Black Hat
USA 2023 with bolt-on relationship building activity planned.
In the autumn of 2023, we will launch our own events
programme, for example, featuring our Global Head of Threat
Intelligence, among others, to add value to our clients and the
broader cyber community.
Brands
Link to risks:
A
Strategy
C
Innovation and product development
E
Market and competition
F
Brand and reputation
G
Quality and delivery
NCC Group plc 26
Part of the vision for NCC Group is to become a go-to provider
of cyber services for decision makers through a greater focus
on clients, capabilities, global delivery and differentiated brands.
This means being able to leverage the moments when we add value
for our new and existing clients to create greater impact through
offering a broader range of services.
We demonstrate this with a case where we were brought in
to support an international organisation possessing a complex
on-premise and multi-cloud architecture. They had experienced
multiple Cyber Security incidents in recent years and brought
us in to provide consultancy services to consolidate and enhance
their Cyber Security posture quickly.
As part of the consulting services initially requested, our team
conducted a compromise assessment, where we deployed tools
to identify indicators of compromise that threat actors leave during
an attack. This led to us carrying out a high level review of its whole
infrastructure to identify any vulnerabilities that would present
a critical risk to its business operations, examining its external
attack surface (including its public cloud services) for potential
exposure of data or vulnerable services, analysing data sets related
to previous breaches for evidence of undetected data exfiltration.
As a result of this consulting work, the client was able to move forward
with confidence that there were no urgent issues to address before
thinking about the long-term requirements. One of the long-term
critical gaps identified during the consulting review was the lack
of ongoing protective monitoring.
Through our development of Managed Services, we were perfectly
placed to plan and implement a rapid deployment of our NCC Group
Managed XDR service using Microsoft Sentinel and Defender.
The initial launch of this service was completed within five weeks
and addressed the on-premise and high priority cloud infrastructure
organisation and the client is moving forward with its programme
of security improvement in the knowledge its starting position is not
critical, and any new threats will be identified quickly if they arise
through protective monitoring.
We expect in future that much of our growth will come from our
ability to offer and embed a greater variety of services with our
clients. Our strategy enables this by ensuring that our expanding
range of capabilities can be delivered to clients across the globe.
This allows us to build on our historical strengths and create greater
impact for our clients across the full lifecycle of Cyber Security
decisions that they will make.
Read more on our cyber solutions pages 32 and 33
Strategic report
NCC Group plc 27
We are a Company with a unique perspective.
Most Cyber Security business’s operate
advise without having a real understanding
Kevin Brown
COO
28 NCC Group plc — Annual report and accounts for the year ended 31 May 2023
Meet the COO
Q&
Kevin Brown was appointed
COO in June 2023. He spent
20 years in high level UK
policing before moving to
BT in 2012, where he built
a $1bn managed security
services business. Most
recently, he has been
resident CISO for private
equity firm Insight Partners,
leading its “C-suite in
residence” programme
and working with cyber
companies to challenge
and refine their strategies.
Q. What attracted you to NCC Group?
I gave a lot of thought to what I wanted in my next role.
I was looking for three things.
Firstly, I only wanted to join a pure-play Cyber Security business.
This is where my passion lies. Secondly, I was looking for
a company with a clear vision and going for growth. And finally,
it had to have the right culture – somewhere that people were
supported to do brilliant work.
I found all three at NCC Group so in the end it was an easy
decision to make.
Q. What makes NCC Group different?
We are a company with a unique perspective. Most Cyber
Security businesses operate from the outside in – they attempt
to sell and advise without having a real understanding of what’s
going on within a business’s technology infrastructure.
But we operate from the inside out. We are often in privileged
positions where we gain an intimate knowledge of our clients’
challenges through our world-class incident response capability
or ongoing penetration testing. We are trusted to hold the
“tip of the spear”. And this means the subsequent consultancy
and end-to-end support we deliver is designed around the
specific needs of each client. This really sets us apart.
Q. Where do you see the biggest opportunities?
We are building out a set of services that will act as a natural
flywheel. There’s a sequential nature to what we do – one
informs the other and allows us to create deeper relationships
with our clients.
We have all the constituent parts, as well as from some of
the most significant businesses globally. This is simply about
knitting each element together – and we are already taking
some very meaningful steps forward.
Q. How do you view the global opportunity for
NCC Group?
We are already an international business. We have fantastic
client relationships and incredible talent in every major market.
The opportunity for us lies in greater global consistency –
ensuring shared best practice across markets – and flexibility
in resourcing, both of which will result in an even better service
for clients. Our new global delivery centre in Manila is a prime
example of how a global approach can make our business more
efficient, agile and scalable.
Strategic report
29NCC Group plc — Annual report and accounts for the year ended 31 May 2023
It’s in our DNA
The world around us continuously evolves and
so must how we operate to stay at the cutting
edge of our industry. We think forward, we adapt
and we’re not afraid to take calculated risks.
For our clients this means access to the latest Cyber Security
solutions that offer them peace of mind, knowing that, working
in collaboration, we’ll always be scanning and preparing for
threats to ensure their business stays operational.
30 NCC Group plc — Annual report and accounts for the year ended 31 May 2023
In focus
NCC Group drives for innovation, to improve
the security of the industry, our capabilities
and the way that we support our clients
Strategic partnership
Innovation thrives in the land of collaboration, which is why we have
built strategic relationships with industry leaders, allowing us to quickly
integrate cutting-edge technologies and capabilities into our solutions
providing well-rounded competitive offerings.
Expert Cyber Security professionals
Our Company strengths lie in the proficiency of our Cyber Security
experts. We lean upon this core strength to innovate our product and
services to provide continuous consultant-led solutions.
As an example of this, we continue to evolve our threat intelligence
capability to help our clients and the broader cyber community dealing
with the rapidly changing risk landscape. Our insights have been cited
in the press and clients are increasingly looking to us for intelligence and
advice and insights on their exposure and response. This has culminated
in our newest threat intelligence service, Online Exposure Monitoring.
Online Exposure Monitoring is an example of how we’ve built a partnership,
fed requirements and utilised our internal experts to create a new innovative
service that fits with our wider portfolio to solve multiple client problems.
Online Exposure Monitoring provides a lens that looks from the inside
out, creating continuous visibility into a client’s digital risk.
Our Company strengths
Siân John
CTO
How innovation supports our strategy
Strategic reportStrategic report
31NCC Group plc — Annual report and accounts for the year ended 31 May 2023
Our solutions
INCIDENT RESPONSE MANAGED SERVICES
Our global response capability provides immediate
support to clients under attack and in preparing for attacks.
In the event of an attack our service minimises disruption
to their business, mitigates threats, protects valuable data,
reduces financial loss and safeguards reputation by swiftly
identifying, containing and recovering from cyber attacks.
Impact
Sector: IT/technology
Challenge: Highly sophisticated threat actor had
maintained elevated access over considerable part
of the environment for months.
Solution: NCC Group enabled the client to increase its
visibility in the environment while tracking the threat
actor’s activity and reverse engineer its custom tooling
to achieve a successful eradication outcome.
Value: The full extent of the compromise was identified,
and the threat actor was successfully removed from the
environment. The client improved its overall security
posture and additional recommendations to further
fortifyxthe environment were provided, as well as
additional reports to satisfy any enquiring authorities.
Revenue sources
•
Non-recurring revenue but is an entry point for other
services that we offer
Strategic objectives
•
Continue to evolve and maintain the high quality
we have today of this critical, niche service
Our managed security services are known for delivering
high quality, consistent protection, informed by our
world-class threat intelligence. Our clients can expect
us to deliver solutions fit for their unique environment,
presented transparently. The outcome is real time threat
protection against a very sophisticated group of bad actors.
Impact
Sector: Education
Challenge: Ireland’s National Education and Research
Network organisation, HEAnet, was looking for a partner
to support the Irish education sector’s fight against
cyber crime.
Solution: Building on a similar engagement for the
and security operation centre services, along with
rapid intelligence sharing.
Value: We provide a critical support service to HEAnet’s
offering to over 30 educational institutions in its network.
With our integrated, collaborative alert system, and ongoing
monitoring, HEAnet is able to provide institutions with the
knowledge they need to build strong defences and quickly
respond to evolving threats.
Revenue sources
•
Largely recurring revenue
Strategic objectives
•
As a future growth driver we are investing to enhance
our offer to increase annual recurring revenues, and gain
a larger share of our client’s Cyber Security spend
NCC Group plc 32
CONSULTING & IMPLEMENTATION TECHNICAL ASSURANCE
Our Cyber Security experts work in collaboration with
our clients to identify potential vulnerabilities, develop
a strategy to mitigate these weaknesses, and then execute
the plan to strengthen the overall security posture to
protect valuable assets from potential threats.
Impact
Sector:
Challenge: Group executives lacked confidence in an
external security review and wanted an expert technical
opinion to drive security spend.
Solution: We baselined their technical capability and
researched their threat landscape. We expanded our
review into a comprehensive understanding of their
system security and produced a roadmap for security
investment and capability development.
Value: Provided peace of mind and a solution to reduce
the client’s attack surface, removed system vulnerabilities,
increased security awareness, and improved its ability to
monitor for and respond to threats.
Revenue sources
•
Non-recurring revenue but with potential for other services
Strategic objectives
•
As a future growth driver, we are investing in broadening
our portfolio of Cyber Security consulting services so
that we can better advise clients on their cyber risk
strategy and then help them implement technologies
and supporting processes that mitigate their cyber risk
We provide clients with proactive defence of their digital
assets through vulnerability assessment, penetration
testing, sophisticated adversary simulation, staff training,
third party assurance, and constant compliance and
security monitoring to enhance their system resilience
and data protection.
Impact
Sector: Technology
Challenge: The client lacked security coverage and
needed a partner to provide manual testing services and
manage critical vulnerabilities with remediation testing to
verify fixes were in place.
Solution: We provided the client with 24/7 coverage from
our global team, focusing on security testing and providing
reliable and effective coverage to help maintain the
security of its applications, as an extension to the in-house
security team covering multiple time zones and technical
specialities.
Value: The client had access to a global team of skilled
testers bringing diverse expertise and knowledge to
address potential security vulnerabilities. As a result
it reduced pressure on the in-house team and avoided
costly recruitment costs by outsourcing the capability.
Revenue sources
•
Non-recurring revenue but with potential for
other services
Strategic objectives
•
Invest in our core Technical Assurance capability,
including our continuous, always-on testing proposition
Strategic report
NCC Group plc 33
Our solutions continued
ESCROW AGREEMENT ESCROW VERIFICATION
An Escrow Agreement is a simple and effective tri-party
arrangement with mutually agreed terms between the
software customer, software supplier and NCC Group.
Under the Escrow Agreement, the supplier periodically
deposits a copy of the software source code and
associated materials for secure storage within NCC
Group’s secure physical or virtual vaults, ensuring that the
material can be accessed and released should the need
arise. In the event of a release, the software customer
can utilise the escrow deposit to maintain the software,
working from the source code, whether that be in house
or by engaging with another supplier.
Impact
Sector: Renewable energy
Challenge: When solar energy pioneer BrightSource
wanted to develop large-scale innovative projects, its
partners and bankers needed insurance against any
potential risks that may disrupt the smooth construction
and operation of its plants.
IP escrow and verification added a level of reassurance
at every stage with key project milestones included tied
to the release of project funding.
Solution: To meet the needs of both BrightSource and
investors, NCC Group and BrightSource worked together
to develop a tailor-made business continuity and risk
management solution to allow investors to witness
important developmental stages themselves and to have
access to important documentation should the need arise.
Revenue sources
•
Recurring annual revenue through contract renewal
Strategic objectives
•
Increase our footprint in key growth areas of North
America, Australia and the critical infrastructure market
Software Escrow Verification tests the source code and
material held under the Software Escrow Agreement to
ensure it is correct and complete and can be rebuilt into
the working application, providing a higher level of
resilience and business continuity assurance.
Impact
Sector: Financial services
Challenge: One of our customers, a multinational systemic
bank, had two challenges:
scenarios where supplier was no longer able to provide
support for software deployed in house
process was a successfully stressed exit plan as
required by the PRA SS2/21 outsourcing and third
party regulation
Solution: An Escrow Agreement had been in place for
several years, but the appropriate level of verification had
not yet been completed. To meet the requirements of the
PRA SS2/21 regulation, a complete end-to-end Escrow
Verification was completed. This was conducted in a
clean environment at NCC Group, without reliance on
the software owner’s infrastructure, using the deposit
materials collated as a result of an Entry Level Verification.
Value: All results were documented in a comprehensive
report and distributed to all stakeholders. Successfully
delivering this verification demonstrates the scenario
of a release event and ensured that the application could
be built from the source code.
With the escrow arrangement and the confirmation of the
Independent Build Verification, the bank has the peace
of mind that it is compliant with the PRA requirements
and has a tried and tested plan, should anything happen
to its supplier.
Revenue sources
•
Recurring annual revenue through contract renewal
and a schedule of verification tests
Strategic objectives
•
Continue to increase our verification attach rate
to Escrow Agreements
NCC Group plc 34
Meet the Global Managing Director
Q&
Andrew was appointed as
Global Managing Director
for NCC Group’s Software
business in November 2022.
Before joining NCC Group,
Andrew was CEO of the then
AIM-listed Tungsten Network,
and Group Chief Strategy and
Transformation Officer of IWG
plc (formerly Regus). Prior to
that, Andrew held a variety
of leadership roles within the
technology sector, at Dell
Computer Corporation and
Toshiba Information Systems,
having begun his career
with IBM.
Q. What have you learned since joining NCC Group?
My greatest learning has been that the Software Resilience
business has more untapped opportunity than I realised.
In any business where revenue has plateaued, you expect to
find operating model inefficiencies. The ability to address these
comes down to the support from the Board, from the ExCom,
our people and our clients. I have found that in abundance,
with everyone becoming involved in, and committed to,
delivering sustainable growth through a plan that addresses
those operating inefficiencies to build the right foundations
that underpin growth. The future growth of the Software
client at the centre of all that we do, radically simplifying our
processes and utilising new and emerging technology to
deliver an enhanced client experience.
Q. What are your achievements of note since stepping
into the role?
As a team, I am proud that we returned the business to growth
in H2 FY23 by focusing our sales and delivery teams on a single
objective – which was to meet the needs and requirements of
our clients. Overburdened with priorities, this was achieved
through identifying and focusing on the “critical few actions”,
which are transformative to our business, our bottom line and
our client experience. These included improving internal
communications, developing and launching a roadmap
to simplify our processes, and building and implementing
a credible growth plan.
We have witnessed a strong increase in colleague engagement
over the period and I am incredibly proud of not only what the
team has achieved, but the drive to be innovative in what we
deliver to our clients. Today, we have a team who believe in
themselves and in the value they are adding and who are
passionately committed to our clients and to achieving growth.
Q. What makes NCC Group’s Software Resilience
business different?
Without question our people, our offerings and our clients.
At the heart of our organisation are the teams that sell to,
support and deliver for our clients. I have spent a great deal of
time getting to know the team and listening to their input, which
has been used to help shape our change agenda. The commitment
and passion the team show continues to make me proud to have
each of them within the organisation.
Our product portfolio is impressive, not just software escrow,
but extending into many related products and offerings, which
are some of our best kept secrets. In FY24, we need to be far
more vocal about what we offer and what we can do to meet
our clients’ needs.
Our clients are highly innovative and working with them has
enabled us to change the way that we work to help deliver the
right solutions to them at the right time. At the end of the day,
our clients want to feel protected, safe and reassured that they
are receiving the best levels of service and that their needs
matter and are being answered.
Strategic report
35NCC Group plc — Annual report and accounts for the year ended 31 May 2023
Q. Where do you see the opportunity for
Software Resilience?
I believe the future for Software Resilience is bright. There is
opportunity within our existing client base and within the existing
market whitespace for acquiring new clients, and within new and
emerging markets, and we have new and emerging products. What
we need to maintain is a planned and focused approach, which
gives a rigorous approach to the way we manage and develop
our business. We will deliver on our simplified, scalable business
model to underpin our ability to realise the market opportunities.
Q. What are the key initiatives for FY24?
In FY24, we will continue to invest in simplifying our processes;
we will retire several duplicated systems, enabling us to have
a simplified and more effective client journey. We will build out
our presence in our existing markets, while also growing our
presence in both Europe and Asia. Another focus area for us
will be to expand our product portfolio and identify key market
adjacencies to further drive growth.
Added to this, we will launch our new brand, which will see us
move away from the Software Resilience name, amplifying our
brand presence and creating a distinct and separate brand
from NCC Group’s Cyber Security business.
In all, FY24 will be an exciting year for the business, as we
demonstrate what the team is truly capable of.
Q. How would you describe how the Software
Resilience business contributes to the performance
of the Group?
Our profitability and recent flat revenue performance clearly
make us a cash cow for the Group; however, with our team,
our client base and our growth plan, we can be so much more!
Q. How well known is Software Resilience in the
market?
It’s a little-known fact that NCC Group is the creator of software
escrow as a service, and today we are the world’s largest
software escrow provider. We protect and verify code for some
of the world’s leading companies and Government
organisations. But we don’t tell people enough – now all that’s
about to change! Back in February 2023, Mike Maddison, our
CEO, said that NCC Group would create distinct brands for both
the Cyber and Software Resilience businesses. I’m pleased to
say that as of now, we are on the cusp of rolling out our new
brand for escrow.
Q. What will be the new brand for Software Resilience,
and what difference do you think it will make?
I’m really excited about our own distinctive brand, Escode, that I
think will help us to differentiate and stand out in the market.
Visually it’s striking, but a brand is so much more than that. This
creates the opportunity for us to build our own identity, to
reconnect, and to engage with customers past and present,
helping us to build a better connection and creating an
opportunity to tell our story.
Q. When will we start to see the new brand in
the market?
We unveiled our new brand to colleagues in September 2023,
and expect Escode to be rolled out, including a new website,
early in 2024. Exciting times!
Meet the Global Managing Director
continued
I believe the future for
Software Resilience is bright.
There is opportunity within
whitespace for acquiring
new clients, and within
36 NCC Group plc — Annual report and accounts for the year ended 31 May 2023
Our new centre in Manila
37NCC Group plc — Annual report and accounts for the year ended 31 May 2023
Strategic report
37
It’s in our DNA
We use, analyse and interpret the
vast amount of data we collate to make
strategic decisions – for our own business
and that of our clients through the solutions
we offer. We use technology, data and
machine learning to make smarter, data-
driven decisions, to operate efficiently
and predict trends.
The value to our client comes from our ability to
turn that intelligence into smart solutions. And while
we utilise artificial intelligence and other technologies
to deliver services at a faster rate, and lower cost, it’s
a higher quality and trusted service to our clients.
38 NCC Group plc — Annual report and accounts for the year ended 31 May 2023
How intelligence supports our strategy
Strategic report
In focus
60 unique data feeds – helps our clients defend against the latest
We’re constantly assessing, investigating and aggregating threat
intelligence from the dark web, research and our learned insights
from client engagements across the globe.
Our intelligence provides for the deployment of defences against
the latest attacker techniques and IOCs.
Our clients are able to leverage NCC Group’s advanced threat
intelligence which feeds directly into our custom threat detections.
With a local presence in all
continents around the world,
Siân John
CTO
Strategic report
39NCC Group plc — Annual report and accounts for the year ended 31 May 2023
We believe we have a responsibility to listen to our stakeholders,
considering all their needs, and using insights and learnings to improve
how we make important decisions. Our Code of Ethics guides us,
informing and helping us to build enduring and trusted relationships.
Listening insights are used to inform decision making at every level
of the organisation.
Stakeholder engagement
Link to strategy:
Our clients
Our capabilities Global delivery
Colleagues
The opportunity
•
Know they are contributing to our success
•
Feel confident they have the skills to do their job or are
supported to learn on the job
•
Know what is expected of them through structured
and fair performance management process
•
Have the opportunity to grow their career through our
learning and development offering
•
Spend quality time with their line manager and feel listened to
How we listen and engage
•
Regular virtual and in-person meetings at different levels
in the organisation with line managers and Executives
•
Internal news and collaboration channels to connect
colleagues to what is happening and also enabling them
to easily share approved content
•
where appropriate
•
Highlights in 2022/23
•
Launch of new Talent Partnership Framework to attract
diverse talent – entering into partnerships with Women
•
Launch of a global Speak Up policy to provide clear guidance
and signposting to colleagues across our global teams
•
Scoped and planned launch of gathering of diversity data,
due to launch in FY24
We are a people-led, tech-enabled business and our colleagues around the world each play an important role in helping to make
the digital world safer and more secure.
Clients
The opportunity
•
Using our research and intelligence expertise to understand
the threat and how that affects our customers’ operations
in their sector
•
Using our insights to develop “right-fit” solutions, which
improve and enhance our customers’ current and future
cyber resilience
•
The ability to work collaboratively with our clients, their
partners and broader supply chains
•
Horizon scanning regulations and legislation, and
contributing to government consultations based on
understanding of future market needs
How we listen and engage
•
Active account management
•
Client satisfaction surveys and complaints procedure in
place Industry collaboration with investment in sector-based
approach to understand and mitigate risks of current and
future technologies
Highlights in 2022/23
•
Streamlined our market approach implementing a sales
structure aligning our major regions by verticals. Smaller regions
have been strategically aligned with a country-centric focus
incorporating elements of the vertical structure where suitable.
This forms a crucial part of our commitment to meet our clients’
needs more effectively across various geographies and sectors
Rooted in our sector knowledge, we develop solutions tailored to the unique needs of our clients. Bringing our in-depth
understanding of the threat and regulatory landscape, we assist our clients in addressing their complex Cyber Security challenges.
NCC Group plc 40
Shareholders
Our network
The opportunity
•
Financial performance
•
•
Responsible long-term sustainable strategy
•
Sound corporate governance and stewardship
How we listen and engage
•
Strategic and financial updates issued via RNS Reach
and RNS respectively
•
Regular meetings with investor relations, management
and Board members
•
Investor roadshows after the full and half-year results
•
Open-door policy with investors
•
AGM
Highlights in 2022/23
•
Relations in January 2023
•
Implementation of investor management system –
with both shareholders and analysts
•
New strategy launched in February 2023, with investor
roadshow to build deeper understanding of our vision
•
Following our trading update in March 2023, the management
team offered shareholders the opportunity to meet to discuss
what had happened and further engage how the new
strategy would address concerns
The opportunity
•
Building on our technology heritage and our role as trusted
advisors to governments and regulators we provide independent,
technical expertise to improve cyber resilience policies
•
By understanding and shaping new and emerging regulations
and policy proposals we can develop the right solutions to
prepare for our clients’ future needs and requirements
How we listen and engage
•
Building alliances with global think tanks and foundations,
trade associations and campaign groups to pool resources,
amplify our messages and maximise impact
•
Strategic relationships with national technical authorities,
and support for government initiatives across all our regions
through direct engagement
•
Representation on senior government advisory panels
Highlights in 2022/23
•
Engaged with regulators around the world to advocate for
in Canada, Switzerland, the UK and India, paving the way
support compliance
•
Joined the United Nations’ intersessional consultation
on a new cyber crime convention, making recommendations
on how to improve international collaboration between law
enforcement authorities, promote cyber capacity building,
and protect the contribution of the industry in tackling
cyber crime
We are committed to engaging with our shareholders, creating an opportunity to understand our business, the market, how we
are responding and the opportunity to secure growth.
Our expertise plays a pivotal role in shaping evidence-based policy decisions. By adopting a proactive engagement approach,
we harness our insights to contribute meaningfully towards a more secure digital society and differentiate ourselves in the market.
Suppliers
The opportunity
•
Long-term trusted partnerships facilitating sustainable
overhead cost reduction and cost of sale margin improvement
•
Fit for purpose contracts and payment terms, ensuring a safe
and responsible supply chain with suppliers delivering to
acceptable service levels and protecting NCC Group from
any long-term commercial inflation
How we listen and engage
•
Regular meetings are held with key suppliers to help them
understand our strategy and future forecasting of service
•
with suppliers and structured on-boarding process
Highlights in 2022/23
•
Engaging existing suppliers in ESG to support our journey
to net zero
•
Introduction of a consistent global supplier on-boarding
and due diligence process to gain better visibility and control
of third party risks
•
Improved supplier relationship management process
implemented to drive better commercial value, operational
delivery and future innovation
•
Successful progression and management of the Group’s real
estate strategy to provide quality and productive environments
We engage with many different suppliers across our global business and value the role our supply chain plays in supporting
responsible business operations. Our procurement operations have been endorsed in line with industry best practice and we
proactively work with a consolidated supply chain network to drive innovation, deliver commercial value, mitigate risk and improve
operational benefit.
NCC Group plc 41
Strategic report
Culture
At NCC Group we embrace
difference and are connected
by our purpose to make the
digital world safer and more
secure. Across our global
operations we form a
phenomenal network, working
together, collaborating and
innovating to support our clients.
We are guided by our Code
of Ethics and our values,
which define our behaviours
– treating everyone and
everything with respect.
This is the foundation of
our culture and we strive to
create an environment where
everyone is welcome, feels
safe and can be successful.
Our mission unites us as a global community.
many of the world’s leading businesses. Our focus
are supported to be their very best, and they feel
empowered with managers and leaders who inspire
them. We provide clarity on their role and as
Above all, we give colleagues the opportunity to
follow their vocation and say with conviction that
what they do makes the digital world safer and
Michelle Porteus
Chief People Officer
Our values
We work together
We have each other’s back
We are brilliantly creative
We look at things differently
We embrace difference
We respect each other
We take responsibility
We get things done in the right way
42 NCC Group plc — Annual report and accounts for the year ended 31 May 2023
Wellbeing
Our work can be exciting and intense, delivered by passionate,
committed teams. We recognise the level of focus required to
deliver to high standards, and acknowledge that the pressures
of external and internal factors, when combined, can lead to
burnout. We’ve come through a pandemic where the focus was
very much on mental and physical wellbeing, into some challenging
economic headwinds – not just for NCC Group but also personally
for colleagues. This year we enhanced our wellbeing programme
to cover financial wellbeing too. As we headed into the Group’s
first redundancy programme in February 2023, the support was
welcomed by those impacted, and their teammates who remained.
Mental wellbeing
We have a global network of trained Mental Health First Aiders,
who provide support to their colleagues as required or requested.
in place for colleagues around the world, as well as on the ground
support through the people team. All managers are offered training
in mental health awareness and throughout the year we run
various colleague engagement campaigns to ensure that
it’s always okay to talk about mental health.
Physical wellbeing
As we continue to evolve how we work, we have made decisions
to close offices and embrace hybrid working practices for those
close to our main office hubs. Colleagues are supported financially
to set up their homeworking space, to ensure they are operating
in a safe environment.
In the US, we changed the policy for new colleagues, to enable
them to access negative vacation of up to 40 hours within their
first six months (a period that is normally used to accrue future
time off) and putting emphasis on the balance of work and time
away from the business, ensuring they are empowered to take
time off to rest and recharge as needed.
Buy Scheme – to enable colleagues to purchase up to five
In addition, long-service colleagues received additional days
off added to their annual allowance with the first milestone for
an additional day being four years.
Financial wellbeing
In the US we ran our first financial wellbeing week providing
colleagues with an extensive programme of support on personal
budgeting, saving for the future, retirement and much more.
We also introduced a wellness bundle that supports financial,
physical and mental wellness.
Our UK financial wellbeing programme included introducing new
mortgage broker benefits and free one-to-one pension adviser
meetings as well as a host of other internal and external
resources for colleagues to access.
In Spain we ran two external training sessions to help colleagues
learn how to manage stress and build financial resilience.
Bringing it all together we also launched Perkbox, a global discounts
and perks app which also includes access to a wellbeing hub.
Professional development
NCC Group has become a hub for talent, a place where people
can develop personally and professionally. We offer a broad
range of career options across our technology, sales
and professional practices. We strive to create an inclusive
environment to grow, and we have an embedded transparent
performance management process to support this.
Performance management
Colleagues and their managers are encouraged to meet on
a regular basis to review performance, with a formal documented
review at the half and full year.
The performance review plays an important role in supporting
colleagues’ personal development opportunities, while providing
role purpose and clarity. Career paths guide options, and our
commitment to internal mobility and the open approach to
vacancies support our ambition to retain our talented teams
and enhance careers within the Group.
64 colleagues took up new roles within the organisation,
Learning and development
In FY23 we brought the local training teams together as one global
team to enhance our learning and development programme. The
team is focused on building capabilities to support our move to
a global operating model – we’ll continue to invest in career paths and
equipping colleagues with the tools and knowledge to develop their
own careers, supported by our performance management process.
NCC Group plc 43
Strategic report
Culture continued
Professional development continued
Colleague engagement
In 2022 we decided to move away from the annual colleague
survey to a more progressive way of measuring sentiment
on a quarterly basis. We partnered with Glint, the LinkedIn
engagement programme, with the benefits of managers having
direct access to results (while still preserving anonymity of
participants) and being empowered to own the results, the
conversation and actions locally with their teams.
This regular pulse is critical while NCC Group moves through this
phase of transformation in the next chapter of the strategy and
provides the executive team with a rounded view on how colleagues
are feeling. Other sources of feedback are also sought, and this
includes regular and very successful listening sessions hosted
local town halls, as well as the team meetings and one-to-one
sessions as part of the performance management process.
We use these sessions to encourage discussion and opinion
on executive remuneration and how this aligns with the wider
where the information can be located and answers any questions
as they arise.
In the UK, Spain and Australia we operate colleague forums, where
colleagues are elected by their peers to meet with management
on a regular basis to discuss what’s on their minds. And in the
Netherlands, colleagues have appointed representatives forming
a Works Council.
With the implementation of our new strategy and changing
colleague recognition scheme with the aim of relaunching
it in the second half of FY24.
Diversity and inclusion
We want to create an environment where all colleagues feel
psychologically, emotionally and physically safe to be authentic,
share their personal experiences and have equal opportunities
to achieve, and that is representative of the diversity of the
world they live in.
In 2020 we established our colleague resource groups in support
Race and Ethnicity, and in 2022 we also launched an Accessibility
group. Each of the groups has a people team partner who supports
it in running engagement activities and making change happen.
Our colleague resource groups have been actively engaged in:
•
Reviewing and editing our US and Canada Colleague Handbook
•
Enabling the choice in use of pronouns in Workday – our HR
and across our Microsoft tools
•
enable us to benchmark where we are today and track year
on year improvement
•
Changing the US holiday calendar from 2024 to enable
to Juneteenth being observed from 2022
Colleague Resource Groups continue to actively create
engagement opportunities for the wider community, bringing
everyone together to learn, embrace and celebrate differences.
Gender diversity
As a UK-based company we see the requirement to publish
gender pay gap figures as a positive indicator of our progress
towards a fully inclusive workplace. From 2022 we extended
this practice to include North America and the Netherlands.
We are seeing steady progress but not as fast we would like it to
be. Pay gaps exist because genders are not represented equally
at different levels in the Company – not because we’re not paying
equally. NCC Group still has too few women at senior levels of the
organisation and while female representation has significantly
improved, and we see women moving from lower pay quartiles
to upper pay quartiles, we know there’s still much more to do.
Improving gender representation really matters to us. Overcoming
the barriers of inclusion to achieve a gender-balanced workplace
will take time and sustained effort, underpinned by a plan to drive
change. We remain committed to progress on inclusion for the
longer term, both for our current colleagues and future talent
coming into our industry.
Male
Female
Undisclosed
* Includes the CEO and CFO.
Direct reports to the Executive Committee
45%
55%
Board
37%
63%
Executive Committee*
44%
56%
Group
25%
73%
2%
New hires in FY22
26%
9%
65%
NCC Group plc 44
NCC Group has
become a hub for
talent, a place where
people can develop
personally and
Strategic report
45NCC Group plc — Annual report and accounts for the year ended 31 May 2023
As a part of our commitment to bolstering sustainability, this year
marks an important milestone in our journey. We partnered with
Ever Sustainable to undertake a comprehensive materiality
assessment. This initiative has granted us the chance to engage
directly with our colleagues, clients and shareholders, and the
broader industry to benchmark our current standing, define our
future priorities and integrate sustainability deeply into our operations
.
Upon completion of the materiality assessment, we proudly
present our inaugural sustainability strategy, available in our
detailed launch report.
Making the digital world safer and more secure
We recognise the paramount importance of Cyber Security as
the world becomes more connected and relies on technology
to progress. As a people-driven, technology-empowered global
Cyber Security and Software Resilience business, we provide
solutions that aim to make the digital world more secure and
resilient. Our focus extends from cutting-edge technologies
critical to achieving net zero transition plans, to fortifying existing
technologies against potential cyber threats. It’s what we
do every day for our clients.
To further share our expertise, we developed a global giving back
programme. This initiative empowers our colleagues to actively
protect our local communities and fosters the next generation
of cyber talent through partnerships and sponsorships.
Delve into our business model on pages 14 and 15
Explore our sustainability strategy launch report
The change begins within
Recognising the vital role of sustainability, we assigned
a Board member, Non-Executive Director and Head of the Audit
Committee Lynn Fordham, to be responsible for sustainability
in January 2023. Last summer, the Board took part in a workshop
with our climate partner, Planet Mark, and now, with our new
sustainability strategy in place, we are ready to enhance
sustainability engagement at every level of our organisation.
Expanding our Climate Change Working Group to support TCFD
reporting, we are setting in motion a structure wherein each key
area identified in our sustainability launch report has executive
ownership and associated KPIs. This will enable us to measure,
track and report our progress, in alignment with our overarching
business strategy.
Read more on our strategy on pages 24 to 28
We are wholly committed to doing
Mike Maddison
Chief Executive Officer
Non-financial and sustainability information statement
Championing sustainability
through strategic action
NCC Group plc 46
In preparation for reporting against the European
Union Corporate Sustainability Reporting
independent materiality assessment that sought
the Company’s activities have an external impact.
This double materiality approach enables us
to consider both the risk and the opportunity.
Methodology
Based on the insights we have gained over the past few years
from our stakeholders – from rating agencies to colleague surveys
and client bid requests – we decided to assess impact against
26 topics across environmental, social and governance factors.
It was important to us that we didn’t restrict this list or close out
any risks or opportunities, and we gave stakeholders further
opportunity to comment on anything they thought was missing.
The assessment process sought to integrate industry research,
risk, opportunity and impact analysis and insights gained from
the stakeholder engagement process. These were then converted
into quantitative scores where possible.
NCC Group plc 47
Strategic report
Key:
Social
GovernanceEnvironmental
Diversity and inclusion
GHG emissions
Data privacy and ethics
Professional development
Cyber Security
Employee mental health
and wellbeing
Employee engagement
1. MAXIMISE
Significance to stakeholders
Impact on the business/external impact
Energy management
Waste and e-waste
Labour practices
and human rights
Product accessibility
and inclusion
Social value
Product design and
lifecycle management
Community outreach
Anti-bribery
and corruption
Product security
Biodiversity loss
Employee
engagement
Employee mental
health and wellbeing
Data privacy
and ethics
Diversity and inclusion
Professional development
GHG emissions
Cyber Security
Selling practices and
product labelling
Climate adaptation
Systemic risk
management
Sustainability
awareness
and capability
Product innovation
and impact
Digital capabilities
and access
Executive
remuneration and
incentivisation
Opportunities
in cleantech
Supply chain
management
3. MANAGE 1. MAXIMISE
2. MITIGATE4. MONITOR
Taking a multidimensional approach to materiality
Labour practices
and human rights
Energy management
Waste and e-waste
3. MANAGE
Social value
Product accessibility
and inclusion
Community outreach
Product security
Anti-bribery and corruption
Product design and
lifecycle management
Selling practices and
product labelling
Biodiversity loss
4. MONITOR
Supply chain management
Executive remuneration
and incentivisation
Product innovation and impact
Opportunities in cleantech
Sustainability awareness
and capability
Digital capabilities and access
Systemic risk management
Climate adaptation
2. MITIGATE
Non-financial and sustainability information statement continued
Taking a multidimensional approach to materiality continued
In assessing the relative importance of the topics in our materiality assessment we used the following process:
Prioritising topicsAssigning valuesSetting the scope
Step 1
Define and decide the final list of
topics keeping scope broad enough
to capture the best possible picture.
Step 2
Identify the main risks, opportunities
and impacts of each topic.
Step 3
Assign values for outward and inward
impacts and a likelihood rating for risks
and opportunities associated with
each topic, combining to define a final
impact value to plot on the X-axis.
Step 4
Input outcome of stakeholder
engagement with each topic scored
on its significance to the stakeholder
group, weighted on importance and
size of the sample group.
Step 5
Map each topic onto a matrix to help
visualise the relative importance.
Step 6
Prioritise the topics, linking to the
NCC Group purpose, vision and strategy
to determine where resources should
be allocated to have the greatest
impact, minimise risks and maximise
opportunities for the business.
Using materiality to drive strategy and impact
The materiality assessment helped us to identify what environmental, social and governance issues were most material
and significant to our business and stakeholders. We looked at the topics plotted on the matrix through four lenses to
do this and to identify areas to maximise, mitigate, monitor and manage.
Significance to stakeholders
Impact on the business/external impact
3. Manage
•
Engage with stakeholders to gather views
on the issue
•
Disclosure level determined by
regulation/stakeholder feedback
1. Maximise
•
Issues that are core to the sustainability strategy
•
High level of disclosure to demonstrate ambition
and progress
4. Monitor
•
Monitor the issue for changes to materiality
•
Lower level of disclosure
2. Mitigate
•
Build understanding and internal capability
to mitigate potential impacts
•
Transparent disclosure needed
NCC Group plc 48
The materiality assessment is just the start, and we will now
develop specific goals and targets within our control in line
with our business objectives and stakeholder expectations.
Enhancing our approach to sustainability enables us to mitigate
growth and innovation – something that is at the heart of NCC
Group’s DNA.
page 16
With a new framework, informed by the materiality assessment,
we will continue to improve not only how we report and adhere
to reporting regulations, but more importantly how we continue
to drive responsible business practice.
The full detail of this and how that led to our new framework
can be found in the sustainability strategy launch report.
Securing our future
We firmly believe that our purpose and approach to sustainability
are intertwined, ultimately securing our future as a business.
Central to our purpose is the drive to make the digital world
safer and more secure, building a global Cyber Security and
Software Resilience capability that enhances and advances
sustainable development.
Sustainable development relies on the adoption of digital
technologies. The transition to a greener, more equitable
and inclusive society manifests through the development
of innovative solutions such as smart cities, renewable energy
grids and clean transportation, as well as the accessibility
and widespread adoption of remote education and healthcare
solutions. However, these transformative benefits can only
be fully realised when these digital solutions are resilient
and trusted, which requires robust Cyber Security measures.
By advancing Cyber Security solutions and capacity building,
we are facilitating a secure digital space that allows for the
full potential of these sustainable initiatives to be unleashed.
This makes Cyber Security not merely a defensive measure
but a proactive enabler of progress and development.
Our purpose to make the digital world safer and secure transcends
all five pillars of The United Nations Global Goals – peace, prosperity,
people, the planet and partnerships. Digital transformation is a
safer, fairer world for everyone, in our increasingly digital lives.
Our purpose and our vision as a people-led, tech-enabled
business position us as an essential partner in digital
transformation and sustainable development.
NCC Group plc 49
Strategic report
Climate action
Non-financial and sustainability information statement continued
and Scope 3 emissions were calculated and verified by Planet
Mark in line with the GHG Protocol Corporate Standard. Planet
Mark calculated this from verified third party data and invoices
as part of our overall carbon certification. Note the certification
has not been independently audited by KPMG.
Scope 3 emissions for transmission and distribution, and travel
distances were calculated using the units of energy consumption
and travel distances provided respectively, multiplied by the
relevant BEIS emissions factors. Some conversions were used,
colleagues but neither received the response rate required
to provide accurate benchmark data for their respective
calculations. Our priority in FY24 is to improve on this with
an engagement plan.
In FY23 we committed to improving the data collection process
required from landlords. We significantly improved the number of
offices in our calculations through improved landlord engagement,
as well as extending coverage of our external data centres.
We have outlined our commitment to decarbonisation and our
continuing net zero journey in our new sustainability strategy -
and this includes focusing on including the relevant Scope 3
categories in future reporting. Once we have an accurate report
on our emissions, we can then work with Planet Mark, and other
experts where applicable, to set credible, science-based targets
to achieve net zero before 2050.
The reporting period is aligned with our financial reporting year
for which NCC Group is directly responsible. Having considered
the production metrics within the business, we have concluded
that annual turnover is the most appropriate to achieve
a benchmark, which aligns with the carbon reduction policy
and methodology we will work towards in FY24.
Our benchmark was set against a year still impacted by
restrictions on travel caused by the global pandemic, and
therefore this year we’ve observed an increase in travel and
office usage. This has led to a temporary rise in our overall
carbon intensity.
As a people-led business, this revitalisation of travel and
face-to-face time was essential, and this is something impacting
other businesses too. Despite the overall increase in emissions
we were successful in reducing emissions per colleague by
4.6%, which is one of our metrics as we mature our carbon
disclosure reporting capability.
Our focus continues on improving data, to fully understand
the
source of our emissions, and to enable us to set credible,
science-based reductions to achieve net zero before 2050.
By net zero, we follow the guidance from Planet Mark, which
is
a
ligned to the principles of the Science Based Targets initiative
absolute emissions across all three Scopes by at least 90%.
Read more on our journey to net zero in our sustainability strategy
launch report
2020/21
999
2021/22
298
2022/23
979
Electricity and heat
and steam (tCO
2
2020/21
125
2021/22
80
2022/23
189
Gas (tCO
2
2020/21
72
2022/232021/22
Company owned cars (tCO
2
47
2020/21
135
2022/232021/22
Business travel (tCO
2
29
Electricity: 74%
Heat and
steam: 1%
Natural gas: 9%
Company car
travel: 6%
Business
travel: 10%
Emissions by type
13
67
NCC Group plc 50
Total GHG tCO
2
e
Source 2022 2023
tCO
2
e
change
from
previous
year
% change
from
previous
year
Scope 1
Gas 80.0 124.7
Company vehicles
Diesel 22.6 5.2 3.0
Petrol 24.2 12.3 485%
Hybrid — 4.0 —
Fleet fuel – petrol — — 43.0 43.0 —
46.8 58.3 47.0
Total Scope 1 200.4 183.0
Scope 2
Electricity 297.8 924.5 979.0 54.5 6.0%
Heat and steam — 4.9 19.8 304%
Company vehicles – electric — 13.7
Total Scope 2 297.8 1,012.5 9%
Total Scope 1 and 2 424.6 1,195.5 63.8 6%
Scope 3
Business travel 66.7 134.7 68.0
Transmission and distribution losses — 54.9 52.9
Heat and steam transmission and distribution losses — 0.3 —
Fleet transmission and distribution losses — — 0.3 0.3 —
Total Scope 3 187.9 66.0 54.0%
Total Scope 1, 2 and 3 453.7 1,383.4
Underlying energy use
The table below shows the proportion of energy use that occurs in the UK and non-UK countries alongside the total carbon emissions.
In FY23, 43% of the Group’s energy consumption and 35% of carbon emissions arose from the UK.
FY23 energy use FY23 carbon emissions
Area kWh
% of global
energy use Total emissions (tCO
2
e) % of global emissions
UK 2,201,099 43% 484.5 35%
Non-UK 2,925,189 57% 898.9 65%
Total 5,126,288 100% 1,383.4 100%
Intensity metric
Total per £m turnover – location based
Amount
Turnover
Total emissions
(tCO
2
Intensity per turnover
(tCO
2
4.00
335
Comparison 15.10% 6.30% 10.40% 2.50%
carbon report
on our website
NCC Group plc 51
Strategic report
Non-financial and sustainability information statement continued
Disclosure index
Directive requirements contained in sections 414CA and 414CB of the Companies Act 2006.
Reporting topic
Policies and standards
Annual Report and Accounts
section reference Page Website resources
Climate-related
disclosures
•
Environmental policy
•
Sustainability report
•
TCFD report
•
Principal risks and uncertainties
•
Stakeholder engagement
53
70
40
•
Sustainability strategy
launch report
•
Planet Mark certification
•
Streamlined Energy
Carbon Report
Colleagues
•
Whistle-blowing policy
•
Code of Ethics
•
Disciplinary and grievance policy
•
Sustainability report
•
Stakeholder engagement
•
Remuneration Committee report
•
Our culture
40
42
•
Sustainability strategy
launch report
Social and
community matters
•
Modern slavery statement
•
Code of Ethics
•
Supply chain Code of Conduct
•
Giving back policy
•
Matched funding policy
•
Sustainability report
•
Stakeholder engagement 40
•
Sustainability strategy
launch report
Respect for
human rights
•
Modern slavery statement
•
Data privacy policy
•
Global equal opportunities and
diversity policy
•
Sustainability report
•
Stakeholder engagement
•
Culture
40
42
•
Sustainability strategy
launch report
Anti-bribery
and corruption
•
Anti-bribery and corruption policy
•
Gifts and entertainment policy
•
Sustainability report
•
Audit Committee Report
•
Sustainability strategy
launch report
Business model
•
N/A
•
Our business model
Principal risks
and uncertainties
•
Risk register
•
Principal risks and uncertainties
•
Audit Committee Report
70
NCC Group plc 52
TCFD reporting helps organisations like ours disclose climate-
related financial risks and opportunities in a structured way.
mandates climate-related disclosure for all UK listed companies
– we have produced a comprehensive TCFD Report. Our report
strategy, risk management, and metrics/targets and the
To ensure consistency across our report, we adhered to section
C of the TCFD Annex, titled “Guidance for All Sectors”.
As a result the following are documented as partially compliant
with further detail available within this report:
•
financial implications of climate scenarios into our financial
planning and in the next reporting period will look to
develop a quantitative scenario analysis and integrate
into financial planning.
•
business travel, electricity and distribution losses, heat and
steam transmission and distribution losses. We continue to
improve data collection from suppliers and understanding of
colleague commuting impacts to enhance our reporting across
other Scope 3 categories, through various planned engagement
activities in the next period.
Each pillar of our report includes a table detailing our current
disclosure and areas of focus for 2024.
Our assessment indicates a low risk of exposure to physical
and transitional climate changes, thanks to our business model.
However, we acknowledge the high importance of mitigating
greenhouse gas emissions, which emerged as a priority from
stakeholder feedback in our recent materiality assessment.
We continue to partner with Planet Mark, a leading sustainability
certification organisation, to calculate, verify and target
reductions in our carbon footprint and support our commitment
towards net zero before 2050.
We recognise the considerable opportunities presented by the
growing climate-focused market. Our collaborations with clients in
industries such as electric vehicles, renewable energy, operational
technology and other climate-friendly technologies underscore
our readiness to seize these opportunities for sustainable growth.
Evolving our sustainability agenda
We are pleased to present NCC Group’s second annual report in accordance
Governance
TCFD recommended disclosure Compliance NCC Group disclosure Focus areas for FY24
Governance
A. Describe the
Board’s oversight of
climate-related risks
and opportunities
Compliant
•
The Board has appointed the Head
of the Audit Committee as the lead
Non-Executive Director responsible
for sustainability. Monthly updates
are provided via the CFO report to the
Board as well as directly from regular
with the Director of Investor Relations
and Sustainability with the full Board,
including an update on progress
against the Group’s goals and targets
where appropriate.
•
The Board takes overall accountability for
the management of climate-related risks
and opportunities and considers them as
part of its overall risk review processes.
For example, the Board (and management
criteria to facilitate conscious decision
making on the location of NCC Group’s
new global delivery centre to support
execution of the strategy.
•
We are in the process of incorporating
ESG criteria into the Group’s budgetary
planning process and financial planning
for FY25.
•
From the 2023 materiality assessment,
set goals for FY24, with at least quarterly
updates through the CFO report, to show
progress against the plan and continue to
mature the process by which the Board will
oversee progress against the targets for
addressing climate-related issues.
•
Meet at least quarterly with the nominated
NED responsible for sustainability to reflect,
discuss and ensure actions are being taken.
•
Continue to develop NCC Group’s net
zero journey and broader sustainability
strategy with oversight and input from
the Board.
TCFD
NCC Group plc 53
Strategic report
How ERM fits into the Group Committee structure
Internal audit
External and ISO auditors
Board
Audit Committee Cyber Security Committee
Enterprise Risk
Committee
ExCom
The above diagram shows how the Enterprise Risk Management Committee feeds into the Audit and Cyber Security Committees,
which in turn reports to the Board. Actions are also driven back down from the Board as reflected in the above diagram.
TCFD continued
Governance continued
TCFD recommended disclosure Compliance NCC Group disclosure Focus areas for FY24
Governance continued
B. Describe the
management’s role
in assessing and
managing climate-
related risks and
opportunities
Compliant
•
A new role was created in January 2022
to bring sustainability and investor
relations together. The newly appointed
Director of Investor Relations and
Sustainability (formerly Director of
reporting to the Chief Financial Officer,
provides advice and updates to the
Executive Committee on climate-related
issues as and when relevant.
•
meets quarterly addresses climate risk
as part of that process.
•
Continue to mature NCC Group’s net zero
journey, including improvement of
collation of Scope 3 emissions.
•
Review and update the terms of reference
for the Climate Change Working Group in
line with the materiality assessment and
integrate into the existing Board and
executive governance processes.
•
Once all new executive members are
appointed and upon completion of the
sustainability strategy, identify executive
ownership for each element including
climate change and how this is supported
through the Climate Change Working Group.
•
Integrate the output from the double
materiality assessment conducted in FY23
into our newly launched business strategy,
to incorporate key ESG considerations
into decision making where relevant.
Lynn Fordham, the lead Non-Executive Director for Sustainability,
was appointed by the NCC Group Board Chair. In addition to her
position as the Head of the Audit Committee, Lynn’s role is to
oversee the Company’s sustainability strategy, ensure its
integration with the overall business strategy, and provide
regular sustainability updates to the Board.
While there is no specific Board committee for environmental
by the Director of Global Governance addresses these issues.
The ERM meets bi-monthly and is attended by our CEO and CFO.
It discusses, among other risks, sustainability and environmental
challenges, which are then reported to the Board.
From March to May 2023, we conducted our first materiality
assessment considering both inward and outward impacts (see
various stakeholders, including shareholders, colleagues and
clients. The results formed the foundation of our newly launched
sustainability framework, which outlines our priority areas for
the
next one to three years.
As NCC Group’s business strategy evolves, the sustainability
framework will be integrated into our strategic planning.
An engagement programme is being developed to ensure that
our internal stakeholders, including the Board, are informed, and
engaged on not just climate change but all priority sustainability
topics. This programme will feature training sessions, workshops
and continued awareness-building initiatives.
The Board and the Executive Committee are committed to
communicating their dedication to addressing climate change.
This will be demonstrated through our annual Sustainability
Report and reinforced through other appropriate internal and
external communication channels throughout the financial year.
NCC Group plc 54
Strategy
TCFD recommended disclosure Compliance NCC Group disclosure Focus areas for FY24
Strategy
A.
Describe the climate-related
risks and opportunities the
organisation has identified
over the short, medium
and long term
Compliant
•
See tables on page 56 describing risks and
opportunities, which were selected based on
location of our existing business and known
climate change risks affecting the broader
region we operate in.
•
Monitor actions arising from
the risk register.
B. Describe the impact
of climate-related risks
and opportunities in
the organisation’s
business strategy
and financial planning
Partially
compliant
•
An impact in our ability to meet climate-related
disclosures that are required by clients in their
capture of Scope 3 emissions. Each sector we
operate in has its own requirements, because
of legislation and their own commitments. Not
understanding or assessing this could have an
impact on NCC Group’s ability to meet the
requirements in a contract.
•
Climate-related taxes, or fines for non-compliance
could impact the business if we fail to take action.
•
Our ability to raise capital to invest in growth,
may be restricted if we fail to make progress
on climate related action, which forms part of
sustainable lending requirements.
•
As part of the verticalisation element of our
strategy, we are undertaking research to ensure
we meet the broader ESG criteria that applies to
our clients. We are creating a knowledge bank for
sales teams and will conduct regular briefings/
updates through internal channels.
•
Develop a knowledge
management repository that
supports sales/bid teams in
accurately representing how
NCC Group supports clients
in meeting their specific
climate-related disclosures.
•
Working in collaboration with
strategy, marketing and public
affairs, ensure that environment
and broader sustainability
considerations are built into the
understanding of client needs
by sector and by region.
C. Describe the resilience of
the organisation’s strategy,
taking into consideration
different climate-related
scenarios, including a
2
O
C or lower scenario
Partially
compliant
•
We have conducted an initial quantitative
O
C and 4
O
C.
•
Develop the initial scenario
analysis and integrate, aligned
to NCC Group’s strategy
development, into future financial
and strategic planning activities
as our net zero journey matures.
In our ongoing commitment to the TCFD’s Strategy pillar, we are
not only advancing our approach to managing climate-related risks
but also actively pursuing growth opportunities within the climate
change sphere. We’ve formed strategic partnerships, such as our
collaboration with Planet Mark, to help us lower our carbon footprint
and develop more sustainable business practices. As a proud
member of techUK’s Responsible Business Community, we’re
also exchanging insights and best practices with industry peers
to collectively address climate change.
In early 2023, we appointed our first Director of Strategy, who
will play a crucial role in our internal Climate Change Working
Group. This group is currently tasked with evaluating the
potential impact of climate change on our business operations,
identifying both risks and opportunities. To date, the group has
been focused on improving the collation of climate-related data
to assess our current state and instrumental in helping to
progress our ambitions to set achievable targets for reducing
our carbon emissions over the next five years. New terms of
reference for this working group are to be defined along with
clearly identifying how it is embedded into our existing
governance process from the Board down.
Our focus is not limited to risk mitigation but extends to
exploring opportunities where we can make a positive impact.
This includes improving the energy efficiency of our operations,
collaborating with our landlords and requesting renewable
energy sources, and identifying ways our technology solutions
can contribute to our clients’ sustainability efforts. As we
continue our climate change journey, we are committed to
regularly reporting our progress against these objectives,
showing transparency in our endeavours, and constantly
seeking ways to better our efforts.
Climate-related risks
Our comprehensive risk management framework (summarised
in the Risk Management section of the Annual Report on pages
climate-related risks. We categorise these risks into:
•
policy changes impacting climate-related risks and opportunities as
well as existing forecasting processes considered by management
which are reviewed and evaluated on an annual basis.
•
that may affect climate-related risks and opportunities.
•
of international agreements and commitments, technological
trends and changes to policy or carbon pricing and their
impact on our operations, client services and supply chain.
For instance, short-term risks might include immediate regulatory
changes or extreme weather events, while long-term risks could
be major shifts in our industry driven by the transition to a low carbon
economy. Each identified risk is paired with corresponding mitigation
measures, such as implementing energy-efficient technologies
or diversifying our supply chain, aimed to reduce our vulnerability.
While these risks apply to the Group as a whole, we do recognise
that certain locations face unique challenges. For example, our
operations in coastal areas are more susceptible to rising sea
levels and increased frequency of extreme weather events.
For a more detailed understanding of the climate-related
risks and opportunities we face, please refer to the table
below. It provides a snapshot of the specific challenges we’re
addressing and the strategic responses we have undertaken.
NCC Group plc 55
Strategic report
Climate-related risks continued
Risk Risk impact Short/medium/long term Regions impacted Mitigating activities
Physical risks
Extreme weather
(acute)
Causing business disruption
and loss of service delivery
and therefore revenue
Short to medium term All but particularly
North America
•
Business interruption cover
•
Business Continuity Plans
•
Remote working in place
•
Dutch flood defences in place
Sea level rises
(chronic)
Increased likelihood of
flooding in Delft and
Amsterdam offices causing
increased insurance premiums
Long term
Amsterdam offices
Transition risks
Increase in taxes
and levies for
greenhouse
gas emissions
Disruption and increased
costs to ensure compliance
with new legislation
Medium term Depends on
local legislation
•
Working with Planet Mark
to calculate our carbon
footprint, ways to reduce
it, and colleague and
Board engagement, and
helping progress our net
zero journey
Move to net zero Increased costs required
to lower emissions
Long term Global
•
Remote delivery of client
services where possible
•
Company car scheme
only for electric and hybrid
•
Annual calculation of
with Scope 3
emissions
collation started
•
Rigorous and transparent
budget setting will
identify increasing costs
associated with carbon
emissions reduction
Margin risk Impact on results due
to extra costs incurred
to lower emissions
Medium term Global
•
Accounting policies
regularly reviewed
•
Rigorous and transparent
budget setting will
identify increasing costs
associated with carbon
emissions reduction
Reputation risk Increased stakeholder
concern and changing
customer behaviours
Medium term Global
•
Ongoing dialogue
with investors
•
Benchmarking and
independent reviews
undertaken through a double
materiality assessment
•
ESG information
publicly available
Supply chain risk Substitution of existing
products and services with
lower emission options
Medium to long term Global
•
Scope 3 questionnaires sent
to supply chain partners
equating to 80% of our spend
•
Business Continuity Plans
•
Reviewing office strategy
TCFD continued
Strategy continued
NCC Group plc 56
Opportunities to further reduce NCC Group’s impact
on the environment:
Resource efficiency: By embracing more efficient modes
of transport, promoting recycling, encouraging hybrid working
models and operating within efficient buildings, we can lessen
our environmental footprint, improve colleague satisfaction and
reduce operational costs. For instance, removing unnecessary
travel not only reduces our carbon emissions but also empowers
colleagues with more control over their work-life balance,
contributing to improved morale and productivity (anticipated
Energy source: Our transition to lower emission energy sources,
underpinned by the introduction of an electric/hybrid car scheme
for all UK colleagues, demonstrates our commitment to sustainable
practices. By giving colleagues access to green car options, we
are mitigating our exposure to future fossil fuel price fluctuations
and regulations. It also addresses our colleagues’ material
concerns, fostering a culture of environmental responsibility and
Market: As industries evolve in response to climate change,
we’re strategically positioned to leverage these transformations.
For example, by partnering with companies transitioning into
alternative energy sources or working on projects involving smart
meters, electric vehicles, IoT technology for waste reduction and
cloud data centres, we anticipate strengthening our market
position and enhancing our reputation as a sustainable and
Resilience: Our sustainable business model increases our resilience
to climate-related risks, demonstrating our commitment to being
a responsible and ethical supply chain partner. This commitment
to sustainability not only aligns us with an increasingly eco-aware
market but also empowers us to lead in the space, fostering
a culture of innovation and responsible business practices (short
Scenario analysis
To understand the risks and opportunities our business faces
considering climate change, we have conducted a
quantitative
of the scenarios selected is provided below.
These scenarios are chosen to reflect the diverse spectrum
of possibilities that could unfold due to different levels of global
effort to curb climate change. In the context of these scenarios,
“transition risks” refer to the challenges associated with the shift
towards a lower carbon economy, while “physical risks” denote
the potential damage caused by climate change itself.
In terms of the risks selected, these were based on physical
locations and the nature of our business in key locations of
North America, the UK, Europe and Asia Pacific. We are in the
process of flowing this into our financial planning and will continue
to do so as we mature our climate action planning and reporting.
rapid shifts in regulatory and market conditions, but the physical
risks would be significantly reduced due to the effective global
action on climate change. Conversely, Scenario 2 predicts lower
transition risks but considerably higher physical risks due to the
lack of substantial progress towards climate goals.
We’ve further broken down these risks by timeline, classifying
offers a comprehensive overview of NCC Group’s potential
exposure to both transition and physical risks under each scenario.
While our current analysis is qualitative, we are working towards
quantifying these risks and opportunities as we progress towards
our net zero targets and improve our data collection across Scope
impact on our Financial Statement disclosures based on our
materiality assessment results see page 47 of the Annual Report
and known near to mid-term regulatory developments. However,
we will continuously monitor both transition and physical risks,
adjusting our mitigation strategy as necessary.
Risk type Risk Risk impact Scenario
Short term
Medium term
Long term
Physical
risk
Rising sea
levels
Risk to NCC Group offices
located in high risk areas, e.g.
Delft, as well as colleague and
customer homes resulting in
business disruption
Low
Low
High
2 Low High High
Flooding Impact to service quality and
disruption to systems, increased
costs to relocate colleagues
Low Low Low
2 Low High High
Transition
risk
Increase in taxes
and levies
Disruption and increased
costs to ensure compliance
with new legislation
Low Medium High
2 Low Low Low
Margin risk Impact on results due to extra
costs incurred to lower emissions
Low Medium High
2 Low Low Low
Reputation risk Increased stakeholder
concern and changing
customer behaviours
Low Medium High
2 Low High High
Supply chain risk Substitution of existing
products and services with
lower emission options
Low Medium High
2 Low Low High
NCC Group plc 57
Strategic report
TCFD continued
Strategy continued
Financial planning
We recognise the significant implications of climate-related risks
and opportunities on our financial planning. We anticipate shifts
in our future business model and strategy in response to evolving
market conditions due to climate change. We foresee potential
changes in customer preferences towards more sustainable
products and services, along with possible disruptions in our
supply chain due to extreme weather events. These factors are
thoroughly considered in our business strategy development.
Our business strategy has been designed to be resilient to future
economic and climate-related scenarios. And by running regular
scenarios we can test that resilience, and ensure it’s considered
in future business strategy development, enabling us to adapt
accordingly, without disrupting or negatively impacting
current operations.
The scenarios are based on industry insights, which were used
in the expert input into our materiality assessment. We will look
to assess the potential financial implications of various climate
scenarios and factor these into our revenue forecasts, expenditure
plans and asset valuations from FY25 onwards. This will include
a detailed analysis of potential climate-related liabilities and their
impact on our financial stability.
Our future aspiration is to incorporate climate considerations
to influence future investment decisions by the Group, always
reducing our carbon footprint, and gradually divesting areas that
carry high climate-related risks. For now though, we are actively
working to improve our operational efficiency and addressing
things we can directly influence to reduce our impact on the
environment and realise cost savings.
In summary, our organisation is committed to integrating
climate considerations into our financial planning process.
We will continue to refine our approach as we gain more
data and insights into the evolving climate scenarios.
Risk management
TCFD recommended disclosure Compliance NCC Group disclosure Focus areas for FY24
Risk management
A.
Describe the organisation’s processes
for identifying and assessing
climate-related risks
Compliant
•
Climate-related risks are managed
through our enterprise risk
management framework.
•
Monitor actions arising
from the risk register.
B. Describe the organisation’s processes
for managing climate-related risks
Compliant
•
Climate-related risks are documented,
mitigating actions are considered, a risk
rating is assigned and associated actions
are documented and followed up.
•
Monitor actions arising
from the risk register.
C. Describe how processes for identifying,
assessing, and managing climate-
related risks are integrated into the
organisation’s overall risk management
Compliant
•
Climate-related risks are managed
through our enterprise risk
management framework.
•
Monitor actions arising
from the risk register.
As part of our robust materiality assessment, we conducted
in-depth, topic-based and industry research to identify our
most material sustainability issues.
Through a detailed materiality matrix, we also identified
opportunities to enhance our sustainability performance by
focusing on reducing GHG emissions, monitoring product design
and lifecycle management, and mitigating biodiversity loss.
Our approach is to address these opportunities through targeted
initiatives in cleantech, increasing sustainability awareness and
capability, and climate adaptation.
Addressing these issues will involve closer collaboration with our
supply chain, particularly our global landlords and our top suppliers.
A key initiative in this regard is our Data Centre Management
Strategy, aimed at reducing our energy consumption. In collaboration
with our web development partner, Nexer, we have successfully
reduced the energy consumption of our websites by 50%, applying
eco-design principles.
Climate-related risks are managed through our NCC Group
which is detailed in the Risk Management section of the Annual
Report on page 70, uses a sophisticated risk model to assess
and score each risk based on likelihood and impact. Risks are
re-evaluated consistently to ensure we’re responsive
to evolving circumstances.
Our risk management approach combines “top-down strategic”
and “bottom-up operational” perspectives, fostering collaboration
and promoting efficient risk identification. With respect to climate-
related risks, we have outlined our strategies and targets for GHG
emissions reduction and biodiversity preservation.
These climate-related risks are integrated into our Principal Risks
plays an active role in the ongoing review of these risks, their
mitigations, controls and associated actions. This Committee
meets on a regular basis and follows a stringent process for
identifying, assessing, responding to and escalating serious
concerns related to these risks.
We firmly believe that this integrated and transparent approach
will ensure effective risk management aligned with the principles
of TCFD, while driving our strategic objectives for sustainability.
NCC Group plc 58
Obtain
assurance
Implement
internal
control
Adapt
ERM
P
erform
scenario
analysis
Integrate
into
reporting
Use
existing
tools
S
olicit
investor
feedback
Assess
financial
impacts
Collaborate
across the
business
Secure leadership buy-in
Establish Committee oversight
A
u
d
i
t
C
o
m
m
i
t
t
e
e
R
i
s
k
C
o
m
m
i
t
t
e
e
Metrics and targets
TCFD recommended disclosure Compliance NCC Group disclosure Focus areas for FY24
Metrics and targets
A. Disclose the metrics used by the
organisation to assess climate-
related risks and opportunities
in line with its strategy and risk
management process
Compliant
•
Reporting of greenhouse gas emissions
for FY23 compared to prior years.
•
Commitment to net zero before 2050
in line with the Paris Agreement with
regular reviews to improve as and when
broader Scope 3 data is available.
•
Climate-related performance metrics
incorporated into Remuneration
in line with our Planet Mark certification
commitment to reduce greenhouse gas
emissions year on year. In our first two
years, we are aiming to reduce our total
greenhouse gas
emissions
by 5%
recognising that as our data collection
matures and improves, we may need to
reduction in colleague intensity, but an
return to travel and office use following
the pandemic.
•
Improve Scope 3
data collection and
management to
accelerate NCC Group’s
net zero journey.
B. Disclose Scope 1, Scope 2, and,
if appropriate, Scope 3 greenhouse
gas emissions and the related risks
Partially
compliant
emissions
still in their
infancy
•
emissions for FY23 vs FY22.
•
Scope 3 emissions limited to business
travel, electricity transmission and
distribution losses, heat and steam
transmission and distribution losses.
•
Supplier engagement to provide data
was limited in response.
•
Colleague commuting data collated
as part of the materiality assessment but
not enough responses to
enable calculation.
•
Improve supplier and
colleague engagement
to gather required Scope
3 data from supply chain
activities and colleagues
in relation to commuting
and working from
home impact.
C. Describe the targets used
by the organisation to manage
climate-related risks and
opportunities and performance
against targets
Compliant
•
Set year two reduction in line with
Planet Mark recommendations of 5%. This
includes reducing colleague intensity by
intensity by 2.5%. We will also continue to
seek location intensity through better
understanding of our data and the steps
we can take to reduce our impact.
•
Seek opportunities,
as NCC Group’s
management of climate
change matures, to
accelerate achieving
net zero before 2050.
NCC Group plc 59
Strategic report
Meet the CFO
Q&A with Guy Ellis
Director after senior commercial
on all things finance. Prior to
Guy spent time as Interim
Director of the UK and APAC
Cyber Security business.
Q. What do you think the role of a finance department
should be?
The most effective finance functions act as a strategic force
Q. What are you going to bring to the role?
I’m experienced in driving through transformational change.
In the short term I’m focused on standardisation and simplification
scale at pace globally.
to both the executive team and the Board. I see that as a critical
element of my role.
Q.
risk increases in tandem – so overall I have a positive outlook.
into the future.
Q. Where do you think the opportunities lie?
Security industry. We are building out our capabilities to offer
company to a fully global business.
The opportunities are significant. This is the right strategy.
60 NCC Group plc —
2022/23 key activities
•
Finalised the full operational review of the Software
Resilience business to create additional
Group contribution
•
Completed a scheduled refinance process with
enhanced banking facilities
•
Continued to demonstrate effective cash management
with strong cash conversion
2023/24 priorities
•
Identify cost efficiencies across Cyber Security and
corporate functions, achieving in-year savings and full
annualised contribution from FY25 onwards
•
Drive transformational change in processes and insights
to support the business as we embed our strategy
•
Maintain strong cash conversion
Financial review
Guy Ellis
Chief Financial Officer
Overview of financial performance
2023 2022
Cyber
Security
£m
Software
Resilience
£m
Central
and
head office
£m
Group
£m
Cyber
Security
£m
Software
Resilience
£m
Central
and
head office
£m
Group
£m
Revenue 270.8 64.3 – 335.1 258.5 56.3 –
Cost of sales – –
Gross profit 86.1 45.9 – 132.0 92.3 40.3 –
Gross margin % 31.8% 71.4% – 39.4% 35.7% –
2
Adjusted EBITDA
1
15.4 31.2 41.4 22.8 59.2
Depreciation and amortisation
Adjusted operating profit
1
6.9 30.6 28.8 22.0
Amortisation of acquired
intangibles
Share-based payments
Individually Significant Items – – –
Operating (loss)/profit 22.3 1.9 28.9 34.7
Operating margin % 34.7% n/a 0.6% 28.5% n/a
Finance costs
Taxation
23.0
EPS
Basic EPS 7.4p
Adjusted basic EPS
6.1p
an explanation of APMs and adjusting items.
2 Administrative expenses excludes depreciation and amortisation, amortisation of acquired intangibles, Share-based payments and individual significant items.
3 Depreciation and amortisation excludes amortisation of acquired intangibles.
2023 has been a challenging year for the Group, as our expected Revenue performance and consequently our gross profit and overall
experienced buying decision delays and cancellations in the North American tech sector and to lesser extent our UK market for Global
Professional Services.
NCC Group plc 61
Strategic report
Overview of financial performance continued
Encouragingly, no material clients have been lost, however this
sharp market correction had a direct impact on our revenue,
direct utilisation, gross profit and ultimately our profitability due
to the level of employee costs in the business and recognition of
Individually Significant items that mainly relate to the impairment
of North American Assurance Goodwill. These headwinds have
further reinforced the need to implement the next chapter of our
Group strategy and identify cost efficiencies across Cyber
Security and corporate functions, achieving FY24 savings and
full annualised contribution from FY25 onwards.
Turning back in detail to our FY23 performance, Group revenues
the prior year Software Resilience fair value revenue adjustment
In our Cyber Security business, the Europe, and UK and APAC
Cyber Security businesses grew on a constant currency basis
a constant currency basis
decline in tech sector spend.
constant currency basis
In our Software Resilience division, following the completion of
year of IPM contract renewals, which contributed to overall
to
to these potential contract renewals, total Software Resilience
generated sale orders of £4.7m, an increase of 38% compared to
performance of the Cyber Security business and lower direct
and training costs arising from inflationary pressures and further
c.£6.5m. Other higher costs include an increase in non-client
travel and office costs (including the impact of our NCC
performance also incurred the indirect trading cost hosting our
in person global NCC Conferences in June 2022 for the first time
impact of c.£5m year-on-year, of which c.£2.3m related directly
Individually Significant Items incurred during the year amounted
in Goodwill of £9.8m for the North American Assurance business
following the recent reduction in spend by North American
technology clients and £4.2m in relation to fundamental
reorganisation costs as we reshape the Group to implement the
next chapter of the Group’s strategy. The impairment of North
American Assurance Goodwill has been recognised based on the
include costs associated with the strategic review of our
reorganisation. These were partially offset by a profit on disposal
profit performance, recognition of ISIs and after an increase in
The variable rate of interest cost increased due to the macro-
economic environment and the write off of existing arrangement
amounted to
Net debt excluding lease liabilities
Our Balance Sheet and facility headroom remains strong, during
multi-currency revolving credit facility and the remaining $46.7m
of the original $70m term loan that was maturing in June 2024.
The new facility now matures in December 2026 and includes a
£75m uncommitted accordion option. In addition, we also
secured an increase to our leverage covenant from 2.5x to 3.0x
with an additional acquisition spike to 3.5x for the first twelve
months of any acquisition. The weighted average margin of the
facility also decreased and is payable on a ratchet mechanism
on the level of the Group’s leverage. The average interest rate for
the year was 4.54% and is currently 6.27% following recent
changes to base interest rates.
that paid in the prior year as the Board is conscious of the need
to invest in new strategy and manage its net debt accordingly
following the challenging year.
Throughout this Financial Review, certain APMs are presented.
These APMs used by the Group are not defined terms under IFRS
and may therefore not be comparable with similarly titled
measures reported by other companies. They are not intended to
be a substitute for, or superior to, Generally Accepted
current year results and comparative periods where provided.
Financial review continued
NCC Group plc 62
This presentation is also consistent with the way that financial
performance is measured by management and reported to the
Board, and the basis of financial measures for senior
management’s compensation schemes and provides
supplementary information that assists the user in understanding
the financial performance, position and trends of the Group. At
all times, the Group aims to ensure that the Annual Report and
Accounts give a fair, balanced and understandable view of the
‘Presentation of Financial Statements’ requires the separate
presentation of items that are material in nature or scale in order
to allow the user of the accounts to understand underlying
business performance.
We believe these APMs provide readers with important
additional information on our business and this information is
relevant for use by investors, securities analysts and other
interested parties as supplemental measures of future potential
performance. However, since statutory measures can differ
significantly from the APMs and may be assessed differently by
the reader we encourage you to consider these figures together
with statutory reporting measures noted. Specifically, we would
note that APMs may not be comparable across different
companies and that certain profit related APMs may exclude
recurring business transactions (e.g. acquisition related costs
performance and cash flows.
As the Group manages internally its performance at an Adjusted
operating profit level (before Individually Significant Items,
amortisation of acquired intangibles and share-based
underlying trading of the business; this information is still
disclosed as an APM within this Annual Report. This APM is
reconciled to statutory operating profit, together with the
consequently Adjusted basic EPS (before amortisation of
acquisition intangibles, share-based payments and Individually
The Group has the following APMs/non-statutory measures:
•
•
•
•
•
•
Cash conversion which includes Adjusted EBITDA (reconciled
•
The above APMs are consistent with those reported for the year
and Software Resilience revenue excluding IPM acquisition
which have been removed now that the Group has comparable
The Group also reports certain geographic regions on a constant
currency basis to reflect the underlying performance considering
constant foreign exchange rates period on period. This involves
translating comparative numbers to current period rates for
comparability to enable a growth factor to be calculated. As
these measures are not statutory revenue numbers, management
considers these to be APMs.
Further detail is included within the Glossary of terms to
the Financial Statements that provides supplementary
information that assists the user in understanding these
APMs/non-statutory measures.
Financial summary
Summary Income Statement
2023
£m
2022
£m % change
Revenue 335.1 6.4%
Cost of sales
Gross profit 132.0
Depreciation and amortisation
2
Administrative expenses
3
23.4%
Adjusted operating profit
1
28.8
Individually Significant Items
Acquired intangible amortisation
Share-based payments
Operating profit 1.9 34.7
Finance costs 67.6%
Taxation
23.0
EPS
Basic EPS 7.4p
Adjusted Basic EPS
6.1p
explanation of APMs and adjusting items.
2 Depreciation and amortisation excludes acquired intangible amortisation.
3 Administrative expenses excludes depreciation and amortisation, amortisation of acquired intangibles, share-based payments and Individually Significant Items.
NCC Group plc 63
Strategic report
Financial summary continued
Revenue summary
2023
£m
2022
£m
%
change at
actual rates
2023
£m
Constant
currency
2022
£m
% change at
constant
Cyber Security 270.8 258.5 4.8% 270.8 270.5
Software Resilience 64.3 56.3 64.3 59.8 7.5%
Total revenue 335.1 6.4% 335.1 330.3
at constant currency
Divisional performance
Cyber Security
Cyber Security revenue analysis – by originating country:
2023
£m
2022
£m
% change at
actual rates
2023
£m
Constant
currency
2022
£m
% change at
constant
currency
UK and APAC 118.4 3.3% 118.4 3.0%
North America 99.3 5.5% 99.3
Europe 53.1 49.8 6.6% 53.1 3.9%
Total Cyber Security revenue 270.8 258.5 4.8% 270.8 270.5
on a constancy currency basis
(increased
Turning to the performance between each half of the financial year, the following revenue analysis by originating country demonstrates
tech sector and the UK Market within Global Professional Services.
H1 2023
£m
£m
% change at
actual rates
H1 2023
£m
Constant
currency
£m
% change at
constant
currency
UK and APAC 61.6 54.6 61.6 55.0
North America 59.2 44.0 34.5% 59.2
Europe 24.2 24.6 24.2 24.9
Total Cyber Security revenue 145.0 145.0
H2 2023
£m
H2 2022
£m
% change at
actual rates
H2 2023
£m
Constant
currency
H2 2022
£m
% change at
constant
currency
UK and APAC 56.8 60.0 56.8 60.0
North America 40.1 40.1 53.4
Europe 28.9 25.2 28.9 26.2
Total Cyber Security revenue 125.8 125.8
Financial review continued
NCC Group plc 64
Divisional performance continued
Cyber Security revenue analysed by type of service/product line:
2023
£m
2022
£m
% change
at actual
rates
2023
£m
Constant
currency
2022
£m
% change at
constant
currency
199.3 2.0% 199.3 205.6
67.8 58.6 67.8 60.3
3.7 4.5 3.7 4.6
Total Cyber Security revenue 270.8 258.5 4.8% 270.8 270.5
than product sales.
cancellations in the North American tech sector and our UK market.
service global sales orders for the forthcoming years increasing 72.5% YoY.
Turning to the performance between each half of the financial year, the following revenue analysis by type of service/product line
North American tech sector and the UK Market with Global Professional Services.
H1 2023
£m
£m
% change
at actual
rates
H1 2023
£m
Constant
currency
£m
% change at
constant
currency
111.1 93.6 111.1
32.2 28.4 32.2
1.7 1.7
Total Cyber Security revenue 145.0 145.0
H2 2023
£m
H2 2022
£m
% change
at actual
rates
H2 2023
£m
Constant
currency
H2 2022
£m
% change at
constant
currency
88.2 88.2
35.6 30.2 35.6
2.0 3.3 2.0 3.4
Total Cyber Security revenue 125.8 125.8
Cyber Security gross profit is analysed as follows:
2023
£m
2023
% margin
2022
£m
2022
% margin
% pts
change
UK and APAC 40.3 34.0% 46.4 40.5%
North America 26.1 26.3% 29.8
Europe 19.7 37.1% 32.3% 4.8% pts
Cyber Security gross profit and % margin 86.1 31.8% 92.3 35.7%
lower technical attrition.
Turning to the performance between each half of the financial year, the following gross profit analysis by originating country further
H1 2023
£m
H1 2023
% margin
£m
% margin
% pts
change
UK and APAC 22.9 37.2% 22.4
North America 16.6 28.0% 32.0%
Europe 9.7 40.1% 7.9 8.0% pts
Cyber Security gross profit and % margin 49.2 33.9% 44.4 36.0%
NCC Group plc 65
Strategic report
Divisional performance continued
Cyber Security continued
one-off item, the margin would have increased 3.8%.
H2 2023
£m
H2 2023
% margin
H2 2022
£m
H2 2022
% margin
% pts
change
UK and APAC 17.4 30.6% 24.0 40.0%
North America 9.5 23.7%
Europe 10.0 34.6% 8.2 32.5%
Cyber Security gross profit and % margin 36.9 29.3% 47.9 35.4%
Software Resilience
Software Resilience revenue analysis – by originating country:
2023
£m
2022
£m
% change
at actual
rates
2023
£m
Constant
currency
2022
£m
% change
at constant
currency
UK 25.8 25.4 25.8 25.4
North America 34.5 26.8 28.7% 34.5 30.2
Europe 4.0 4.0 4.2
Total Software Resilience revenue 64.3 56.3 64.3 59.8 7.5%
2
, Software Resilience revenue decreased
Turning again to the performance between each half of the financial year, the following revenue analysis by originating country further
H1 2023
£m
£m
% change
at actual
rates
H1 2023
£m
Constant
currency
£m
% change
at constant
currency
UK 12.3 12.3
North America 17.3 40.7% 17.3
Europe 2.0 2.0 — 2.0 2.0 —
Total Software Resilience revenue 31.6 26.9 31.6 29.4 7.5%
H2 2023
£m
H2 2022
£m
% change
at actual
rates
H2 2023
£m
Constant
currency
H2 2022
£m
% change
at constant
currency
UK 13.5 5.5% 13.5 6.3%
North America 17.2 17.2
Europe 2.0 2.0 2.2
Total Software Resilience revenue 32.7 29.4 32.7 30.4 7.5%
Software Resilience revenues analysed by service line:
On a statutory basis
2023
£m
2022
£m
% change
at actual
rates
2023
£m
Constant
currency
2022
£m
% change
at constant
currency
Software Resilience contracts 42.8 42.8 40.4 5.9%
Verification services 21.5 21.5
Total Software Resilience revenue 64.3 56.3 64.3 59.8 7.5%
Financial review continued
NCC Group plc 66
Divisional performance continued
Software Resilience continued
After considering the prior year Software Resilience fair value revenue adjustment
2
currency
FY23 statutory results, as the adjustment has unwound following the renewal of IPM contracts or completion of verification services.
Gross margin is analysed as follows:
2023
£m
2023
% margin
2022
£m
2022
% margin
% pts
change
UK 18.2 70.0% 69.3%
North America 25.0 72.9% 74.3%
Europe 2.7 67.5% 2.8 68.3%
Software Resilience gross profit and % margin 45.9 71.4% 40.3
2
, Software Resilience gross profit decreased
Turning again to the performance between each half of the financial year, the following gross profit analysis by originating country
H1 2023
£m
H1 2023
% margin
£m
% margin
% pts
change
UK 8.4 68.3% 9.0
North America 12.6 72.8% 8.9 72.4% 0.4% pts
Europe 1.3 65.0% 70.0%
Software Resilience gross profit and % margin 22.3 70.6%
H2 2023
£m
H2 2023
% margin
H2 2022
£m
H2 2022
% margin
% pts
change
UK 9.8 72.6% 8.6 67.2% 5.4% pts
North America 12.4 72.1% 75.9%
Europe 1.4 70.0% 66.7% 3.3% pts
Software Resilience gross profit and % margin 23.6 72.2% 0.8% pts
Individually Significant Items
2023
£m
2022
£m
North America Cyber Security goodwill impairment 9.8 —
Fundamental re-organisation costs 4.2 —
Costs associated with strategic review of Software Resilience business 3.0 —
NCC Group A/S goodwill impairment 3.0 —
IPM Software Resilience bushiness deferred income adjustment —
Profit on disposal of DDI business —
Costs directly attributable to the acquisition of IPM — 0.9
Total ISIs 14.7 0.9
for the NA Assurance business following the recent reduction in spend by North American technology clients and £4.2m in relation to
fundamental reorganisation costs as we reshaped the Group to implement the next chapter of the Group’s strategy. Costs associated
Finance costs
Finance costs for the period were £6.2m compared to £3.7m in 2022 due to an increase in borrowing following the IPM acquisition
December 2026. The average interest rate for the year was 4.54% and is currently 6.27% following recent changes to base interest
NCC Group plc 67
Strategic report
Taxation
factors including the non-deductibility impact of goodwill impairment. See note 6 for further details. The Group’s adjusted tax rate is
against the benefit of US R&D tax claims and a prior year credit in relation to the tax treatment of the IPM acquisition.
2023 2022
Statutory
Basic EPS 7.4p
Diluted EPS 7.4p
Adjusted
1
Basic EPS 6.1p
Weighted average number of shares (million)
Basic 310.4 309.5
Diluted 311.2
Cash flow and net debt
1
The table below summarises the Group’s cash flow and net debt
:
2023
£m
2022
£m
Operating cash inflow before movements in working capital 37.9 49.3
19.7
Decrease in inventories 0.1 0.2
Cash generated from operating activities before interest and taxation 42.6 60.3
Interest element of lease payments
Finance interest paid
Taxation paid
Net cash generated from operating activities 32.1 54.8
Purchase of property, plant and equipment
Software and development expenditure
2.0 —
Acquisition of trade and assets as part of a business combination
Equity dividends paid
Purchase of own shares —
Proceeds from the issue of ordinary share capital 0.1 0.8
Net movement 4.8
83.3
Foreign exchange movement
Closing net debt excluding lease liabilities
1
Lease liabilities
Closing net debt
1
Financial review continued
NCC Group plc 68
Cash flow and net debt
1
continued
Net debt
can be reconciled as follows:
2023
£m
2022
£m
Cash and cash equivalents 34.1 73.2
Bank overdraft —
Net debt excluding lease liabilities
1
Lease liabilities
Net debt
1
The calculation of the cash conversion ratio
is set out below:
2023
£m
2022
£m
% change/
% pts
42.6 60.3
Adjusted EBITDA
41.4 59.2
Cash conversion ratio
1
102.9%
measures. See Note 3 for an explanation of APMs and adjusting items.
the remaining £3.8m is contingent on novation of certain customer contracts. £2m has been received post year end and it is expected
that the remaining proceeds will be received in FY24.
Borrowings
multi-currency revolving credit facility and the remaining $46.7m of the original $70m term loan that was maturing in June 2024. The
new facility now matures in December 2026 and includes an £75m uncommitted accordion option. In addition, we also secured an
increase to our leverage covenant from 2.5x to 3.0x with an additional acquisition spike to 3.5x for the first twelve months of any
acquisition. The weighted average margin of the facility also decreased and is payable on a ratchet mechanism above SONIA & SOFR
was 4.54% and is currently 6.27% following recent changes to base interest rates.
Dividends
This represents a dividend equal to that paid in the prior year as the Board is conscious of the need to invest in new strategy and
manage its net debt accordingly following the challenging year.
Guy Ellis
28 September 2023
NCC Group plc 69
Strategic report
Principal risks and uncertainties
Risk management
Risk is an inherent part of doing business and risk management
is a fundamental part of good corporate governance. A successful
risk management process balances risk and reward and is
underpinned by sound judgement of their impact and likelihood.
The Board has overall responsibility for ensuring that NCC Group
has an effective risk management framework, which is aligned
to our business objectives.
The Board has established a Risk Management Policy, which
has established protocols, including:
•
Roles and responsibilities for the risk management framework
•
Risk scoring framework
•
A definition of risk appetite
summarises the Group’s overall approach to risk management,
which is supported by a web-based tool – the Integrated Risk
management model described in the next section and records
both strategic and operational risk registers and tracks risk
mitigation action plans, helping embed ownership of risks and
treatment actions while also providing access to live management
information, which is used at both a Board and operational
management level.
NCC Group’s approach to risk management
NCC Group adopts both a “top-down” and “bottom-up” approach
to risk, to manage risk exposure across the Group to enable the
effective pursuit of strategic objectives. The approach is
The approach is one of collaboration, which supports our
comprehensive approach to risk identification, from the “top
down” and “bottom up”. The Group believes that this is the most
efficient and effective way to identify its business risks.
Top down
The Board, Audit Committee and Cyber Security Committee
review risks on an ongoing basis and are supported by the Executive
Committee and subject matter specialists (including Software
Resilience, Assurance, information security, data protection and
strategic objectives and any barriers to their achievement.
Bottom up
The Board and senior leadership team engage with colleagues
at every level of the Group in recognition of the importance of
their expertise, contribution and views. In relation to matters
of wrongdoing, or risks not being recognised and adequately
managed, the Group has a robust and effective whistleblowing
procedure, which is supported by the Safecall reporting line.
Embedded risk
NCC Group plc 70 NCC Group plc 70
Managing risk from the top down
Managing risk from the bottom up
Top down
Strategic risk management
Bottom up
Operational risk management
•
Establishing guidance on the Group’s
approach to risk management and
establishing the parameters for risk
appetite and associated decision making
•
Identification, review and management
of identified Group strategic risks and
associated actions
•
Ongoing consideration of:
Board
Audit Committee
Cyber Security
Committee
•
Periodically assessing the effectiveness
of the embedded Group risk
management process
•
Challenging the content of the strategic
risk register to support a comprehensive
and balanced assessment of risk
•
Reporting on the principal risks and
uncertainties of the Group
•
Implementing and embedding the Group’s
Risk Management Policy and approach
•
Directing the delivery of the Group’s
identified actions associated with
managing/mitigating risk
•
Identification of key risk indicators,
monitoring and taking timely action
where appropriate
Executive Board
and
leadership team
•
Responsible for reviewing the operational
risks across the business units and Group
•
Challenging the appropriateness and
adequacy of proposed action plans
to mitigate risk
•
Giving due consideration to the
aggregation of risk across the Group
•
Provisioning suitable cross-functional/
business unit resource to effectively
manage risk where appropriate
•
Instrumental in developing the risk
management framework adopted by
the Board
•
Providing governance and control over
the IRMS
•
Conduit between the Board and the
business units – providing training
and support where appropriate
•
Developing and executing a risk-based
internal audit plan to assess the
management of risks
Global governance
function, incl.
dedicated CISO
•
Ongoing monitoring and reporting to
the Board in relation to the progress being
made by the business units in implementing
agreed action plans to mitigate strategic risk
•
CISO dedicated to the identification,
management, monitoring and reporting of
data security risks
•
Execution of the delivery of the Group’s
identified actions associated with
managing risk
•
Timely reporting on the implementation
and progress of agreed action plans
•
Provision of key risk indicator updates
Business units
•
Identification and reporting of strategic risk
to the Board
•
Provision of reports and data relating
to significant emerging risks to the Group
•
Implementation of risk management
approach which promotes the ongoing
identification, evaluation, prioritisation,
mitigation and monitoring of
operational risk
Effective pursuit of strategic objectives
NCC Group plc 71
Strategic report
Risk management model
The Board has overall responsibility for ensuring that NCC Group
adopts an effective risk management model, which is aligned to
our objectives and promotes good risk management practice.
We have therefore adopted the model described in this section
and summarised in the diagram above.
The Board, Audit Committee, Cyber Security Committee and
executive management team review risks on an ongoing basis
throughout the year. The appropriateness and relevance of the
global governance team to ensure that it continues to be updated,
meets the needs of the Group and remains in line with good risk
management practice. In addition, there is a robust process in place
for monitoring and reporting the implementation of agreed actions.
We are satisfied that the Risk Management Policy, framework
and model currently in place are sufficient to manage risk across
the Group.
The key areas of identifying, assessing, addressing and
monitoring risks are explained in more detail below:
Identify
Risks exist within all areas of our business and it is important for
us to identify and understand the degree to which their impact and
likelihood of occurrence will affect the delivery of our key objectives.
This is achieved through day-to-day working practices and
incorporates risks in both the internal and external environment.
Examples of identification include horizon scanning for emerging
risks such as increasing energy costs, takeover risks, legislative
and market changes and geopolitical risks.
All identified risks are initially assessed for their “inherent” risk
accounts for the likelihood of an event occurring and the impact
that it may have on the Group. The scoring mechanism adopted
takes account of high impact, low likelihood events and these
risks are managed in a timely manner.
In addition to ongoing risk identification, an annual exercise is
undertaken to review the Group’s strategic risk universe by the
Board. This exercise is reliant on the “top-down”, “bottom-up”
approach discussed earlier.
Assess
Post-identification of the Group’s inherent risk exposure,
a comprehensive assessment of the effectiveness of current
mitigating controls is undertaken. This exercise takes account
of the design of the current control environment and the
application of these controls prior to assessing the Group’s
current exposure to risk – mitigated risk score. The Board uses
a number of sources of information to support the scoring
of risk and these include, but are not limited to:
•
Management updates
•
Action tracking and reporting
•
Control environment policies and procedures
•
Independent audit activity
•
Project monitoring reports
Address
Having identified and assessed the risks faced by the Group, the
risks are scored according to likelihood of occurring and impact
to the business should they occur. The risks are then mapped
according to their rating onto a risk heat map, which reflects the
Group’s overall risk appetite set by the Board. The Group’s Risk
Management Policy then provides guidance on the expected
level of response to those risks, depending on where they sit on
the risk heat map. The heat map shows the four bandings in the
different shades of risks as set out below as well as expected
actions and responses to risks in these areas:
•
Green – within appetite. Ongoing monitoring in place.
•
Amber – out of appetite. Some actions are required to treat
the risk to bring this within acceptable levels.
•
Purple – significantly out of appetite. High combination of
residual probability and impact. Management actions are
required, with some urgency, to treat the risk, reducing this
to acceptable levels.
•
Grey/black – risks that are deemed to have such an impact
that they could theoretically impact the ability of the business
to continue in existence. If any, they would need consideration
in assessing in the Directors’ Viability Statement.
The below heat map shows the residual risk after mitigation.
An assessment of whether additional actions are required to
reduce our risk exposure is undertaken, with actions falling
into the one of four categories:
•
Treat – develop an action plan (applying responsibility,
implementation of additional controls, or increase the
requirement for additional assurance over the adequacy
and effectiveness of the existing controls.
•
Transfer – use a third party specialist to undertake the activity,
thus mitigating the risk.
•
Tolerate – determine the risk is within appetite.
•
Terminate – exit the activity.
Output from the evaluation of strategic risks has resulted in
milestone plans owned by senior business leaders, or has been
used in the development of the Group’s transformation programme.
Risk
management
model
Assess
adequacy and
effectiveness
of existing
controls
Identify
risks
Identify
inherent risks
and likelihood
of impact
Monitor
delivery of
action plans/
risk universe
Assign
Director-
level
sponsorship
Evaluate
mitigated risks
and likelihood
of impact
Develop
action plans
(
treat, transfer,
tolerate,
I
d
e
n
t
i
f
y
M
o
n
i
t
o
r
A
s
s
e
s
s
A
d
d
r
e
s
s
C
o
r
p
o
r
a
t
e
g
o
v
e
r
n
a
n
c
e
C
o
r
p
o
r
a
t
e
g
o
v
e
r
n
a
n
c
e
Principal risks and uncertainties continued
NCC Group plc 72
Monitor
Ongoing monitoring of risks and related actions is key to the
implementation of our risk management model and, therefore,
NCC Group is committed to making enterprise-wide risk
management part of business as usual. Examples of ongoing
monitoring of business risks include, but are not limited to:
•
Annual review of the external audit strategy and plan by the
Audit Committee and Chief Financial Officer to ensure inclusion
of key financial risks
•
Annual review of the annual internal audit plan to validate
that it incorporates key areas of business risk
•
A review of internal audit reports issued during the period,
including a summary of progress against previously raised
management actions at each Audit Committee meeting
•
Annual review of the strategic risk register by the Enterprise
Risk Management Steering Group and Board to ensure that
it includes risks arising in year
Internal control
While risk management identifies threats to the Group achieving
its strategic objectives, internal controls are designed to provide
assurance that these objectives are being achieved, such as the
effectiveness and efficiency of operations and delivery, accurate
and reliable financial reporting, and compliance with applicable
laws and regulation.
NCC Group has established a robust internal control framework,
which is made up of a number of components:
Control environment
The control environment has primarily been established taking
account of the Group’s values (working together; being brilliantly
Code of Ethics, which sets the foundations for the expected
behaviours, values and competencies for all colleagues across the
Group. The Board, Executive Committee and extended leadership
team lead by example and strive to maintain effective control
environments, while also maintaining integrity and transparency.
Risk assessments
Risk assessments are conducted at both a strategic and operational
level of the Group and support the Group in understanding the
risks that it faces and the controls in place to mitigate them.
Importantly, they provide a mechanism to identify operational
improvements and are vital in our transformational programmes.
Low
0
2
3
4
5
2 3 4 5
High
Impact
Likelihood
Low High
19
14
12
18
13
21
17
9
10
6
4
7
8
5
1
3
2
24
16
20
22
11
15
23
number
number Risk
1 1
Ineffective execution of the Group’s strategy
2 2
Poor and/or ineffective change management
mechanisms (previously management of
3
n/a
Over-reliance on market sector, region, products/
4 6
Cyber attack (previously information security risk
5 4
Significant business systems failure (previously
6
n/a
7 7
Insufficient quality, integrity and availability
of management information (previously quality
of management information systems and internal
8
n/a
9
n/a
10
n/a
11
n/a
12 5
Inability to retain/recruit colleagues to meet
the resource needs of the business (previously
attracting and retaining appropriate colleague
13 3
Poor colleague health and wellbeing, including
14
n/a
Economic changes/volatility impact on revenue
15
n/a
Unable to meet the service and resource needs
16
n/a
17
n/a
18 9
International trade (previously international trade
19
n/a
20
n/a Undertaking work with disreputable clients or
21
n/a Service delivery does not achieve established
22
8
Loss of internationally recognised quality
and security standards (previously quality
23
n/a Criminal and civil legal action resulting in fines
24
10
Inability to identify and adopt emerging
regulations in a timely manner (previously
Policies and procedures
Established policies communicate expected behaviours and
these are supported through procedures and guidelines defining
required processes and controls. This in turn supports the
business to adopt efficient and effective control environments.
Information and communication
Access to accurate and timely data is key in supporting our
colleagues to make decisions and to be well informed in order
to conduct, manage and control their areas of responsibility.
NCC Group plc 73
Strategic report
Principal risks and uncertainties continued
A. Strategy
1. Ineffective execution of the Group’s strategy
VR
Link to strategy: Our clients Our capabilities Global delivery Differentiated brands
Previous risk name
Business strategy
Risk owner
Mike Maddison,
CEO
R
isk impact
A poor strategy or ineffective execution of a
strategy could have a material negative impact
on the Group’s financial performance and value.
It would potentially weaken the Group
compared to its competitors and risk the
Group’s established position in the marketplace.
Risk movement
Key controls and mitigating factors
New strategy launched in February 2023 and in
process of being implemented with full Board
support.
New leadership team in place, including new Head
of Strategy.
Strategy accelerated (delivery centre in Manila due
being made.
2. Poor and/or ineffective change management mechanisms
Link to strategy: Our clients Our capabilities Global delivery Differentiated brands
Previous risk name
Management of
strategic change
Risk owner
Mike Maddison,
CEO
R
isk impact
Implementation of projects that then cost more
to deliver, take longer to deliver and result in
Poor delivery of change could ultimately impair
business performance.
As the Group adapts and executes its strategy,
there are a number of complex projects and
initiatives that not only need to be delivered
but also require understanding and support
from all colleagues.
Risk movement
Key controls and mitigating factors
The Group has recently recruited a new Head
of Strategy who will manage the implementation
alongside key stakeholders.
New leadership team in place to drive the new
strategy.
Development of business cases which clearly
articulate project objectives including delivery
metrics which are monitored.
Internal control continued
Activity monitoring
The minimum financial controls framework was established in
FY20. Further enhancement of the framework is being designed
and implemented to align with the Corporate Reform and
upcoming Directors’ attestation of internal controls.
Financial accounting and reporting follow generally accepted
accounting practices.
Group review and approval procedures exist in relation to major
areas of risk and require Executive Committee/Board approval,
including mergers and acquisitions, major contracts, capital
expenditure, litigation, treasury management and taxation policies.
Compliance with all legislation, current and new, is closely monitored.
Risk and control reporting structure
During the current financial year, NCC Group has continued
to focus on embedding the “three lines of defence” to provide
a robust internal controls structure that will support the Board,
Audit Committee, Cyber Committee, Executive Committee and
extended leadership team with accurate and reliable information
in relation to the systems of internal control.
Three lines of defence:
•
First line
•
Second line – information security, data protection, health
and safety, and legal
•
Third line – risk and assurance, incorporating internal audit,
standards and support, assessing compliance with standards
and external audit, both financial and operational, providing
independent challenge and assessment
Principal risks and uncertainties
The introduction of the new strategy in February 2023, and
introduction of new Executive Committee members, has resulted
in a revisit and relaunch of the Company’s risk management
framework giving rise to a robust assessment of principal risks and
thus resulting in changes to the identified risks and uncertainties.
The Group continues to operate in a particularly dynamic
and evolving marketplace. The current risk register has been
developed to reflect those factors and includes those risks that
would threaten its business model, future performance, solvency
or liquidity. Detailed descriptions of the current principal risks
and uncertainties faced by the Group, their potential impact
and mitigating processes and controls are set out below.
The heat map on page 73 provides a pictorial representation
of the Group’s net risks and their direction of travel.
The strategic risks are based on the four pillars: our clients,
our capabilities, global delivery and differentiated brands.
We have identified eight risk themes:
A. Strategy – this is the overarching strategic risk
B.
C
yber and information security
C. Innovation and product development
D.
P
eople and partners
E. Market and competition
F.
B
rand and reputation
G. Quality and delivery
H.
L
egal, regulatory compliance and governance
Extraordinary risk during the year
Customer concentration risk materialised and due to some large US-based tech customers not renewing their contracts, this had
an adverse effect on revenue resulting in the profit warning. We did recognise this as a risk in FY22 as part of business strategy
and viability risk, but the new strategy looks to diversify our client base to ensure this does not occur again.
NCC Group plc 74
Risk movement: Increased Decreased Unchanged
Viability risk:
VR
Ne
w risk:
NR
Risk impact: High
A. Strategy continued
3. Over-reliance on market sector, product/service or client
VR
Link to strategy: Our clients Our capabilities Global delivery Differentiated brands
Previous risk name
N/A
Risk owner
Mike Maddison,
CEO
Risk impact
A loss of key customers or over-reliance
on market sector can result in a reduction
in revenue and consequential impact on
profitability and cash generation.
Risk movement
NR
Key controls and mitigating factors
The new strategy looks to help mitigate this risk
and ensure we don’t have any future overexposure
to a market sector or client.
Viability risk considers this as part of the
scenarios modelled.
B. Cyber and information security
4. Cyber attack
VR
Link to strategy: Our capabilities Global delivery Differentiated brands
Previous risk name
Information security risk
Risk owner
Rebecca Fox,
CIO
Risk impact
Data breach leading to fines from regulators
and reputational damage.
Lack of availability in systems.
Inability to operate services resulting in loss
of customer trust, resulting in loss of revenue
and negative impact on share price.
Impact on national security due to our work
with government clients.
Risk movement
Key controls and mitigating factors
The Board operates a Cyber Security Committee
chaired by a NED.
All colleagues globally are required to undertake annual
and ongoing security training and updates to alert
them to potential methods of security breach and to
their responsibilities in safeguarding information and
reporting potential issues.
Security testing is regularly carried out on the
Group’s infrastructure and there are extensive
response plans, which are tested.
Comprehensive plans are in place and being
delivered associated with discharging our data
protection obligations.
Deployed an Information Security Management
5. Significant business systems failure
VR
Link to strategy: Our capabilities Global delivery Differentiated brands
Previous risk name
Availability of critical
information systems
Risk owner
Rebecca Fox,
CIO
Risk impact
Inability to transact, operate and deliver
services resulting in loss of customer trust,
resulting in loss of revenue and negative
impact on share price.
Risk movement
Key controls and mitigating factors
Deployed an Information Security Management
IT strategy of continued cloud migration which
has greater resilience and availability.
Business Continuity Plans, including Crisis
Management, in place and tested regularly.
Change management process in place within
IT which assists a reduction in incidents caused
by human error.
Backups in place and single points of failure
identified and mitigated in the event of
prolonged loss of systems.
6. Loss of client/colleague data
Link to strategy: Our clients Differentiated brands
Previous risk name
N/A
Risk owner
Guy Ellis,
CFO
Risk impact
Data breach leading to fines from regulators
and reputational damage.
Risk movement
NR
Key controls and mitigating factors
Deployed an Information Security Management
Regular compliance training, including data
protection, provided to all colleagues at least annually.
Information classification and handling and data
privacy policies in place.
NCC Group plc 75
Strategic report
Principal risks and uncertainties continued
B. Cyber and information security continued
7. Insufficient quality, integrity and availability of management information
VR
Link to strategy: Our clients Our capabilities Global delivery
Previous risk name
Quality of management
information systems and
internal business processes
Risk owner
Guy Ellis,
CFO
Risk impact
Suboptimal business decision making and
performance as key financial performance
data is not available or trusted.
Risk movement
Key controls and mitigating factors
Standardised business process control standards are
in place and subject to regular review by the global
standards and support team.
C. Innovation and product development
8. Intellectual property theft or exposure
Link to strategy: Differentiated brands
Previous risk name
N/A
Risk owner
Siân John,
CTO
Risk impact
Reputational damage from losing client data
and industrial espionage, resulting in loss of
revenue and loss of competitive advantage
from threat of malicious actors.
Risk movement
NR
Key controls and mitigating factors
Security and technical controls in place through our
9. Ineffectual product/service management
Link to strategy: Global delivery
Previous risk name
N/A
Risk owner
Siân John,
CTO
Risk impact
Loss of revenue from uncompetitive solutions
and failure to compete effectively.
Failure to align to the business strategy
resulting in lack of client trust leading
to a loss of clients.
Failure to maintain competitive advantage.
Ineffectual marketing strategy.
Risk movement
NR
Key controls and mitigating factors
Suitably qualified and experienced product managers.
Quality review process.
Customer feedback and escalation process.
Marketing strategy in place focused on
product development.
10. Failed product/service launch
Link to strategy: Global delivery
Previous risk name
N/A
Risk owner
Kevin Brown,
COO
Risk impact
Cost implications.
Reputational damage.
Loss of colleague morale.
Loss of customer trust.
Poor development processes.
Insufficient speed of execution.
Risk movement
NR
Key controls and mitigating factors
Robust planning processes and consultation
Management oversight and review process.
Use of modern development practices such
as “Agile” and “design thinking”.
Principal risks and uncertainties continued
Risk movement: Increased Decreased Unchanged
Viability risk:
VR
N
ew risk:
NR
Risk impact: High
NCC Group plc 76
D. People and partners
11. Insufficient workforce resilience
Link to strategy: Our capabilities
Previous risk name
N/A
Risk owner
Michelle Porteus,
Chief People Officer
Risk impact
Inability to deliver to clients resulting in loss
of revenue.
Loss of colleague morale and risk of “burnout”.
Risk movement
NR
Key controls and mitigating factors
Workforce resourcing managed by Chief
People Officer.
Full review of workforce requirements
undertaken as part of strategic review.
12. Inability to retain/recruit colleagues to meet the resource needs of the business
VR
Link to strategy: Our capabilities
Previous risk name
Attracting and retaining
appropriate colleague
capacity and capability
Risk owner
Michelle Porteus,
Chief People Officer
Risk impact
Loss of key colleagues or significant colleague
turnover could result in a lack of necessary
expertise or continuity to execute the
Group’s strategy.
An inability to attract and retain sufficient high
calibre colleagues could become a barrier to the
continued success and growth of NCC Group.
Risk movement
Key controls and mitigating factors
Colleagues are offered an industry aligned
salary and benefits package, which can include
participation in share schemes, salary sacrifice
car scheme and retail discount offerings.
Improved communications with our colleagues
managed by the new Chief Marketing Officer.
New global delivery and operations centre opened
in Manila in September 2023
13. Poor colleague health and wellbeing, including pandemic
Link to strategy: Our capabilities
Previous risk name
Global pandemic
Risk owner
Michelle Porteus,
Chief People Officer
Risk impact
High turnover of staff based on low colleague
morale or “burnout”.
If significant number of colleagues are unable
to work this will impact client delivery and
could lead to a loss of revenue.
Risk movement
Key controls and mitigating factors
Various channels available to colleagues
to support with health and wellbeing.
Colleagues continue to successfully work in a
hybrid manner, delivering remote client services.
Mental health allies across the business.
Attractive office environments globally.
Risk assessments carried out regularly, for
example display screen equipment and shift workers.
E. Market and competition
14. Economic changes/volatility impact on revenue and profitability
Link to strategy: Our clients Our capabilities Global delivery Differentiated brands
Previous risk name
N/A
Risk owner
Mike Maddison,
CEO
Risk impact
Loss of clients or reduction in client spend will
result in a loss of revenue. Increases to interest
rates or inflation will impact profitability.
Risk movement
NR
Key controls and mitigating factors
Strategy accelerated (delivery centre in Manila due
being made, making NCC Group more resilient to
economic changes. Increased cost control
measures and actions.
Risk movement: Increased Decreased Unchanged
Viability risk:
VR
N
ew risk:
NR
Risk impact: High
NCC Group plc 77
Strategic report
Principal risks and uncertainties continued
Principal risks and uncertainties continued
E. Market and competition continued
15. Unable to continue to meet the service and resource needs of our clients
VR
Link to strategy: Our capabilities Global delivery
Previous risk name
N/A
Risk owner
Mike Maddison,
CEO
Risk impact
Loss of clients will result in a loss of revenue
and reputational damage.
Risk movement
NR
Key controls and mitigating factors
New strategy includes capabilities as a key
pillar and the business has been restructured
to mitigate this risk.
16. Lack of visibility in the marketplace
Link to strategy: Our clients Our capabilities Global delivery Differentiated brands
Previous risk name
N/A
Risk owner
Mike Maddison,
CEO
Risk impact
Loss of clients will result in a loss of revenue.
Risk movement
NR
Key controls and mitigating factors
Chief Marketing Officer is planning a rebrand
as per the new strategy.
Continue to publish expert advice and
content publicly.
17. Reliance on relationships with third parties
Link to strategy: Our clients Our capabilities Global delivery Differentiated brands
Previous risk name
N/A
Risk owner
Mike Maddison,
CEO
Risk impact
Loss of margin.
Reputational damage if third parties
don’t deliver.
Risk movement
NR
Key controls and mitigating factors
Contracts in place with third parties.
Ongoing review of service and delivery
from third parties.
18. International trade
Link to strategy: Our clients Our capabilities Global delivery Differentiated brands
Previous risk name
International trade
Risk owner
Kevin Brown,
Chief Operating Officer
Risk impact
Failure to comply with changing global regulations
may cause disruption to our business.
Risk movement
Key controls and mitigating factors
The new strategy is focused on globalisation
and thus the resource structure is being designed
to promote global delivery.
F. Brand and reputation
19. Adverse publicity in news and social media
Link to strategy: Differentiated brands
Previous risk name
N/A
Risk owner
Angela Brown,
Chief Marketing Officer
Risk impact
Reputational damage leading to loss of existing
and potential clients resulting in loss of revenue.
Risk movement
NR
Key controls and mitigating factors
Policies and procedures in place which follow
good practice and ethics.
Research quality review process managed
by a panel of experts.
Risk movement: Increased Decreased Unchanged
Viability risk:
VR
N
ew risk:
NR
Risk impact: High
NCC Group plc 78
F. Brand and reputation continued
20. Undertaking work with disreputable clients or in sanctioned/undesirable jurisdictions
Link to strategy: Our clients Global delivery
Previous risk name
N/A
Risk owner
Angela Brown,
Chief Marketing Officer
Risk impact
Reputational damage.
Potential fines.
Risk movement
NR
Key controls and mitigating factors
Country risk assessment process in place
for new business.
Higher risk countries have a risk assessment
completed and approved appropriately.
G. Quality and delivery
21. Service delivery does not achieve established quality standards
VR
Link to strategy: Our clients Our capabilities
Previous risk name
N/A
Risk owner
Chief Operating Officer
Managing Director
Risk impact
Clients don’t renew, have their SLA breached
or cancel mid-service leading to loss of revenue.
Negligence in delivery leading to legal action
or loss of revenue and reputational damage.
Risk movement
NR
Key controls and mitigating factors
Quality assurance processes in place.
Standard methodologies and procedures followed.
Customer feedback and complaints process.
Ongoing internal training programmes.
22. Loss of internationally recognised quality and security standards
VR
Link to strategy: Our capabilities Global delivery Differentiated brands
Previous risk name
Quality and security
management systems
Risk owner
Guy Ellis,
CFO
Risk impact
The risk of the Group failing to retain a core
consequential loss of key customer accounts
or ability to operate.
Risk movement
Key controls and mitigating factors
We operate a comprehensive programme
to ensure the retention of our core standards.
Policies and procedures in place and audited
against the design and application.
External assessors conduct audits at least
annually confirming the retention of our quality
and security standards.
We have extended our ISO standards to more
locations during FY23.
H. Legal, regulatory compliance and governance
23. Criminal and civil legal action resulting in fines and incarceration
VR
Link to strategy: Our clients Global delivery Differentiated brands
Previous risk name
N/A
Risk owner
Guy Ellis,
CFO
Risk impact
Reputational damage from legal action being
taken and financial impact of the fines and the
impact it may have on key customer accounts.
Risk movement
NR
Key controls and mitigating factors
Legal team reviews customer contracts.
Annual compliance training undertaken including ethics
(covering anti-bribery and corruption, whistleblowing,
and safety, information security and data protection.
Risk movement: Increased Decreased Unchanged
Viability risk:
VR
N
ew risk:
NR
Risk impact: High
NCC Group plc 79
Strategic report
In addition to identifying the Group strategic risks, we continuously review and monitor emerging risks through horizon scanning;
publications; assessing regulatory changes and how they may impact the Group; and ensuring adequate oversight over
significant projects.
Emerging risks
Risk area Risk Risk description Mitigating controls
People and partners Pandemic
Colleagues can deliver client
services remotely.
Market and
competition
Blackouts Potential energy supply shortages
as a result of supply issues created
by the Russian invasion of Ukraine.
Emergency backup generators
in place and tested.
Property portfolio being reviewed.
Increasing energy costs Energy costs have increased
significantly since the Russian
invasion of Ukraine.
Factored into budget.
Geopolitical Legislative change; political party
change; and Russian invasion of Ukraine.
Country risk assessment process
in place for new business.
Takeover
Profit warning and significant drop
in the share price expose the Group
to a takeover.
New strategy being implemented.
Quality and delivery Off-shoring Geopolitical landscape, including
changing legislation and taxation.
Project team considering all key
risks and using subject matter
Extending ISO certifications to
include new centre of excellence.
Project management Significant number of large
scale projects which need
to be adequately managed.
New Head of Strategy responsible
for project management.
Development of business cases
which clearly articulate project
objectives including delivery
metrics which are monitored.
Principal risks and uncertainties continued
Principal risks and uncertainties continued
H. Legal, regulatory compliance and governance continued
24. Inability to identify and adopt emerging regulations in a timely manner
Link to strategy: Our clients Global delivery Differentiated brands
Previous risk name
Sustainability/climate change
Risk owner
Guy Ellis,
Chief Financial Officer
Risk impact
Non-compliance with regulations resulting in
fines from regulators and reputational damage
leading to loss of key customer accounts and
shareholder investment.
Risk movement
Key controls and mitigating factors
TCFD came in last year and we disclosed accordingly.
Horizon scanning for new regulations, for example
CSRD, ISSB, Corporate Governance Reform and NIS.
Risk movement: Increased Decreased Unchanged
Viability risk:
VR
N
ew risk:
NR
Risk impact: High
NCC Group plc 80
Viability statement
Viability statement
The context for assessment In accordance with the requirements
of the UK Corporate Governance Code, the aim of the Viability
Statement is for the Directors to report on the assessment of the
prospects of the Group meeting its liabilities over the assessment
period, considering the current financial position, outlook,
principal risks and uncertainties, and key judgements and
estimates in preparing the Financial Statements.
The Directors have based their assessment of viability on the
Group’s current business model and strategic plan, which is
updated and approved annually by the Board, in line with our
objectives to deliver sustainable and profitable growth, increase
shareholder value and offer an improved service and product
offering to our customers. This is underpinned by the strategic
priorities outlined on pages 24 to 27 of the Strategic Report. The
effective management of principal risks and uncertainties is
outlined within pages 70 to 80 and this assessment emphasises
those risks that could theoretically threaten the Group’s ability to
The assessment period
The Directors have assessed the viability of the Group over the
three-year period to May 2026, as this is an appropriate planning
time horizon given the speed of change and customer demand in
the industry and is in line with the Group’s strategic planning period.
Assessment of viability
The viability of the Group has been assessed considering the
Group’s current financial position, available bank facilities, and
the Board approved FY24 budget and three-year strategic plan.
It’s been a challenging year for the Group with a decline in the rate
of revenue growth and overall profitability, resulting in a loss
before taxation of £4.3m. The Group’s revenue performance and
profitability suffered from market volatility within Cyber Security
.
In particular, the Group experienced buying decision delays and
cancellations in the North American tech sector and our UK
market. These headwinds have further reinforced the need to
accelerate the implementation of our next chapter of the Group
strategy following its communication in February 2023. This strategy
requires a level of additional investment in 2024. Despite the above,
the Group has maintained consistent cash generation during the year.
Following the year end, the Group has engaged in additional
generating cost efficiencies across Cyber Security
and corporate
functions which is resulting in the implementation of a fundamental
reorganisation generating further savings compared to the prior
year. As a result of all of the above, the base case budget for
FY24 has been prepared on the basis that market volatility within
Cyber Security
partially continues with overall profitability
remaining similar to 2023.
In addition, the base case budget for FY24 also reflects recent
growth patterns in the other geographical regions and operating
segments, relevant growth opportunities for the Group based on
existing propositions and factoring in current macro-economic
factors most specifically existing inflationary pressures.
The Directors have also modelled the impact of certain severe
but plausible scenarios arising from the principal risks, which
have the greatest potential impact on viability in the period under
review, as set out in the table below. Further details of how these
sensitivities have been applied are provided in the going concern
The impact of these sensitivities has been reviewed against the
Group’s projected cash flow position, available bank facilities
and compliance with financial covenants over the three-year
Group’s financing arrangements and expiry dates. The sensitivities
applied under stress testing show adequate levels of headroom
and that no mitigating actions are required to address severe but
plausible scenarios modelled by management.
While noting that no mitigating actions are required to address
severe but plausible scenarios modelled by management, options
available include a reduction of planned capital expenditure,
headcount reduction, freezing pay and recruitment and not
paying a dividend to shareholders, all of which are within the
Directors’ control and give an additional level of headroom.
Conclusions
Based on these severe but possible scenarios, the Directors
have a reasonable expectation that the Group and Company will
be able to continue in operation and remain commercially viable
over the three year period of assessment.
Viability risk
Risk as applied to viability
assessment Specifics of scenario modelled Potential impact
Ineffective
execution of the
Group’s strategy
Inability to retain/
recruit colleagues
to meet the
resource needs
of the business
A poor strategy or ineffective
execution of a strategy could
have a material negative
impact on the Group’s financial
performance and value.
Loss of key colleagues or
significant colleague turnover
could result in a lack of
necessary expertise or
continuity to execute the
Group’s strategy.
In order to consider the impact of the
risks identified management has
modelled two scenarios:
Assurance business does not improve
beyond that seen in FY23 Q4.
to be implemented as part of the
Group’s strategy are not executed.
Scenario modelled assumes annualised
impact of £3.2m adverse impact
on profitability.
The impact of these sensitivities has been
reviewed against the Group’s projected cash
flow position, available bank facilities and
compliance with financial covenants over the
three year viability period. The sensitivities
applied under stress testing show adequate
levels of headroom and that no mitigating
actions are required.
Over reliance
on market sector
or client
Economic changes/
volatility impact
on revenue
A loss of key customers or
over-reliance on market sector
can result in a reduction in
revenue and consequential
impact on profitability and
cash generation.
Loss of clients or reduction in
client spend will result in a loss
of revenue.
Scenario modelled assumes loss of key
customers resulting in a reduction in
profitability of £4.2m.
The impact of these sensitivities has been
reviewed against the Group’s projected cash
flow position, available bank facilities and
compliance with financial covenants over the
three year viability period. The sensitivities
applied under stress testing show adequate
levels of headroom and that no mitigating
actions are required.
Economic changes/
volatility impact
on profitability
Being a global organisation the
Group is exposed to global and
regional macro-economic
factors such as inflation and
rising interest rates.
Scenario modelled assumes additional
wage increases to align with regional
inflation rates across different
geographies of £5.0m. UK Interest rates
on borrowings forecast to rise a further
0.75% from original forecast. Incremental
annual utility costs of £0.2m included.
The impact of these sensitivities has been
reviewed against the Group’s projected cash flow
position, available bank facilities and compliance
with financial covenants over the three year
viability period. The sensitivities applied under
stress testing show adequate levels of headroom
and that no mitigating actions are required.
NCC Group plc 81
Strategic report
82 NCC Group plc —
The Board is committed to creating and
maintaining a culture where strong levels
of governance thrive throughout the
organisation, specifically ensuring that we send
out consistent messages on our values and
acceptable behaviours for our colleagues,
our customers, our suppliers and our advisers.
In this section
84 Chair’s introduction to governance
87 Governance framework
88 Board of Directors
90 Executive Committee
92 Board composition and division of responsibilities
102 Shareholder engagement
103 Audit Committee report
110 Nomination Committee report
113 Cyber Security Committee report
115 Remuneration Committee report
138 Directors’ report
142 Directors’ responsibilities statement
Governance
NCC Group plc 83
2022/23 highlights
•
Continued to hear from our designated NED for workforce
engagement who reports to every Board meeting
•
Recruited and on-boarded a new independent
a new perspective and dynamic to our Board discussions,
and now chairs the Audit Committee
•
Undertook our first ever externally facilitated Board
and Committee evaluation
•
Agreed a revised strategy
•
The Board visited North America and had the opportunity
to meet with colleagues
2023/24 priorities
•
a successful start
•
Continuing to focus on our stakeholders, particularly
in-person colleague engagement
•
Supporting the executive team with embedding the
new strategy
•
Working through the key priorities raised in the Board
evaluation and having regular check-ins on these
throughout the year
•
Supporting the executive team to set up our delivery
centre in the Philippines
Dear Shareholder
On behalf of the Board, I am pleased to present the Corporate
Governance Report for the year ended 31 May 2023. Throughout
the year the Board has worked cohesively as a team to enable
the Company to successfully navigate a turbulent and uncertain
period. I would like to thank the Board for its wise counsel and
continued efforts during this time. The Board is composed of
highly skilled and experienced Directors from a diverse range of
industries and backgrounds, all of whom contribute towards the
long-term success of the Company and show commitment and
enthusiasm in the performance of their roles and duties. The
Board believes that good governance is key to the long-term
success of the Group and is committed to achieving high
standards of governance.
I would like to thank all of my Board colleagues for their commitment,
support and flexibility over the past year. While we welcome
a return to face-to-face meetings, a number of our Board
meetings were conducted in a virtual environment by necessity.
This new hybrid way of working has enabled us to maintain
strong governance and robust decision making, delivering
against our strategy. During the year, a particular highlight was
our visit as a Board to North America in November 2022 and we
enjoyed spending time with colleagues in our New York office,
and we look forward to visiting more offices and meeting more
colleagues in the coming year.
The Board is committed to creating and maintaining a culture
where strong levels of governance thrive throughout the
organisation, specifically ensuring that we send out consistent
messages on our values and acceptable behaviours for our
colleagues, our customers, our suppliers and our advisers.
A continued commitment
With our recent appointments,
Chris Stone
Chair’s introduction to governance
84 NCC Group plc — Annual report and accounts for the year ended 31 May 2023
Board changes
Board composition and diversity
Governance standards
Our approach
Board tenure as at 31 May 2023
6 years 2 months
Mike Maddison
Guy Ellis
Chris Stone
4 years 10 months
Tim Kowalski
8 years 1 month
Chris Batterham
1 year 5 months
Julie Chakraverty
5 years 1 month
Jennifer Duvalier
5 years 8 months
Mike Ettling
NCC Group plc 85
Governance
Board composition and diversity
Effectiveness
You can read more about the Board and the Committee evaluation
on page 96
Our investors
Statement of compliance with the UK Corporate
Governance Code
•
Thank you
Chris Stone
Non-Executive Chair
Chair’s introduction to governance
NCC Group plc 86
Governance framework
•
•
•
•
•
•
•
Board
Board Committees
Chief Executive Officer
The different parts of the Company’s governance framework
are shown below, with a description of how they operate and
the linkages between them.
Audit
Committee
Nomination
Committee
Cyber Security
Committee
Remuneration
Committee
Read more on pages
103 to 109
Read more on pages
110 to 112
Read more on pages
113 and 114
Re ad more on pages
115 to 137
pages 92 to 101
NCC Group plc 87
Governance
Chris Stone
Appointment to the Board:
Career experience
External appointments
Appointment to the Board:
Career experience
External appointments
Appointment to the Board:
Career experience
External appointments
Appointment to the Board:
Career experience
External appointments
Our business is led by our Board of Directors.
Biographical and other details of the Directors are as follows:
N
Mike Maddison
Guy Ellis
Chris Batterham
A NC R
Board of Directors
C
NCC Group plc 88
A
C
N
R
Committee key:
Jennifer Duvalier
Julie Chakraverty
Appointment to the Board:
Career experience
External appointments
Appointment to the Board:
Career experience
External appointments
R NC
Appointment to the Board:
Career experience
External appointments
Mike Ettling
NCA R A
Other Directors during the year
Adam Palser
Tim Kowalski
Lynn Fordham
Appointment to the Board:
Career experience
External appointments
NCA R
NCC Group plc 89
Governance
Executive Committee
Angela Brown
Nick Rowe
Kevin Brown
Harmen Dikkers
NCC Group plc 90
Michelle Porteus
Rebecca Fox
Andrew Lemonofides
Siân John
NCC Group plc 91
Governance
Board composition and division of responsibilities
Role Responsibilities
Chair of the Board
Chief Executive Officer
Chief Financial Officer
Senior Independent
Director
Non-Executive Directors
Designated Non-
Executive Director
for engagement with
the workforce
Company Secretary
NCC Group plc 92
Meetings and attendance
Board Audit Nomination Cyber Security Remuneration
14
14
5
5
*
4
4
13
13
14
14
12
14 4
4
4
5 2
4 4
5
14
14 3
3
*
4
4 3
3 4
4
14
14 3
3 5
5 4
4
*
5
5
12
14
5
5 4
4 5
5
*
11
14 3
4
What principal decisions have been made and what have we looked at as a Board during 2022/23?
Section 172 statement
Principal decisions made during the year
NCC Group plc 93
Governance
What principal decisions have been made and what have we looked at as a Board during 2022/23?
Principal decisions made during the year
Topic Stakeholder group Decision taken Engagement process Reference
Board changes Colleagues,
shareholders,
customers,
our network
Reduction in
workforce
Shareholders,
colleagues,
customers
Board composition and division of responsibilities
NCC Group plc 94
Topic Stakeholder group Decision taken Engagement process Reference
Global delivery
centre in the
Philippines
Colleagues,
customers,
shareholders
Revised
strategy and the
strategic pillars
Colleagues,
customers,
shareholders
Refinancing our
bank facilities
Colleagues,
customers,
shareholders,
our
network
NCC Group plc 95
Governance
Board composition and division of responsibilities
What have we looked at as a Board during 2022/23?
Leadership and colleagues
•
•
•
•
•
•
•
•
Strategy
•
•
•
•
•
Governance
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
Financial
•
•
•
•
•
•
•
•
•
•
•
•
•
Other Group business
•
•
•
•
•
•
•
•
•
NCC Group plc 96
Board strategy review
Independent advice
Conflicts of interest
Colleague engagement
Board independence
•
•
•
•
•
•
NCC Group plc 97
Governance
Board composition and division of responsibilities
Lynn Fordham – induction and first impressions
Diversity
Annual re-election
Director induction, training and development
Board and Committee effectiveness review
My comprehensive induction programme and meeting
the right colleagues and advisers before I started on
1 September 2022 meant I had a good appreciation
of NCC Group and for the Company’s issues before my
first Board meeting.
I believe that the insights I gained allowed me to make
a positive contribution from the outset and although my
first Board meeting was a virtual one, I have now had
the opportunity to attend four in-person Board meetings
Strategy Day and these, together with various events
and site visits, have allowed me to further engage with
a number of colleagues.
Being on the Audit Committee and then recently
taking over from Chris Batterham as Chair has really
allowed me to “get under the skin of NCC Group”
and add value from my experiences gained elsewhere.
I have really enjoyed my early months with NCC Group
and look forward to contributing further and driving
improvements at NCC Group particularly those within
the Audit Committee’s sphere of influence, and also
in my work as lead NED for Sustainability.”
Lynn Fordham
Independent Non-Executive Director
NCC Group plc 98
Board, Committee and Chair evaluation process 2023
MSP reviewed, with the Company
Secretary, the 2022 questionnaires
and evaluation exercise results
and, based on this, recommended
using the same questionnaires for
the 2023 Board Effectiveness
Review to maintain continuity and
provide year on year comparisons.
This approach was approved
by the Chair and, for the
Chair’s review, the Senior
Independent Director.
Questionnaires were added to
an online survey website, which
ensured the anonymous and
efficient collection of answers.
The results were made available
to MSP, under an agreed
Non-Disclosure Agreement.
MSP met with each member of the
Board to conduct a structured
interview on the effectiveness of
the Board. It also met with selected
members of the senior
management team.
MSP also attended a Board
meeting as an observer.
NCC Group plc 99
Governance
Board composition and division of responsibilities
Outcomes
Areas identified in
previous evaluations Outcome
Board composition
•
Board agendas
•
•
•
•
•
•
Board behaviours
•
•
Strategy
•
•
•
•
Performance
monitoring
•
Succession planning
•
•
Stakeholder
management
•
•
Information flows
•
•
•
•
•
Risk management
•
Committees
•
NCC Group plc 100
Operation of governance framework
Role of the Board
•
•
•
•
•
•
•
•
•
Risk management
Internal control
Executive remuneration
NCC Group plc 101
Governance
Shareholder engagement
Share capital structure
Board engagement with shareholders
Board shareholder updates
Investor meetings
One-to-one meetings
66
Group meetings
Substantial shareholdings
Directors’ shareholdings
Annual General Meeting
Chris Stone
Non-Executive Chair
NCC Group plc 102
2022/23 key activities
•
Assessed the quality of earnings by reviewing one-off,
out of period or non-trading items arising over the year
considering the background of a challenging year
•
Continued focus on the adherence to the Individually
Significant Items accounting policy
•
to ensure there is a clear description and explanation,
reconciliation, presentation and consistency applied
•
Critical review and discussion with our external auditor
on the assumptions and models used within the Group
annual impairment review and resultant disclosures
considering the background of a challenging second half
performance, a new strategy and managements future
action plans
•
Consideration of going concern and viability assessment
and disclosures considering the background of a
challenging year and a new strategy
•
Monitoring integration of IPM business including
associated risks, controls and costs of integration and
then ensuring that existing Group controls have been
implemented within the newly acquired business
•
•
reviewing and approving the Group’s response
•
Considered a change to the year end (deciding not to at
2023/24 priorities
•
Review of the risk management and control environment of
any significant strategic or operational projects and the
resulting changes in the business
•
Monitoring the project risk management of key new
initiatives, ensuring that satisfactory internal controls are
embedded from the outset
Audit Committee report
•
Reviewing and monitoring controls
•
Ensuring continued improvement of the effectiveness of the
Group’s risk management and internal control systems
•
Planning for regulatory changes arising from the new
corporate governance reform requirements, including
ensuring that we review and consider all UK governance
changes following the establishment of Audit Reporting
•
and embedding sustainability into the business
•
Undertaking a thorough and comprehensive independent
auditor tender process, leading to the reappointment of
KPMG, or the on-boarding of a new auditor
•
Monitoring implementation of the recently implemented
I am pleased to present the Audit Committee Report for the
year ended 31 May 2023 to explain how we have discharged
our responsibilities with an overview of our principal activities
and their outcomes.
Committee membership, attendees’ access
and objectives
The Audit Committee had a change of Chair during the year.
I am a Chartered Accountant with diverse sector experience
across listed companies, private equity and financial services
in a number of disciplines including risk management, internal
control and financial reporting. I am also currently Chair of the
Audit and Risk Committees at Caledonia Investments plc, Domino’s
Pizza Group plc and Enfinium Group, all of which provide me with
an additional external perspective to bring to my chairing of this
Committee. The Board therefore considers that I have the recent
and relevant financial experience required by the Code.
Lynn Fordham
Committee Chair
Governance
103NCC Group plc — Annual report and accounts for the year ended 31 May 2023
Committee membership, attendees’ access and objectives
Principal duties delegated to the Audit Committee
Areas delegated to
the Audit Committee Committee responsibilities Activities during the year
Financial reporting
•
•
•
•
•
•
Narrative reporting
•
•
•
•
•
•
Internal controls
and risk
management
systems
•
•
•
•
Compliance,
whistleblowing
and fraud
•
•
Internal audit
•
•
External audit
•
•
•
•
•
•
•
Audit Committee report
NCC Group plc 104
Report and Accounts to 31 May 2022
•
•
•
Meeting frequency and attendance
33
44
44
43
Significant accounting areas and areas of significant
management judgement or estimation uncertainty
Significant issues considered during the year
in relation to the Financial Statements
•
•
•
•
•
•
•
•
•
•
•
NCC Group plc 105
Governance
Goodwill carrying value
Fair value less costs to sell
The Group’s approach to materiality
Internal audit
Audit Committee report
NCC Group plc 106
Internal audit
Internal controls and risk management
Controls relating to financial reporting and preparation
of the Annual Report and Accounts
•
•
•
•
Other controls
•
•
•
•
•
•
•
•
•
•
•
Whistleblowing and confidential reporting procedures
Review of the Audit Committee’s effectiveness
Auditor’s independence and objectivity
NCC Group plc 107
Governance
Auditor’s independence and objectivity
External auditor’s effectiveness and appointment
•
•
•
•
•
•
•
•
•
•
•
•
•
Audit Committee report
NCC Group plc 108
Fair, balanced and understandable
1. Financial information
•
•
•
2. Narrative disclosures
•
•
•
3. Independent reviewers
•
•
4. Audit Committee Chair
•
•
1
Financial
information
3
Independent
reviewers
2
Narrative
disclosures
4
Audit
Committee
Chair
Related party transactions and other fees approved
by the Committee
Fair, balanced and understandable
•
•
•
Lynn Fordham
Chair, Audit Committee
NCC Group plc 109
Governance
2022/23 highlights
•
Significant improvement in diversity in the Executive
Committee and the Board
•
Continued focus on building strength in our senior
leadership team to support succession planning, senior
management and Executive Director succession plans
•
Relentless focus on diversity and inclusion in every
meeting, including undertaking unconscious bias training
•
Scoped and planned the launch of gathering of diversity
•
have launched two surveys in the year which have been
challenged and reviewed by the Committee
2023/24 priorities
•
Continue to build and develop diverse senior cyber
leadership across the Group
•
Embed and encourage the data collection, analysis and
actionable insights coming from the diversity data launch
in Workday
•
to create insight and action planning
•
Shift the culture to create growth across the Group by
responding to colleague needs in this post-pandemic
hybrid world, and the needs of our clients by creating the
right working environment to support colleague engagement
Nomination Committee report
The members of the Nomination Committee are Chris Batterham,
The Nomination Committee’s objectives
and responsibilities
The Nomination Committee is responsible for reviewing the
size, structure, balance, composition and progressive refreshing
of the Board and its Committees and as such its duties include:
•
Reviewing the structure of the Board
•
Evaluating the balance of skills, knowledge, experience
and diversity on the Board
•
Making recommendations for further recruitment to the Board
or proposing changes to the existing structure of the Board,
or individual Directors
•
Reviewing the leadership needs of the Company,
both Executive and Non-Executive
•
Succession planning for Directors and other senior
Executives within the business
•
Recruiting, appointing and exiting of Directors
•
Overseeing membership of, and succession to, the various
Board Committees
•
Reviewing the time commitment required from the
Non-Executive Directors on NCC Group business
The Chair of the Board leads the process for the appointment
of new Non-Executive Directors to the Board and for the
appointment of the Chief Executive Officer. The Chief Executive
Officer, in conjunction with the Chair, leads the process for the
the process for a new Chair of the Board.
In relation to an appointment to the Board, the Committee draws
up a specification and assesses the capabilities and experience
required for such a role, taking into account the Board’s existing
composition, including relevant experience and understanding
of our stakeholder groups.
Our objective is to have a broad
range of skills, backgrounds,
experiences and personal
attributes within the Board as this
ensures the Board is best placed
to serve the Company.”
Chris Stone
Committee Chair
110 NCC Group plc — Annual report and accounts for the year ended 31 May 2023
Diversity
Committee meetings
5
5
4
5
5
5
5
5
4
4
Activities during the year
During the year, the Committee:
•
•
•
•
•
•
•
•
•
Presentations and updates during the year
•
•
NCC Group plc 111
Governance
Presentations and updates during the year
•
•
•
•
•
•
•
•
•
Processes
•
•
•
•
•
Culture
•
•
•
•
Colleague voice
•
•
Long term
•
•
•
•
Committee effectiveness
•
•
•
External search consultancies
Chris Stone
Chair, Nomination Committee
Nomination Committee report
NCC Group plc 112
2022/23 highlights
•
•
Ongoing alignment to the NIST Cybersecurity
opportunities for improvement. This is mapped
to our existing ISO 27001 certification
•
Implementation of a “three lines of defence” model for
information security, increasing oversight and
independence of risk management
2023/24 priorities
•
Reviewing structure of data protection and governance
team in light of attrition and bringing all support back in house
•
Greater global alignment in terms of policies and
procedures, and consolidation of our ISO 27001
accreditation under a single certificate
•
Group-wide alignment for risk management and
consistent reporting of risk to the Board
•
Migration of our in-house security monitoring to our new
service, leveraging the latest technology
•
New regulatory requirements are emerging for NCC
Group, such as NIS in the UK and NIS2/DORA in the EU.
We are starting our compliance efforts early, and working
directly with governments and regulators to ensure
successful compliance ahead of introduction
Cyber Security Committee report
The Cyber Security Committee was formed to focus specifically
on the cyber risks faced by the Group. This reflects the significant
threat posed by cyber risks, the nature of our business, and the
potential damage to the business as a high value target for
malicious acts. The Committee’s activities aim to challenge and
support improvements to the Group’s information security and
data protection policies, defences and controls, so as to comply
with global data protection regulations around the world, and
ensure that the Group looks after its own information, and the
information that its customers entrust to it, with the proper care
and attention.
The Committee was formed in November 2016 and I have been
Chair since July 2022.
Chris Batterham and Jennifer Duvalier (both independent
welcome new experience and perspective with her strong
financial and risk background and is a strong addition to the
a member of the Committee.
The Group’s Director of Global Governance, the Group’s Chief
invitees of the Committee. The Executive Directors are invited
to attend Committee meetings when the Committee considers
it to be appropriate.
Julie Chakraverty
Committee Chair
Governance
113NCC Group plc — Annual report and accounts for the year ended 31 May 2023
The Cyber Security Committee’s objectives
and responsibilities
•
•
•
•
•
•
•
•
•
•
•
•
Committee effectiveness
Committee activities during the year
•
•
•
•
•
Committee meetings
4
4
2
4
4
4
4
4
3
3
Julie Chakraverty
Chair, Cyber Security Committee
Cyber Security Committee report
NCC Group plc 114
2022/23 highlights
•
Continuing to embed the Remuneration Policy for
•
Making further grants under the Restricted Share Plan
for below-Board colleagues, to further broaden colleague
share ownership
•
colleague share ownership at all levels
•
2023/24 priorities
•
Remuneration Policy and consult as appropriate with our
major shareholders, before seeking shareholder approval
at the 2024 AGM
•
Continue to ensure our incentive arrangements support
the Group’s revised long-term growth strategy
•
Reviewing the all colleague and discretionary share plans
that the Group wishes to offer
•
Continue to review when the appropriate time is to
introduce ESG measures into incentive arrangements
Remuneration Committee report
On behalf of your Board, I am pleased to present our Directors’
The report is divided into three sections: this Annual Committee
and the previously approved Directors’ Remuneration Policy.
At the AGM in November 2022, 92.68% of shareholders voted
in favour of the Directors’ Remuneration Report, and I would
like to thank shareholders for their continuing support.
Annual Statement
2022/23 was another busy year for the Remuneration
Committee and we had five meetings in total. The Committee
as Chair. Our Board Chair, Chris Stone, also attended all the
meetings. We invited our remuneration consultants, Chief
we always ensure that we have time without Executives present.
Corporate Governance Code remuneration
requirements for engagement with shareholders
and colleagues
The Committee closely monitors shareholder guidance and
feedback on remuneration. Shareholder voting on AGM
remuneration resolutions is reviewed annually, shareholders
are consulted when changes to policy are being considered,
and major shareholders have the opportunity to provide annual
feedback to the Board and Remuneration Committee on NCC
Group’s remuneration approach at annual engagement meetings.
Jennifer Duvalier
Governance
115NCC Group plc — Annual report and accounts for the year ended 31 May 2023
Corporate Governance Code remuneration
requirements for engagement with shareholders
and colleagues
Base salaries
Joining terms for CEO and leaver terms for former CEO
Remuneration Committee report
NCC Group plc 116
Performance related pay – annual bonus
•
Strategic objectives within the Assurance business:
•
Strategic objective for the Software Resilience business:
•
Sustainability and people objectives:
NCC Group plc 117
Governance
Non-Executive Director and Chair’s fees
Details of these fees and allowances are given in the Annual Report
on Remuneration on page 119
Grants of shares under a below-Board Restricted
Share Plan to broaden colleague share ownership
Conclusion
•
•
•
Jennifer Duvalier
Chair, Remuneration Committee
Remuneration Committee report
NCC Group plc 118
Annual Report on Remuneration
How the Remuneration Policy has been implemented in the year ended 31 May 2023
•
•
•
31 May 2023 163 – – – 163 – – – – 163
31 May 2023 449 1 16 – 466 39 – 500 539 1,005
31 May 2023 24 1 1 – 26 – – – – 26
31 May 2023 333 13 15 – 361 21 35 – 56 417
31 May 2023 70 – – – 70 – – – – 70
31 May 2023 78 – – – 78 – – – – 78
31 May 2023 67 – – – 67 – – – – 67
31 May 2023 46 – – – 46 – – – – 46
31 May 2023 56 – – – 56 – – – – 56
31 May 2023 1,286 15 32 – 1,333 60 35 500 595 1,928
NCC Group plc 119
Governance
Additional information in respect of the single total figure of remuneration
Pension and benefits
Annual bonus
2022/23 annual bonus (audited)
Financial targets – up to 75% of the bonus
7.5% 5.0%
Bonus opportunity for FY22/23 £625,000* £415,800
Total bonus for FY22/23 £39,063* £20,790
Amount paid in cash £25,391 £13,513
Amount deferred in shares £13,672 £7,277
Remuneration Committee report
NCC Group plc 120
Additional information in respect of the single total figure of remuneration
Annual bonus
Financial targets – up to 75% of the bonus
Strategic targets – up to 25% of the bonus
maximum total bonus)
31 May 2023
Weighting Outcome
CEO targets
5.0% 0.0%
5.0% 0.0%
5.0% 0.0%
5.0% 5.0%
2.5% 1.25%
2.5% 1.25%
CEO outcome 25.0% 7.5%
CFO targets
5.0% 0.0%
5.0% 0.0%
5.0% 0.0%
5.0% 0.75%
2.5% 2.5%
2.5% 1.75%
CFO outcome 25.0% 5.0%
NCC Group plc 121
Governance
•
•
•
•
•
•
Remuneration Committee report
NCC Group plc 122
Special Replacement Award
•
•
•
•
•
•
•
SAYE options granted in the year
Payments to past Directors
Summary of maximum LTIP awards outstanding
Total LTIP
options
held at
31 May
2023
1
436,408
473,849
NCC Group plc 123
Governance
31 May
2023
31 May
2023
31 May
2023
31 May
2023
31 May
2023
31 May
2023
31 May
2023
162,843 – – – – – 162,843
–
436,408 14,269 – – 222,222 672,899
– – – – – – –
147,197 440,956 14,269 66,921 28,764 – 698,107
55,000 – – – – – 55,000
20,249 – – – – – 20,249
19,115 – – – – – 19,115
50,000 – – – – – 50,000
25,000 – – – – 25,000
•
•
•
•
•
•
•
•
Shareholding requirements
Remuneration Committee report
NCC Group plc 124
Shareholding
as at
31 May
2023
0%
72%
Appointment terms for new Directors
•
•
•
•
•
Annual bonus
Deferred annual bonus awards
•
•
Post-employment shareholding requirements
Other
NCC Group plc 125
Governance
Relative importance of the spend on pay
31 May
2023
£m
236.9
14.5
Percentage increase in the remuneration of the Directors
2022/23 2022/23 2022/23
3% — — — — — —
— — — — — — — — —
— —
8% —
— — — — — —
— — 225% — — — — — —
2% — — — — — —
— — — — — — — — —
2% — — — — — —
7.9% — — —
Chief Executive pay compared to pay of UK colleagues
Total pay ratio
Remuneration Committee report
NCC Group plc 126
Chief Executive pay compared to pay of UK colleagues
CEO pay ratio
Performance graph and table
400
350
300
250
200
150
100
50
0
2014 20152013 2016 2017
Year ended 31 May
2018 2019 2020 2021 2022 2023
£100
£164
£198
£273
£166
£208
£169
£166
£232
£315
£101
NCC Group plc
NCC Group plc 127
Governance
Performance graph and table
Membership and attendance
5
5
4
5
5
5
4
4
Adviser to the Committee
Remuneration Committee report
NCC Group plc 128
Service contracts and letters of appointment
Executive
Non-Executive
Dilution
How will the Remuneration Policy be implemented in the year ending 31 May 2024?
Executive Directors’ base salaries
Base salary
at 31 May
2023
£000
Base salary
at 1 June
1
£000 % change
500 500 0%
333 333 0%
n/a
1
n/a
Pension
Non-Executive Directors’ fees
FY23/24
£154,500
£51,500
£10,000
£11,000
£11,000
£8,000
£11,000
NCC Group plc 129
Governance
Annual bonus
Metric Weight
Statement of shareholder voting
Jennifer Duvalier
Chair, Remuneration Committee
Remuneration Committee report
NCC Group plc 130
Overall approach to remuneration
•
•
•
•
Area of provision 40 of the 2018 UK Corporate Governance Code How fulfilled
Clarity
Simplicity
Risk
Predictability
Proportionality
Alignment to culture
NCC Group plc 131
Governance
Current Policy table for Executive Directors
Purpose and link to
short and long-term
strategic objectives Operation (including framework to assess performance) Maximum opportunity
Changes since
last Directors’
Remuneration
Policy
Salary
Benefits
Pension
Annual bonus
Remuneration Committee report
NCC Group plc 132
Purpose and link to
short and long-term
strategic objectives Operation (including framework to assess performance) Maximum opportunity
Changes since
last Directors’
Remuneration
Policy
Long Term Incentive Plan
Executive Director shareholding requirement
Choice of performance measures and target setting
Current Policy table for Executive Directors
NCC Group plc 133
Governance
Differences in Remuneration Policy for colleagues and Executive Directors
•
•
•
Non-Executive Director Policy table
Purpose and link to
short and long-term
strategic objectives Operation (including framework to assess performance) Maximum opportunity
Changes since
last Directors’
Remuneration
Policy
Fees
Remuneration Committee report
NCC Group plc 134
Approach to recruitment
Pay element Approach Areas of flexibility
Salary
Benefits
and
pension
Pay element Approach Areas of flexibility
Incentive
opportunity
“Buyout” awards
Transitional
arrangements
for internal
appointments
to the Board
Approach to service contracts and letters of appointment
Policy on payment for loss of office
NCC Group plc 135
Governance
Policy on payment for loss of office
Pay element Approach Areas of flexibility
Annual bonus
•
•
•
Long Term
Incentive Plan
All-colleague share
schemes
Illustration of remuneration scenarios
Chief Executive Officer
3,000
2,500
2,000
1,500
1,000
500
0
100%
100%
54%
62%
32%
29%
14%
26%
36%
22%
30%
31%
32%
25%
28%
43%
32%
53%
42%
Minimum MinimumTarget TargetMaximum MaximumMaximum +
50% share
price
growth
Maximum +
50% share
price
growth
£524
£324
£967
£519
9%
£2,024
£924
£1,074
Annual bonus
£000
£2,461
Remuneration Committee report
NCC Group plc 136
Illustration of remuneration scenarios
•
Minimum.
•
Target.
•
Maximum.
•
Effect of a 50% increase in share price.
Statement of consideration of employment conditions elsewhere in the Group
How shareholder views are taken into account
Key areas of discretion in the Remuneration Policy
•
•
•
•
•
•
•
•
•
•
Legacy arrangements
External directorships for Executive Directors
NCC Group plc 137
Governance
Principal activities
Going concern
Directors’ report
NCC Group plc 138
Going concern
Results and dividends
Post-balance sheet events
Share capital and control
Authority to purchase own shares
Directors
NCC Group plc 139
Governance
Directors’ and Officers’ insurance and indemnities
Colleagues
Business relationships with suppliers,
customers and others
Equal opportunities
Disabled persons
Political donations
Sustainability Report
Overseas branches
Research and development
Change of control
Disclosure of information to the auditor
Reappointment of auditor
Directors’ report
NCC Group plc 140
Annual General Meeting
Capitalised interest
Reporting requirements
Mike Maddison Guy Ellis
NCC Group plc 141
Governance
Directors’ responsibilities statement
Statement of Directors’ responsibilities in respect
of the Annual Report and the Financial Statements
•
•
•
•
•
Responsibility statement of the Directors in respect
of the Annual Report
•
•
Mike Maddison Guy Ellis
NCC Group plc 142
In this section
144 Independent auditor’s report
152 Consolidated income statement
152 Consolidated statement of comprehensive income/(loss)
153 Consolidated balance sheet
154 Consolidated cash flow statement
156 Consolidated statement of changes in equity
157 Company balance sheet
158 Company cash flow statement
159 Company statement of changes in equity
160 Notes to the Financial Statements
Additional information
215 Glossary of terms – other terms
217 Other information
218 Financial calendar
Financial
statements
NCC Group plc 143
Financial statements
Independent auditor’s report
1 Our opinion is unmodified
•
•
•
•
Basis for opinion
Materiality
Coverage
Key audit matters vs 2022
Recurring risks
NCC Group plc 144
2 Key audit matters: our assessment of risks of material misstatement
The risk Our response
Recoverability of carrying
amounts of the North America
Cyber Security and Europe
Cyber Security cash
generating units (‘CGUs’)
Subjective estimate
•
Historical comparison:
•
Benchmarking assumptions:
•
Our sector experience:
•
Our valuation expertise:
•
Assessment of experts:
•
Valuation comparison:
•
Sensitivity analysis:
•
Assessing transparency:
Our results
Financial statements
NCC Group plc 145
Independent auditor’s report
The risk Our response
Revenue recognition
2023/2024 sales
Tests of detail:
•
•
•
Assessing Transparency:
Our results
Recoverability of Parent
Company’s investments
in subsidiaries
Low risk, high value
•
Tests of detail:
•
Comparing valuations:
•
Comparing valuations:
Our results
2 Key audit matters: our assessment of risks of material misstatement
NCC Group plc 146
Group materiality
Normalised Group profit
before tax
£1.0m
£0.65m
£0.7m
£0.05m
Total profits and losses
that made up Group loss
before tax
Group revenue
94%
86
88
Group total assets
85%
79
96%
96
95
78
0
1
4
5
6
7
3 Our application of materiality and an overview of
the scope of our audit
Financial statements
NCC Group plc 147
Independent auditor’s report
3 Our application of materiality and an overview of
the scope of our audit
4 The impact of climate change on our audit
5 Going concern
•
•
•
•
NCC Group plc 148
5 Going concern
•
•
•
•
•
•
•
•
6 Fraud and breaches of laws and regulations –
ability to detect
•
•
•
•
•
•
Financial statements
NCC Group plc 149
Independent auditor’s report
6 Fraud and breaches of laws and regulations –
ability to detect
Identifying and responding to risks of material misstatement
related to compliance with laws and regulations
Context of the ability of the audit to detect fraud or breaches
of law or regulation
7 We have nothing to report on the other information
in the Annual Report
Strategic report and directors’ report
•
•
•
Directors’ remuneration report
Disclosures of emerging and principal risks and
longer-term viability
•
•
•
NCC Group plc 150
7 We have nothing to report on the other information
in the Annual Report
Disclosures of emerging and principal risks and
longer-term viability
Corporate governance disclosures
•
•
•
8 We have nothing to report on the other matters
on which we are required to report by exception
•
•
•
•
9 Respective responsibilities
Directors’ responsibilities
Auditor’s responsibilities
10 The purpose of our audit work and to whom we owe
our responsibilities
for and on behalf of KPMG LLP, Statutory Auditor
Chartered Accountants
1 St. Peter’s Square
Manchester
M2 3AE
United Kingdom
Financial statements
NCC Group plc 151
Consolidated income statement
for the year ended 31 May 2023
Notes
2023
£m
2022
£m
Revenue 4 335. 1 314 .8
Cost of sales 4 (2 0 3 .1 ) (182 .2 )
Gross profit 4 132. 0 132. 6
Administrative expenses
Individually Significant Items 5 (14. 7 ) (0.9 )
Depreciation and amortisation 6 (22.6 ) (19 .7 )
Credit gains/(losses) recognised on financial assets 6 1.5 (0.6 )
(Impairment)/reversal of impairment of non-current assets 6 (1 .1 ) 0 .1
Other administrative expenses (93. 2 ) (76.8 )
Total administrative expenses
(13 0 .1 ) (97 .9 )
Operating profit 4 1.9 34.7
Finance costs 8 (6. 2 ) (3 . 7 )
(Loss)/profit before taxation 6 (4. 3 ) 31.0
Taxation 9 (0.3 ) (8.0 )
(Loss)/profit for the year attributable to owners of the Company (4. 6 ) 23. 0
Earnings per ordinary share 11
Basic EPS (1.5 )p 7. 4 p
Diluted EPS (1.5 )p 7. 4 p
Consolidated statement of comprehensive (loss)/income
for the year ended 31 May 2023
2023
£m
2022
£m
(Loss)/profit for the year attributable to the owners of the Company (4. 6 ) 23. 0
Other comprehensive income/(loss)
Items that may be reclassified subsequently to profit or loss (net of tax)
Cash flow hedges – effective portion of changes in fair value — (0 .1 )
Foreign exchange translation differences 2.4 14. 8
Total other comprehensive income 2.4 14. 7
Total comprehensive (loss)/income for the year (net of tax) attributable to the owners of the Company (2. 2 ) 3 7 . 7
The accompanying Notes 1 to 37 are an integral part of these consolidated Financial Statements.
NCC Group plc — Annual report and accounts for the year ended 31 May 2023152
Consolidated balance sheet
at 31 May 2023
Notes
31 May 2023
£m
31 May 2022
£m
Non-current assets
Goodwill 12 255.8 26 6 .1
Intangible assets 12 110.9 11 8. 6
Property, plant and equipment 13 12 .5 12. 9
Right-of-use assets 14 18.6 22.0
Investments 15 0.3 0.3
Deferred tax asset 18 2.9 1.4
Total non-current assets 40 1.0 42 1. 3
Current assets
Inventories 16 0.8 0.9
Trade and other receivables 17 58. 1 7 7. 7
Contingent consideration receivable 34 3.8 —
Derivative financial instruments 25 — 0.2
Current tax receivable 3.6 3 .1
Cash and cash equivalents 24 3 4 .1 73.2
Total current assets 100. 4 1 5 5 .1
Total assets 5 01.4 57 6.4
Current liabilities
Trade and other payables 19 44.7 48.3
Bank overdraft 24 1.8 —
Borrowings 24 — 18.5
Lease liabilities 20 6.0 5.4
Current tax payable 4 .2 7. 4
Derivative financial instruments 25 0.6 —
Contingent consideration payable 35 1.0 1. 9
Provisions 21 1.2 2.7
Contract liabilities – deferred revenue 22 51.6 61.7
Total current liabilities 111.1 145 .9
Non-current liabilities
Borrowings 24 81.9 1 0 7. 1
Lease liabilities 20 24.0 2 7. 2
Deferred tax liabilities 18 1.4 1.6
Provisions 21 1.5 0. 8
Contract liabilities – deferred revenue 22 3.3 0.6
Total non-current liabilities 1 1 2 .1 1 3 7. 3
Total liabilities 223. 2 28 3. 2
Net assets 278.2 293.2
Equity
Share capital 27 3 .1 3 .1
Share premium 27 2 2 4 .1 224 . 0
Merger reserve 27 42 .3 42. 3
Currency translation reserve 27 3 7. 5 3 5 .1
Retained earnings 27 (28.8 ) (11 .3 )
Total equity attributable to equity holders of the Parent 278.2 293.2
The accompanying Notes 1 to 37 are an integral part of these consolidated Financial Statements.
These Financial Statements were approved and authorised for issue by the Board of Directors on 28 September 2023. They were
signed on its behalf by:
Mike Maddison Guy Ellis
Chief Executive Officer Chief Financial Officer
28 September 2023 28 September 2023
Financial statements
NCC Group plc — Annual report and accounts for the year ended 31 May 2023 153
Consolidated cash flow statement
for the year ended 31 May 2023
Notes
2023
£m
2022
£m
Cash flows from operating activities
(Loss)/profit for the year (4. 6 ) 23. 0
Adjustments for:
D
epreciation of property, plant and equipment 13 4.5 3.9
Depreciation of right-of-use assets 14 5.7 5.4
S
hare-based payments 26 2 .2 3.9
Cash settled share-based payments — (0 .5 )
A
mortisation of customer contracts and relationships 12 10.0 8.6
Amortisation of software and development costs 12 2 .4 1. 8
I
mpairment of goodwill 12 12 .8 —
Impairment of software costs 12 0.6 —
I
mpairment/(reversal of impairment) of right-of-use-assets 14 0.5 (0 .1 )
Lease financing costs 8 1 .1 1.2
O
ther financing costs 8 5 .1 2.5
Foreign exchange loss/(gain) 6 0.6 (0.6 )
A
cquisition of business – transaction costs 5 — (7. 3 )
Disposal of business – transaction costs 34 (0 .1 ) —
I
SIs (non-cash impact) 5 3. 5 —
Profit on disposal of right-of-use assets 6 (0.7 ) —
P
rofit on disposal of business (DDI) 34 (4 . 7 ) —
Research and development UK tax credits (0. 5 ) (1.0 )
R
esearch and development US tax credits (1. 4 ) (1 .1 )
Income tax expense 1.7 9 .1
(D
ecrease)/increase in provisions 21 (0.8 ) 0.5
Cash inflow for the year before changes in working capital 3 7. 9 49.3
Decrease/(increase) in trade and other receivables 19.7 (1. 8 )
Decrease in inventories 0 .1 0. 2
(Decrease)/increase in trade and other payables (1 5 .1 ) 12.6
Cash generated from operating activities before interest and taxation 42 .6 60.3
Interest element of lease payments 20 (1 .1 ) (1. 2 )
Other interest paid (4. 0 ) (2 .1 )
Taxation paid (5.4 ) (2. 2 )
Net cash generated from operating activities 3 2 .1 54.8
Cash flows from investing activities
Acquisition of trade and assets as part of business combinations 35 (1. 0 ) (153 .0 )
Purchase of property, plant and equipment (3 .9 ) (5 .2 )
Software and development expenditure (3. 4 ) (3. 0 )
Sale proceeds of business disposal (DDI) 2.0 —
Net cash used in investing activities (6. 3 ) (16 1. 2 )
Cash flows from financing activities
Proceeds from the issue of ordinary share capital 27 0.1 0.8
Purchase of own shares (0. 5 ) —
Principal element of lease payments 20 (6 .1 ) (5 .3 )
Drawdown of borrowings (net of deferred issue costs) 70.8 120.7
Issue costs related to borrowings (1 .5 ) (0.6 )
Repayment of borrowings (115. 6 ) (3 9. 4 )
Equity dividends paid 10 (14. 5 ) (14 .4 )
Net cash (used in)/generated from financing activities
(6 7. 3 ) 61.8
Net decrease in cash and cash equivalents (41 .5 ) (44 .6 )
Cash and cash equivalents at beginning of period 73 .2 116 .5
Effect of foreign currency exchange rate changes 0.6 1.3
Cash and cash equivalents at end of year 24 32. 3 73 .2
NCC Group plc — Annual report and accounts for the year ended 31 May 2023154
Consolidated cash flow statement continued
for the year ended 31 May 2023
Reconciliation of net change in cash and cash equivalents to movement in net debt
1
Notes
2023
£m
2022
£m
Net decrease in cash and cash equivalents (41 .5 ) (4 4 .6 )
Change in net debt
1
resulting from cash flows (net of deferred issue costs) 44.8 (8 1. 3 )
Interest incurred on borrowings 4.0 2.1
Interest paid on borrowings (4. 0 ) (2 .1 )
Release of deferred issue costs (1. 0 ) (0. 4 )
Issue costs related to borrowings (non-cash) 1.7 0.6
Effect of foreign currency on cash flows 0.6 1.3
Foreign currency translation differences on borrowings (1. 8 ) (11. 3 )
Change in net cash/(debt)
1
during the year 2.8 (135. 7 )
Net (debt)/cash at start of year excluding lease liabilities
1
(52 . 4 ) 83.3
Net debt at end of year excluding lease liabilities
1
(4 9.6 ) (52. 4 )
Lease liabilities 20 (30.0 ) (32 . 6 )
Net debt
1
at end of year (79.6 ) (85 .0 )
The accompanying Notes 1 to 37 are an integral part of these consolidated Financial Statements.
1 Revenue growth at constant currency, Adjusted EBITDA, Adjusted operating profit, Adjusted EPS, cash conversion, net debt and net debt excluding lease
liabilities are APMs and not IFRS measures. See Note 3 for an explanation of APMs and adjusting items.
Financial statements
NCC Group plc — Annual report and accounts for the year ended 31 May 2023 155
Consolidated statement of changes in equity
for the year ended 31 May 2023
Notes
Share
capital
£m
Share
premium
£m
Hedging
reserve
£m
Merger
reserve
£m
Currency
translation
reserve
£m
Retained
earnings
£m
Total
£m
Balance at 1 June 2021 3 .1 223 .2 (0. 8 ) 42. 3 20.3 (21.9 ) 266 .2
Profit for the year — — — — — 23.0 23 .0
Other comprehensive expense for the year — — (0 .1 ) — — — (0 .1 )
Foreign currency translation differences — — — — 14 .8 — 14. 8
Total comprehensive (expense)/income
for the year — — (0 .1 ) — 14 . 8 23.0 3 7. 7
Transactions with owners recorded directly
in equity
Dividends to equity shareholders 10 — — — — — (14 .4 ) (14. 4 )
Transfer hedging reserve to retained earnings — — 0.9 — — (0.9 ) —
Share-based payments 26 — — — — — 3.2 3.2
Tax on share-based payments 9 — — — — — (0.3 ) (0. 3 )
Shares issued 27 — 0.8 — — — — 0. 8
Total contributions by and distributions
to owners — 0.8 0.9 — — (12 .4 ) (10.7 )
Balance at 31 May 2022 3. 1 224.0 — 42.3 35.1 (11. 3 ) 293.2
Loss for the year — — — — — (4 . 6 ) (4.6 )
Foreign currency translation differences — — — — 2 .4 — 2.4
Total comprehensive income/(loss) for the year — — — — 2.4 (4 .6 ) (2. 2 )
Transactions with owners recorded directly
in equity
Dividends to equity shareholders 10 — — — — — (14 .5 ) (14 .5 )
Share-based payments 26 — — — — — 2.2 2.2
Tax on share-based payments 9 — — — — — (0 .1 ) (0 .1 )
Purchase of own shares — — — — — (0.5 ) (0.5 )
Shares issued 27 — 0 .1 — — — — 0 .1
Total contributions by and distributions
to owners — 0 .1 — — — (12 .9 ) (12 . 8 )
Balance at 31 May 2023 3 .1 2 2 4 .1 — 42.3 3 7. 5 (28.8 ) 278. 2
The accompanying Notes 1 to 37 are an integral part of these consolidated Financial Statements.
NCC Group plc — Annual report and accounts for the year ended 31 May 2023156
Company balance sheet
at 31 May 2023
Company no: 4627044
Notes
2023
£m
2022
£m
Non-current assets
Investments in subsidiary undertakings 33 279.1 276.9
Trade and other receivables 17 23.2 32.9
Total non-current assets 302.3 309.8
Current assets
Cash and cash equivalents 24 15.0 20.2
Total current assets 15.0 20.2
Total assets 317.3 330.0
Current liabilities
Trade and other payables 19 0.2 18.2
Total current liabilities 0.2 18.2
Total liabilities 0.2 18.2
Net assets 317.1 311.8
Equity
Share capital 27 3.1 3.1
Share premium 27 224.1 224.0
Merger reserve 27 42.3 42.3
Retained earnings 27 47.6 42.4
Total equity 317.1 311.8
The accompanying Notes 1 to 37 are an integral part of these Financial Statements.
These Financial Statements were approved and authorised for issue by the Board of Directors on 28 September 2023. They were
signed on its behalf by:
Mike Maddison Guy Ellis
Chief Executive Officer Chief Financial Officer
28 September 2023 28 September 2023
Financial statements
NCC Group plc — Annual report and accounts for the year ended 31 May 2023 157
Company cash flow statement
for the year ended 31 May 2023
Notes
2023
£m
2022
£m
Cash flows from operating activities
Profit for the year 28 17.5 20.0
Cash inflow for the year before changes in working capital 17.5 20.0
Decrease in trade and other receivables 9.7 8.5
(Decrease)/increase in trade and other payables (18.0) 4.7
Net cash generated from operating activities 9.2 33.2
Cash flows from financing activities
Proceeds from the issue of ordinary share capital 27 0.1 0.8
Equity dividends paid 10 (14.5) (14.4)
Net cash used in financing activities (14.4) (13.6)
Net (decrease)/increase in cash and cash equivalents (5.2) 19.6
Cash and cash equivalents at beginning of year 20.2 0.6
Cash and cash equivalents at end of year 15.0 20.2
The accompanying Notes 1 to 37 are an integral part of these Financial Statements.
NCC Group plc — Annual report and accounts for the year ended 31 May 2023158
Company statement of changes in equity
for the year ended 31 May 2023
Notes
Share
capital
£m
Share
premium
£m
Merger
reserve
£m
Retained
earnings
£m
Total
£m
Balance at 31 May 2021 and 1 June 2021 3.1 223.2 42.3 32.9 301.5
Profit for the year — — — 20.0 20.0
Total comprehensive income for the year — — — 20.0 20.0
Transactions with owners recorded directly in equity
Dividends to equity shareholders 10 — — — (14.4) (14.4)
Increase in subsidiary investment for share-based charges — — — 3.9 3.9
Shares issued 27 — 0.8 — — 0.8
Total contributions by and distributions to owners — 0.8 — (10.5) (9.7)
Balance at 31 May 2022 3.1 224.0 42.3 42.4 311.8
Profit for the year — — — 17.5 17.5
Total comprehensive income for the year — — — 17.5 17.5
Transactions with owners recorded directly in equity
Dividends to equity shareholders 10 — — — (14.5) (14.5)
Increase in subsidiary investment for share-based charges — — — 2.2 2.2
Shares issued 27 — 0.1 — — 0.1
Total contributions by and distributions to owners — 0.1 — (12.3) (12.2)
Balance at 31 May 2023 3.1 224.1 42.3 47.6 317.1
The accompanying Notes 1 to 37 are an integral part of these Financial Statements.
Financial statements
NCC Group plc — Annual report and accounts for the year ended 31 May 2023 159
NCC Group plc — Annual report and accounts for the year ended 31 May 2023160
1 Accounting policies continued
Financial statements
NCC Group plc — Annual report and accounts for the year ended 31 May 2023 161
1 Accounting policies continued
Going concern continued
NCC Group plc — Annual report and accounts for the year ended 31 May 2023162
Notes to the Financial Statements continued
at 31 May 2023
1 Accounting policies continued
Financial statements
NCC Group plc — Annual report and accounts for the year ended 31 May 2023 163
1 Accounting policies continued
NCC Group plc — Annual report and accounts for the year ended 31 May 2023164
Notes to the Financial Statements continued
at 31 May 2023
1 Accounting policies continued
Financial statements
NCC Group plc — Annual report and accounts for the year ended 31 May 2023 165
1 Accounting policies continued
NCC Group plc — Annual report and accounts for the year ended 31 May 2023166
Notes to the Financial Statements continued
at 31 May 2023
1 Accounting policies continued
Revenue recognition continued
Financial statements
NCC Group plc — Annual report and accounts for the year ended 31 May 2023 167
1 Accounting policies continued
Revenue recognition continued
Detailed policies continued
NCC Group plc — Annual report and accounts for the year ended 31 May 2023168
Notes to the Financial Statements continued
at 31 May 2023
1 Accounting policies continued
Revenue recognition continued
Detailed policies continued
Financial statements
NCC Group plc — Annual report and accounts for the year ended 31 May 2023 169
1 Accounting policies continued
Revenue recognition continued
Detailed policies continued
NCC Group plc — Annual report and accounts for the year ended 31 May 2023170
Notes to the Financial Statements continued
at 31 May 2023
Financial statements
NCC Group plc — Annual report and accounts for the year ended 31 May 2023 171
1 Accounting policies continued
Cash flow hedges continued
NCC Group plc — Annual report and accounts for the year ended 31 May 2023172
Notes to the Financial Statements continued
at 31 May 2023
1 Accounting policies continued
Financial statements
NCC Group plc — Annual report and accounts for the year ended 31 May 2023 173
2 Critical accounting judgements and key sources of estimation uncertainty continued
2.2 Key sources of estimation uncertainty continued
NCC Group plc — Annual report and accounts for the year ended 31 May 2023174
Notes to the Financial Statements continued
at 31 May 2023
3 Alternative Performance Measures (APMs) and adjusting items continued
Financial statements
NCC Group plc — Annual report and accounts for the year ended 31 May 2023 175
3 Alternative Performance Measures (APMs) and adjusting items continued
NCC Group plc — Annual report and accounts for the year ended 31 May 2023176
Notes to the Financial Statements continued
at 31 May 2023
3 Alternative Performance Measures (APMs) and adjusting items continued
Financial statements
NCC Group plc — Annual report and accounts for the year ended 31 May 2023 177
3 Alternative Performance Measures (APMs) and adjusting items continued
Constant currency revenue continued
2 Formerly Assurance.
NCC Group plc — Annual report and accounts for the year ended 31 May 2023178
Notes to the Financial Statements continued
at 31 May 2023
3 Alternative Performance Measures (APMs) and adjusting items continued
Constant currency revenue continued
Cyber Security
2
continued
2 Formerly Assurance.
Financial statements
NCC Group plc — Annual report and accounts for the year ended 31 May 2023 179
3 Alternative Performance Measures (APMs) and adjusting items continued
Constant currency revenue continued
Software Resilience continued
NCC Group plc — Annual report and accounts for the year ended 31 May 2023180
Notes to the Financial Statements continued
at 31 May 2023
1 Revenue growth at constant currency, Adjusted EBITDA, Adjusted operating profit, Adjusted EPS, cash conversion, net debt and net debt excluding lease
liabilities are APMs and not IFRS measures. See Note 3 for an explanation of APMs and adjusting items.
2 Formerly Assurance.
Financial statements
NCC Group plc — Annual report and accounts for the year ended 31 May 2023 181
4 Segmental information continued
* Restated to present revenue by category to be consistent with amounts reported to management. Revenue of £6.4m has been restated within services
rather than product sales.
2 Formerly Assurance.
NCC Group plc — Annual report and accounts for the year ended 31 May 2023182
Notes to the Financial Statements continued
at 31 May 2023
4 Segmental information continued
2 Formerly Assurance.
Financial statements
NCC Group plc — Annual report and accounts for the year ended 31 May 2023 183
5 Individually Significant Items (ISI) continued
NCC Group plc — Annual report and accounts for the year ended 31 May 2023184
Notes to the Financial Statements continued
at 31 May 2023
Financial statements
NCC Group plc — Annual report and accounts for the year ended 31 May 2023 185
NCC Group plc — Annual report and accounts for the year ended 31 May 2023186
Notes to the Financial Statements continued
at 31 May 2023
Financial statements
NCC Group plc — Annual report and accounts for the year ended 31 May 2023 187
11 Earnings per ordinary share continued
NCC Group plc — Annual report and accounts for the year ended 31 May 2023188
Notes to the Financial Statements continued
at 31 May 2023
12 Goodwill and intangible assets continued
1 Revenue growth at constant currency, Adjusted EBITDA, Adjusted operating profit, Adjusted EPS, cash conversion, net debt and net debt excluding lease
liabilities are APMs and not IFRS measures. See Note 3 for an explanation of APMs and adjusting items.
2 Formerly Assurance.
Financial statements
NCC Group plc — Annual report and accounts for the year ended 31 May 2023 189
12 Goodwill and intangible assets continued
Fair value less costs to sell continued
1 Revenue growth at constant currency, Adjusted EBITDA, Adjusted operating profit, Adjusted EPS, cash conversion, net debt and net debt excluding lease
liabilities are APMs and not IFRS measures. See Note 3 for an explanation of APMs and adjusting items.
2 Formerly Assurance.
3 While holding gross margin percentage at a fixed rate.
4 Sensitivities shown for North America Cyber Security are in addition to the £9.8m impairment recognised in the year ended 31 May 2023.
NCC Group plc — Annual report and accounts for the year ended 31 May 2023190
Notes to the Financial Statements continued
at 31 May 2023
12 Goodwill and intangible assets continued
1 Revenue growth at constant currency, Adjusted EBITDA, Adjusted operating profit, Adjusted EPS, cash conversion, net debt and net debt excluding lease
liabilities are APMs and not IFRS measures. See Note 3 for an explanation of APMs and adjusting items.
2 Formerly Assurance.
Financial statements
NCC Group plc — Annual report and accounts for the year ended 31 May 2023 191
12 Goodwill and intangible assets continued
NCC Group plc — Annual report and accounts for the year ended 31 May 2023192
Notes to the Financial Statements continued
at 31 May 2023
Financial statements
NCC Group plc — Annual report and accounts for the year ended 31 May 2023 193
NCC Group plc — Annual report and accounts for the year ended 31 May 2023194
Notes to the Financial Statements continued
at 31 May 2023
Financial statements
NCC Group plc — Annual report and accounts for the year ended 31 May 2023 195
18 Deferred tax assets and liabilities (Group) continued
NCC Group plc — Annual report and accounts for the year ended 31 May 2023196
Notes to the Financial Statements continued
at 31 May 2023
20 Lease liabilities continued
Financial statements
NCC Group plc — Annual report and accounts for the year ended 31 May 2023 197
NCC Group plc — Annual report and accounts for the year ended 31 May 2023198
Notes to the Financial Statements continued
at 31 May 2023
24 Cash and cash equivalents and borrowings continued
Cash and cash equivalents continued
Financial statements
NCC Group plc — Annual report and accounts for the year ended 31 May 2023 199
25 Financial instruments continued
NCC Group plc — Annual report and accounts for the year ended 31 May 2023200
Notes to the Financial Statements continued
at 31 May 2023
25 Financial instruments continued
Financial statements
NCC Group plc — Annual report and accounts for the year ended 31 May 2023 201
25 Financial instruments continued
NCC Group plc — Annual report and accounts for the year ended 31 May 2023202
Notes to the Financial Statements continued
at 31 May 2023
25 Financial instruments continued
Currency risk continued
Financial statements
NCC Group plc — Annual report and accounts for the year ended 31 May 2023 203
NCC Group plc — Annual report and accounts for the year ended 31 May 2023204
Notes to the Financial Statements continued
at 31 May 2023
26 Share‑based payments continued
Financial statements
NCC Group plc — Annual report and accounts for the year ended 31 May 2023 205
26 Share‑based payments continued
NCC Group plc — Annual report and accounts for the year ended 31 May 2023206
Notes to the Financial Statements continued
at 31 May 2023
26 Share‑based payments continued
Financial statements
NCC Group plc — Annual report and accounts for the year ended 31 May 2023 207
26 Share‑based payments continued
Reconciliation of outstanding share options continued
NCC Group plc — Annual report and accounts for the year ended 31 May 2023208
Notes to the Financial Statements continued
at 31 May 2023
Financial statements
NCC Group plc — Annual report and accounts for the year ended 31 May 2023 209
33 Investments in subsidiary undertakings continued
NCC Group plc — Annual report and accounts for the year ended 31 May 2023210
Notes to the Financial Statements continued
at 31 May 2023
33 Investments in subsidiary undertakings continued
Financial statements
NCC Group plc — Annual report and accounts for the year ended 31 May 2023 211
2 Formerly Assurance.
NCC Group plc — Annual report and accounts for the year ended 31 May 2023212
Notes to the Financial Statements continued
at 31 May 2023
35 Acquisitions continued
Financial statements
NCC Group plc — Annual report and accounts for the year ended 31 May 2023 213
35 Acquisitions continued
Measurement of fair values continued
2 Formerly Assurance.
NCC Group plc — Annual report and accounts for the year ended 31 May 2023214
Notes to the Financial Statements continued
at 31 May 2023
Glossary of terms – other terms
Other terms Definition and usage
Code Guidance, issued by the Financial Reporting Council in 2016 and updated in 2018, on how
companies should be governed, applicable to UK-listed companies including NCC Group plc.
Adjusted Any result described as adjusted excludes the impact of Individually Significant Items, and any
tax on any of these items.
Adjusted earnings Adjusted earnings are defined as statutory earnings before amortisation of acquisition
intangibles, Individually Significant Items and the share-based payments charge, net of the
tax effect of these items.
Adjusted operating profit margin
1
Calculated as Adjusted operating profit divided by revenue from continuing activities.
AGM Annual General Meeting of shareholders of the Company held each year to consider ordinary
and special business as provided in the Notice of AGM.
Alternative Performance Measure
(APM)
An Alternative Performance Measure (which is denoted in each case or use thereof
by a footnote) is a non-GAAP performance metric used by management either internally
or externally to present management’s view of the underlying business performance.
They are not superior to GAAP-based measures and are simply an alternative way of looking
at performance. See Note 3 for further information.
Board The Board of Directors of the Company (for more information see pages 88 and 90).
Cash conversion ratio
1
Calculated as cash generated from operating activities before interest and taxation divided by
Adjusted EBITDA
1
, expressed as a percentage.
CDO Cyber Defence Operations.
CEO Chief Executive Officer.
CFO Chief Financial Officer.
CISO Chief Information Security Officer.
Company, Group, NCC, we, our or us We use these terms, depending on the context, to refer to either NCC Group plc, the individual
Company, or to NCC Group plc and its subsidiaries collectively.
CPO Chief People Officer.
CTO Chief Technology Officer.
Directors, Executive Directors and
Non-Executive Directors
The Directors/Executive Directors and Non-Executive Directors of the Company whose names
are set out on pages 88 and 90 of this report.
EBIT Earnings before interest and tax.
EBIT margin % EBIT margin % is calculated as follows: Adjusted EBIT divided by revenue.
EBITDA Earnings before interest, tax, depreciation and amortisation. Calculated as operating profit
before Individually Significant Items and adding back depreciation and amortisation charged.
EBITDA margin % EBITDA divided by revenue.
EPS Earnings per share. Profit for the year attributable to equity shareholders of the Parent
allocated to each ordinary share.
FCA Financial Conduct Authority.
Financial year For NCC Group this is an accounting year ending on 31 May.
FRC Financial Reporting Council.
Free cash flow Net cash from operating activities less net capital expenditure and acquisition costs.
FRS A UK Financial Reporting Standard as issued by the UK Financial Reporting Council (FRC).
FVLCTS Fair value less costs to sell.
1 Revenue growth at constant currency, Adjusted EBITDA, Adjusted operating profit, Adjusted EPS, cash conversion, net debt and net debt excluding lease
liabilities are APMs and not IFRS measures. See Note 3 for an explanation of APMs and adjusting items.
NCC Group plc — Annual report and accounts for the year ended 31 May 2023 215
Additional information
Other terms Definition and usage
Gross profit Gross profit is revenue less direct costs of sale. It excludes costs considered to be overheads
that are supporting the business as a whole as opposed to a specific revenue item.
Gross margin %/GM % Calculated as gross profit divided by revenue from continuing activities.
HMRC His Majesty’s Revenue & Customs, the tax collecting authority of the UK.
IAS or IFRS An International Accounting Standard or International Financial Reporting Standard, as issued
by the International Accounting Standards Board (IASB). IFRS is also used as the term to
describe international generally accepted accounting principles as a whole.
Individually Significant Items Items that the Directors consider to be material in nature, scale or frequency of occurrence
that need to be excluded when calculating some non-statutory performance measures in
order to allow users of the Financial Statements to gain a full understanding of the underlying
business performance. See Note 5 for further information.
KPMG The Company’s external auditor, KPMG LLP.
LTIP Long Term Incentive Plan established to align the interests of senior and executive
management with those of shareholders. The plan is formally known as the NCC Group Long
Term Incentive Plan 2013 (approved by shareholders in 2013).
MD Managing Director.
MDR Managed Detection and Response.
Net debt
1
Total borrowings offset by cash and cash equivalents.
Ordinary shares Voting shares entitling the holder to part ownership of a company.
SAYE/Sharesave Save As You Earn, being a tax efficient scheme to encourage colleague share ownership.
Software Resilience Software Resilience represents our escrow resilience services.
Subsidiary A company or other entity that is controlled by NCC Group.
TSC Technical Security Consulting.
TSR Total shareholder return, which is share price growth plus dividends reinvested (where
applicable) over a specified period of time, divided by the share price at the start of the period.
1 Revenue growth at constant currency, Adjusted EBITDA, Adjusted operating profit, Adjusted EPS, cash conversion, net debt and net debt excluding lease
liabilities are APMs and not IFRS measures. See Note 3 for an explanation of APMs and adjusting items.
Glossary of terms – other terms continued
NCC Group plc — Annual report and accounts for the year ended 31 May 2023216
Other information
Directors
Chris Stone – Non-Executive Chair
Mike Maddison – Chief Executive Officer
Guy Ellis – Chief Financial Officer
Chris Batterham – Independent Non-Executive Director
Julie Chakraverty – Senior Independent Non-Executive Director
Jennifer Duvalier – Independent Non-Executive Director
Mike Ettling – Independent Non-Executive Director
Lynn Fordham – Independent Non-Executive Director
Company Secretary
Jonathan Williams
Registered Group and Company head office
XYZ Building
2 Hardman Boulevard
Spinningfields
Manchester
M3 3AQ
Registered number
4627044
Registered in England and Wales
Joint brokers and corporate finance advisers
Jefferies International Limited
100 Bishopsgate
London
EC2N 4JL
Peel Hunt LLP
Moor House
120 London Wall
London
EC2Y 5ET
Auditor
KPMG LLP
1 St Peter’s Square
Manchester
M2 3AE
Solicitors
DLA Piper UK LLP
1 St Peter’s Square
Manchester
M2 3DE
Registrar
Equiniti
Aspect House
Spencer Road
Lancing
West Sussex
BN99 6DA
Bankers
HSBC UK Bank plc
2nd Floor
4 Hardman Square
Spinningfields
Manchester
M3 3EB
National Westminster Bank plc
1 Hardman Boulevard
Manchester
M3 3AQ
ING Bank N.V. London Branch
8–10 Moorgate
London
EC2R 6DA
Fifth Third Bank
National Association
38 Fountain Square Plaza
Cincinnati
OH 45263
NCC Group plc — Annual report and accounts for the year ended 31 May 2023 217
Additional information
Financial calendar
Ex-dividend date 9 November 2023
Record date 10 November 2023
AGM 30 November 2023
Dividend payment date 8 December 2023
2024 half year end 30 November 2023
2024 interim statement 1 February 2024
2024 year end 31 May 2024
2024 year end trading pre-close statement June 2024
2024 preliminary year end statement September 2024
These dates are provisional and may be subject to change.
NCC Group plc — Annual report and accounts for the year ended 31 May 2023218
NCC Group plc’s commitment to environmental issues is reflected in
this Annual Report, which has been printed on Magno Satin, an FSC
®
certified material.
This document was printed by Geoff Neal using its environmental print
technology, which minimises the impact of printing on the environment,
with 99% of dry waste diverted from landfill. Both the printer and the
paper mill are registered to ISO 14001.
FSC to be supplied
NCC Group plc Annual report and accounts for the year ended 31 May 2023
NCC Group plc Annual report and accounts for the year ended 31 May 2023