Tesco 2015 Annual Report Download - page 26

Principal risks Risk movement Key controls and mitigating factors
Technology
Any significant failure in the IT processes of
our retail operations in stores, online or in our
supply chain could impact our ability to trade
If we do not invest enough or efficiently
or invest in the wrong areas, we may not
be able to deliver our customer proposition
which could impact our competitiveness
As we develop new technologies, we must
maintain the controls over existing platforms or
it may impact systems availability and security
• Our IT strategy is reviewed and approved by the Executive Committee
• We have governance processes in place around new system implementations and
change management of existing IT, adherence to which is closely monitored
• There is a clear programme of investment to maintain the integrity and efficiency
of our IT infrastructure and its security
• Business continuity plans are in place for key business processes
People
Failure to attract, retain, develop and motivate
the best people with the right capabilities
across all levels, geographies and through
the business transformation process could
limit our ability to succeed
There is a risk that our leaders may not play
their critical role in shaping the organisation
that we want to be and that they do not inspire
great performance from our teams
• The Executive Committee meets regularly to review and monitor people policies
and procedures and talent development
• We seek to understand and respond to employees’ needs by listening to their feedback
from open conversations, social media, colleague surveys and performance reviews
• Talent planning, training and people development processes are embedded across
our Group
• Objectives and remuneration arrangements for senior management are approved
by the Executive Committee and have been re-designed to reward behaviours as well
as delivery of results
Safety, fraud, control and compliance
If we do not implement safety standards
effectively, we may endanger our customers
or colleagues
Given the existing size, geographical scope
and complexity of our Group, the potential
for fraud and dishonest activity by our suppliers,
customers and employees increases
There is a risk that if the compliance
monitoring to our Group standards and
policies is not sufficient, we could fail
to identify weaknesses or breaches
• Standards for Health and Safety are defined for all of our sites, monitoring processes
are in place and we have created a Group team whose primary objective is to ensure
that safety standards are met
• Product safety standards are communicated to our suppliers and tested through audit
programmes
• Procedures and controls are set out across the business to reduce fraud and compliance
risks, including our Group Accounting Policy, key financial controls self-assessment
programme, IT access controls and appropriate segregation of duties. Group Loss
Prevention and Security monitors fraud, bribery and other compliance risks
• Compliance Committees monitor compliance with relevant laws and regulations
• Our Group Code of Conduct has been recently refreshed and re-launched with
appropriate training across the Group. This sets out clear behavioural guidance,
consistent with our Values
• We have comprehensive guidance across the Group to ensure compliance with
the UK Bribery Act (and applicable local legislation) and use an externally managed
Whistleblowing service (Protector Line) to allow colleagues to report any instances
of inappropriate behaviour
• A Fraud Blueprint setting out risks, controls and operational strategies informs
a preventative approach
Tesco Bank
The continually changing regulatory
environment could impact the levels of
capital and liquidity the Bank expects to hold,
could impact the earnings profile as a result
of interchange fee caps, and may affect the
governance of the Bank as the new regulatory
Senior Managers Regime is finalised
• The Bank has a defined ‘Risk Appetite’, approved and regularly reviewed by both the
Bank’s Board and the Tesco PLC Board, which sets out the key risks, their optimum
ranges, alert limits and the controls required to manage them within their approved
tolerance limits
• The Bank has formed good working relationships with the Prudential Regulation
Authority and Financial Conduct Authority
• There is a comprehensive structure of governance and oversight in place, including
through the Bank’s Governance and Conduct Committees, to help ensure the Bank’s
compliance with applicable laws and regulations
• The Group is actively engaged in developing and implementing plans to respond
to interchange fee developments to manage the impact on our profitability
Principal risks and uncertainties continued
24 Tesco PLC Annual Report and Financial Statements 2015