NCC Group plc

(the "Company" or the "Group")

Notice of Annual General Meeting 2022

The Company confirms that its Notice of Annual General Meeting 2022 ("AGM Notice") and its Annual Report and Accounts for the year ending 31 May 2022 ("Annual Report") have been posted or otherwise been made available to shareholders and published on the Investor Relations section of its website (www.nccgroup.com/investor-relations). The Annual General Meeting will be held at 1.00pm on Wednesday 2 November 2022 at the Company's Head Office, XYZ Building, 2 Hardman Boulevard, Spinningfields, Manchester, M3 3AQ.

Copies of the Annual Report and the AGM Notice have been submitted to the National Storage Mechanism and will shortly be available for inspection at www.morningstar.co.uk/uk/NSM.

A condensed set of the Company's financial statements and extracts were included in the Company's preliminary results for the year ended 31 May 2022 released on 6 September 2022 (the "Preliminary Announcement"). The information included within the Preliminary Announcement together with the information set out below, which is extracted from the Annual Report, constitute the material required by Disclosure Guidance and Transparency Rule 6.3.5 to be communicated to the media in full unedited text through a Regulatory Information Service. This announcement and the Preliminary Announcement are not a substitute for reading the full Annual Report. Page numbers and cross-references in the extracted information below refer to page numbers and cross-references in the Annual Report. To view the Preliminary Announcement, please visit the Investor Relations section of the Company's website at www.nccgroup.com/investor-relations.

Directors' responsibilities statement

The following statement is extracted from page 133 of the Annual Report and is repeated here for the purposes of Disclosure Guidance and Transparency Rule 6.3.5.  This statement relates solely to the Annual Report and is not connected to the extracted information set out in this announcement or the Preliminary Announcement:

"Statement of Directors' responsibilities in respect of the Annual Report and Accounts and the Financial Statements

The Directors are responsible for preparing the Annual Report and Accounts and the Group and Parent Company Financial Statements in accordance with applicable law and regulations.

Company law requires the Directors to prepare Group and Parent Company Financial Statements for each financial year. Under that law they are required to prepare the Group Financial Statements in accordance with UK-adopted international accounting standards and applicable law and have elected to prepare the Parent Company Financial Statements on the same basis.

Under company law the Directors must not approve the Financial Statements unless they are satisfied that they give a true and fair view of the state of affairs of the Group and Parent Company and of the Group's profit or loss for that period. In preparing each of the Group and Parent Company Financial Statements, the Directors are required to:

·      Select suitable accounting policies and then apply them consistently

·      Make judgements and estimates that are reasonable, relevant and reliable

·      State whether they have been prepared in accordance with UK-adopted international accounting standards

·      Assess the Group and Parent Company's ability to continue as a going concern, disclosing, as applicable, matters related to going concern

·      Use the going concern basis of accounting unless they either intend to liquidate the Group or the Parent Company or to cease operations, or have no realistic alternative but to do so

The Directors are responsible for keeping adequate accounting records that are sufficient to show and explain the Parent Company's transactions and disclose with reasonable accuracy at any time the financial position of the Parent Company and enable them to ensure that its Financial Statements comply with the Companies Act 2006. They are responsible for such internal control as they determine is necessary to enable the preparation of Financial Statements that are free from material misstatement, whether due to fraud or error, and have general responsibility for taking such steps as are reasonably open to them to safeguard the assets of the Group and to prevent and detect fraud and other irregularities.

Under applicable law and regulations, the Directors are also responsible for preparing a Strategic Report, Directors' Report, Directors' Remuneration Report and Corporate Governance Statement that comply with that law and those regulations.

The Directors are responsible for the maintenance and integrity of the corporate and financial information included on the Company's website. Legislation in the UK governing the preparation and dissemination of Financial Statements may differ from legislation in other jurisdictions.

In accordance with Disclosure Guidance and Transparency Rule 4.1.14R, the Financial Statements will form part of the annual financial report prepared using the single electronic reporting format under the TD ESEF Regulation. The Auditor's Report on these Financial Statements provides no assurance over the ESEF format.

Responsibility statement of the Directors in respect of the annual financial report

We confirm that to the best of our knowledge:

·      The Financial Statements, prepared in accordance with the applicable set of accounting standards, give a true and fair view of the assets, liabilities, financial position and profit or loss of the Company and the undertakings included in the consolidation taken as a whole

·      The Strategic Report includes a fair review of the development and performance of the business and the position of the issuer and the undertakings included in the consolidation taken as a whole, together with a description of the principal risks and uncertainties that they face

We consider the Annual Report and Accounts, taken as a whole, is fair, balanced and understandable and provides the information necessary for shareholders to assess the Group's position and performance, business model and strategy."

Principal risks and uncertainties

The principal risks and uncertainties relating to the Company are set out on pages 64 to 71 of the Annual Report from which the following is extracted in full and unedited text:

"Risk management

Risk is an inherent part of doing business and risk management is a fundamental part of good corporate governance. A successful risk management process balances risk and reward and is underpinned by sound judgement of their impact and likelihood. The Board has overall responsibility for ensuring that NCC Group has an effective risk management framework, which is aligned to our business objectives.

The Board has established a Risk Management Policy, which has established protocols, including:

·      Roles and responsibilities for the risk management framework

·      Risk scoring framework

·      A definition of risk appetite

The integrated approach to risk management diagram on page 66 summarises the Group's overall approach to risk management, which is supported by a web-based tool - the Integrated Risk Management System (IRMS). The tool is designed to follow the risk management model described in the next section and records both strategic and operational risk registers and tracks risk mitigation action plans, helping embed ownership of risks and treatment actions while also providing access to live management information, which is used at both a Board and operational management level.

NCC Group's approach to risk management

NCC Group adopts both a "top-down" and "bottom-up" approach to risk, to manage risk exposure across the Group to enable the effective pursuit of strategic objectives. The approach is summarised in the diagram on page 65.

The approach is one of collaboration, which supports our comprehensive approach to risk identification, from the "top down" and "bottom up". The Group believes that this is the most efficient and effective way to identify its business risks.

Top down

The Board, Audit Committee and Cyber Security Committee review risks on an ongoing basis and are supported by the Executive Committee and subject matter specialists (including Software Resilience, Assurance, information security, data protection and health and safety). The Board gives consideration to the Group's strategic objectives and any barriers to their achievement.

Bottom up

The Board and senior leadership team engage with colleagues at every level of the Group in recognition of the importance of their expertise, contribution and views. In relation to matters of wrongdoing, or risks not being recognised and adequately managed, the Group has a robust and effective whistleblowing procedure, which is supported by the Safecall reporting line.

Risk management model

The Board has overall responsibility for ensuring that NCC Group adopts an effective risk management model, which is aligned to our objectives and promotes good risk management practice. We have therefore adopted the model described in this section and summarised in the diagram above.

The Board, Audit Committee, Cyber Security Committee and Executive Management team review risks on an ongoing basis throughout the year. The appropriateness and relevance of the risks and issues tracking system - IRMS - are monitored by the global governance team to ensure that it continues to be updated, meets the needs of the Group and remains in line with good risk management practice. In addition, there is a robust process in place for monitoring and reporting the implementation of agreed actions.

We are satisfied that the Risk Management Policy, framework and model currently in place are sufficient to manage risk across the Group.

The key areas of identifying, assessing, addressing and monitoring risks are explained in more detail below:

Identify

Risks exist within all areas of our business and it is important for us to identify and understand the degree to which their impact and likelihood of occurrence will affect the delivery of our key objectives. This is achieved through day-to-day working practices and incorporates risks in both the internal and external environment. Examples of identification include horizon scanning for legislative and market changes, operational and delivery reviews (such as SGT), procedures in relation to projects and change and independent systems audits.

All identified risks are initially assessed for their "inherent" risk (risk with no controls in place), using a scoring mechanism that accounts for the likelihood of an event occurring and the impact that it may have on the Group. The scoring mechanism adopted takes account of high impact, low likelihood events and these risks are managed in a timely manner.

In addition to ongoing risk identification, an annual exercise is undertaken to review the Group's strategic risk universe by the Board. This exercise is reliant on the "top-down", "bottom-up" approach discussed earlier.

Assess

Post identification of the Group's inherent risk exposure, a comprehensive assessment of the effectiveness of current mitigating controls is undertaken. This exercise takes account of the design of the current control environment and the application of these controls prior to assessing the Group's current exposure to risk - mitigated risk score. The Board uses a number of sources of information to support the scoring of risk and these include, but are not limited to:

·      Management updates

·      Action tracking and reporting

·      Control environment policies and procedures

·      Independent audit activity

·      Project monitoring reports

Address

Having identified and assessed the risks faced by the Group, the risks are scored according to likelihood of occurring and impact to the business should they occur. The risks are then mapped according to their rating onto a risk heat map, which reflects the Group's overall risk appetite set by the Board. The Group's Risk Management Policy then provides guidance on the expected level of response to those risks, depending on where they sit on the risk heat map. The heat map shows the four bandings in the different shades of risks as set out below as well as expected actions and responses to risks in these areas:

·      Green - within appetite. Ongoing monitoring in place

·      Amber - out of appetite. Some actions are required to treat the risk to bring this within acceptable levels

·      Purple - significantly out of appetite. High combination of residual probability and impact. Management actions required, with some urgency, to treat the risk, reducing this to acceptable levels

·      Grey/black - risks that are deemed to have such an impact that they could theoretically impact the ability of the business to continue in existence. If any, they would need consideration in assessing in the Directors' Viability Statement

An assessment of whether additional actions are required to reduce our risk exposure is undertaken, with actions falling into the one of four categories:

·      Treat - develop an action plan (applying responsibility, deadlines and prioritisation) that may include the implementation of additional controls, or increase the requirement for additional assurance over the adequacy and effectiveness of the existing controls

·      Transfer - use a third party specialist to undertake the activity, thus mitigating the risk

·      Tolerate - determine the risk is within appetite

·      Terminate - exit the activity

Output from the evaluation of strategic risks has resulted in milestone plans owned by senior business leaders, or has been used in the development of the Group's transformation programme.

Monitor

Ongoing monitoring of risks and related actions is key to the implementation of our risk management model and, therefore, NCC Group is committed to making enterprise-wide risk management part of business as usual. Examples of ongoing monitoring of business risks include, but are not limited to:

·      Annual review of the external audit strategy and plan by the Audit Committee and Chief Financial Officer to ensure inclusion of key financial risks

·      Annual review of the annual internal audit plan to validate that it incorporates key areas of business risk

·      A review of internal audit reports issued during the period, including a summary of progress against previously raised management actions at each Audit Committee

·      Annual review of the strategic risk register by the Enterprise Risk Management Steering Group and Board to ensure that it includes risks arising in year

Internal control

While risk management identifies threats to the Group achieving its strategic objectives, internal controls are designed to provide assurance that these objectives are being achieved, such as the effectiveness and efficiency of operations and delivery, accurate and reliable financial reporting, and compliance with applicable laws and regulation.

NCC Group has established a robust internal control framework, which is made up of a number of components:

Control environment

The control environment has primarily been established taking account of the Group's values (working together; being brilliantly creative; embracing difference; and taking responsibility), and its Code of Ethics, which sets the foundations for the expected behaviours, values and competencies for all colleagues across the Group. The Board, Executive Committee and extended leadership team lead by example and strive to maintain effective control environments, while also maintaining integrity and transparency.

Risk assessments

Risk assessments are conducted at both a strategic and operational level of the Group and support the Group in understanding the risks that it faces and the controls in place to mitigate them. Importantly, they provide a mechanism to identify operational improvements and are vital in our transformational programmes.

Policies and procedures

Established policies communicate expected behaviours and these are supported through procedures and guidelines defining required processes and controls. This in turn supports the business to adopt efficient and effective control environments.

Information and communication

Access to accurate and timely data is key in supporting our colleagues to make decisions and to be well informed in order to conduct, manage and control their areas of responsibility. During the year, the Group has embedded its data systems following the rollout of the Workday systems.

Activity monitoring

The minimum financial controls framework was established in FY20. Further enhancement of the framework will be designed and implemented in FY23 and beyond, to align with the Brydon Review and related whitepaper issued by the Department for Business, Energy and Industrial Strategy in March 2021.

Financial accounting and reporting follow generally accepted accounting practices.

Group review and approval procedures exist in relation to major areas of risk and require Executive Committee/Board approval, including mergers and acquisitions, major contracts, capital expenditure, litigation, treasury management and taxation policies.

Compliance with all legislation, current and new, is closely monitored.

Risk and control reporting structure

During the current financial year, NCC Group has continued to focus on embedding the "three lines of defence" to provide a robust internal controls structure that will support the Board, Audit Committee, Cyber Committee, Executive Committee, and extended leadership team with accurate and reliable information in relation the systems of internal control.

Three lines of defence:

·      First line - Group policies and procedures

·      Second line - Global governance function, incorporating health and safety; information security; data protection; risk and regulatory compliance; standards and support; and legal

·      Third line - independent challenge and assessment, including ISO certification and internal and external audit

Principal risks and uncertainties

The Group continues to operate in a particularly dynamic and evolving marketplace. The current risk register has been developed to reflect those factors and includes those risks that would threaten its business model, future performance, solvency or liquidity. Detailed descriptions of the current principal risks and uncertainties faced by the Group, their potential impact and mitigating processes and controls are set out below. A risk related to climate change (10b) has been added for FY22 and reflects the importance being placed on the risks and opportunities in relation to climate change and related regulation on the financial performance of NCC Group. The principal risks and uncertainties are categorised into three categories, strategic, operational and environmental, social and governance (ESG), that represent risks relating to the Group's business strategy, various operational risks of managing the business and various ESG/climate change risks.

The heat map provides a pictorial representation of the Group's risks and their direction of travel.

Changes to principal risks and uncertainties during FY22

Having completed the acquisition and transition of IPM into the Group, we have removed this risk from the risk register.

We have added a sub-risk to environmental, social and governance - climate change - to reflect the new regulatory requirements of TCFD. While this is not deemed to be a material risk, we believe that it should be included to reflect its importance in setting our sustainability agenda and strategy.

Extraordinary risk during the year

During the year, the global pandemic of Covid-19 continued on a lesser scale than in FY21.

We have continued to successfully negotiate with our clients where appropriate to work remotely, which has minimised disruption to service delivery."

LEI - 213800DJCGZRB6523934

Classification - Annual Report and Financial Statements and Notice of AGM.