Tesco 2015 Annual Report Download - page 25

Principal risks Risk movement Key controls and mitigating factors
Data security and privacy
Increasing risks of cyber-attack threaten
the security of customer, colleague and
supplier data
We must ensure that we understand the types
of data that we hold and secure it adequately
to manage the risk of data breaches
• We have active monitoring processes to identify and deal with IT security incidents
• A new Cyber Security team has been established to investigate and mitigate
the risks of cyber-attack
• A Group-wide Information Security Blueprint has been rolled out across
our businesses
• There is a programme of compliance monitoring and review being rolled out
with training across our businesses
• A programme to review the use, storage and security of customer data is in progress
Transformation
If the scale of the change across our business
disrupts our focus, there is a risk that we will
not transform the business to where it needs
to be
There is a risk that we underestimate the wider
impacts of the changes that we are making
NEW
• There is Executive sponsorship of the Transformation programme with the creation
of a Transformation Director role
• New Group structures have been designed to simplify our business and clarify accountability
• A new Programme Management Office has been established to manage the
Transformation programme and will be supported by experienced resource from
within the business and externally as required
Competition and markets
If we fail to address the differing challenges of
the budget retailers, the premium retailers and
online entrants, it may adversely impact our
market share and profitability
• We actively seek to be competitive on price, range and service as well as developing
our online and multiple formats to allow us to compete in different markets
• Our Executive Committee and operational units regularly review markets, trading
opportunities and competitor strategy and activity
Performance
If our strategy is not effectively communicated
or implemented, our business may
underperform against plan and competitors
The delivery of long term plans may be
impacted if the business focuses on short
term targets only
• Our Board, Executive Committee and operational units meet regularly to review
performance risks
• All businesses have targets based on a new balanced scorecard of performance against
KPIs and financial targets. Plans are monitored and reviewed regularly by the Executive
Committee and the Board
• An ongoing communication process informs our colleagues about the long term
strategy and ensures that they understand their part in it
• There are clear guidelines and policies set out to ensure that there is an appropriate
focus on balance between short term and longer term delivery
Political and regulatory
In each country in which we operate, we may
be impacted by legal and regulatory changes,
increased scrutiny from competition
authorities and political changes that affect
the retail market
The regulatory landscape is becoming more
restrictive in many markets and may impact
our trading
• We engage with government and regulatory bodies to represent the views of our
customers, colleagues and communities and to manage the impact of political
and regulatory changes
• We aim to contribute to important discussions in public policy wherever we operate
• Country developments are monitored by our local management teams
• Group and country Compliance Committees monitor and guide legal and regulatory
compliance with support from our Group Regulatory Ethics and Compliance team
• The Tesco Bank Executive and Treating Customers Fairly Board oversee Tesco Bank’s
compliance with regulatory requirements
Product
Our business may suffer if we fail to work with
our suppliers to ensure that our products are
designed and delivered to meet a high standard
and to ensure we can trace their provenance
If we do not build mutual and trusting
relationships with our suppliers, this could
impact our range and price proposition
If we do not manage our supply chain, we may
risk not being able to ensure the quality and
security of product supply for customers
• Group and country Compliance Committees have been re-structured to simplify the
identification and monitoring of the risks associated with products, suppliers and operations
• We publish results of internal testing (e.g. provenance tests of content in our food) and
we have in place ethical trading teams working with suppliers
• Appropriate controls are in place around: product development; supplier management,
including the introduction of a new Supplier Feedback forum and an independent Protector
Line and Helpline; distribution standards; third party contract management; and compliance
with regulatory standards
• Clear procedures are operated globally to ensure product integrity and comprehensive
supplier audit programmes are in place to monitor product integrity and labour standards
• A comprehensive compliance programme is in place to promote, monitor and review
compliance with the Groceries Supply Code of Practice in the UK. Appropriate programmes
are in place in other markets
• Sustainability considerations are integrated into our long-term decision making to ensure
that the development of our products is aligned with our goal of reducing our impact on the
environment. We look, in particular, at sustainable sourcing, improved security of supply and
mitigating the impact of climate change
23Tesco PLC Annual Report and Financial Statements 2015
Other informationGovernance Financial statementsStrategic report