Balfour Beatty Regulatory News (BBY)

DESCRIPTION AND IMPACT

CAUSES

MITIGATION

1. Health and safety

The Group works on significant, complex and potentially hazardous projects which require continuous monitoring and management of health and safety risks.

What impact it might have

Failure to manage these risks gives the potential for significant harm, including fatal or life-changing injuries to employees, subcontractor staff or members of the public, as well as criminal prosecutions, significant fines, debarring from contract bidding and reputational damage.

For more information please see 'Health, safety and wellbeing' on pages 40 and 41.

Some common themes which could drive health and safety risks are recognised and communicated, including:

· risk identification/assessment;

· lack of competence;

· processes that fail to deliver risk elimination or mitigation;

· failure in safety leadership;

· ineffective management of subcontractors;

· failure to cascade and follow procedures including within joint ventures; and/or

· ongoing transformation programme and performance pressures, affecting the ability of people to remain focused on health and safety risks.

Balfour Beatty has in place an overarching Key Strategy comprising policies and procedures (Zero Harm) to minimise such risks. This strategy and its action plans are reviewed and monitored by management and external verification bodies.

Each business has experienced health and safety professionals in place who provide advice and support and undertake regular reviews.

The Safety and Sustainability Committee of the Board, as well as business-level Health and Safety executive leadership teams, meet regularly throughout the year to capture lessons learned and develop a consistent approach to health and safety best practice.

Training programmes (including behavioural) are in place.

Owner

Safety and Sustainability Committee

Risk movement

No movement

The well-established controls and mitigations in place throughout the Group represent a stable control environment. Multiple failures within this environment are required for the risk to be realised.

2. Work winning

Failure to adequately identify, resource, price, and execute the appropriate volume and quality of bids and investment opportunities to maintain a profitable, sustainable order book and deliver value to stakeholders.

What impact it might have

Failure to estimate accurately the risks, costs versus scope, time to complete, impact of inflation and exchange rates, and failure to understand specification changes, contractual terms and how best to manage them could cause financial losses.

If any of the assumptions behind bid strategy development and investment decisions prove incorrect, there is the potential for the business not to win the required work to sustain and grow shareholder value.

Failure to effectively engage with customers may limit access to targeted markets in the future.

Inaccuracy at Gateway reviews in:

· assumptions behind investment decisions;

· costs versus scope and time calculations;

· bid strategy development;

· assessment of the impact of inflation and exchange rates;

· technical and written proposal development;

· Quick Qualifier assumptions;

· proposed customer engagement strategy;

· contract/account management;

· negotiation of terms and conditions; and/or

· assessment of customers' liquidity/creditworthiness.

The Group Tender and Investment Committee process is in place to challenge all proposals.

Defined delegated authority levels are in place for approving all tenders and infrastructure investments.

Consistent and shared policies and minimum commercial expectations including acceptable margins.

A wide and ongoing range of work winning initiatives (including Cash is our Compass, High Value Selling and the Win Business Leadership community of practice) are in place across Group to drive increased commercial and customer awareness and further embed an understanding of expectations on margins and cost.

Commercial/contractual reviews are conducted by key commercial and legal staff.

Reviews are conducted following all tenders to ensure lessons are learned, captured and applied to future tenders.

Investment appraisals are performed and reviewed by experienced professionals. The Group analyses the risks associated with revenues and costs and, where appropriate, establishes contractual and other risk mitigations.

Owner

Group Tender and Investment Committee

Risk movement

No movement

Current controls continue to mitigate the likelihood of occurrence by preventing the Group from bidding for unsustainable work and also limit any potential exposure.

3. Project delivery

Failure to deliver projects at the required specification on time and on budget to meet the expectations of customers and minimise the risk of delay related damages and defect liabilities.

What impact it might have

Failure to manage or deliver against contracted customer requirements on time, on budget and to the required quality could result in issues such as contract disputes, rejected claims, design issues, liquidated damages, cost overruns and failure to achieve anticipated customer savings which in turn could reduce the Group's profitability and damage its reputation.

The Group may also be exposed to long-term obligations including litigation and costs to rectify defective or unsafe work.

Delivery failure on a high-profile project could result in significant reputational damage, debarring from future work and significant associated costs of rectification or dispute resolution.

Failure to implement, maintain and challenge operational and commercial controls (as detailed within checklists at Gateway reviews) allowing:

· unrealistic programming targets;

· inadequate resource (people, plant and materials);

· inadequate understanding of contract obligations;

· unrealistic progress assessments and cost to complete judgements which could arise due to poor training, lack of supervision, lack of accountability or fear of reporting bad news;

· overly-optimistic claim recovery assumptions;

· incomplete visibility and appreciation of scale of commercial judgements; and/or

· failings in administering the contract terms to safeguard or protect future claims, change orders and extensions of time (EOTs).

Customer intervention and additional pressure to complete a project may also contribute to realisation of this risk.

A continued focus on identifying and reporting risks, including planning, programme accuracy of cost and cash forecasting and resource reviews.

Early engagement of integrated work winning and project delivery teams across the Gateway processes to ensure expectations are understood and realistic.

Deployment and ongoing monitoring of strong commercial management and contract administration processes.

Optimal scheduling of key staff within project delivery teams and senior management, together with ongoing and focused training of staff via the Balfour Beatty Academy.

Site Mobilisation Hub in place to facilitate early and effective start-up on site.

Use of innovative and cost-effective engineering and technical solutions (including the vision for 25% offsite fabrication by 2025).

Drive for defect-free delivery including digitisation of project management data is being embedded at all levels.

Professional indemnity cover in place to provide further financial safeguards.

Balfour Beatty monitors the performance of subcontractors and suppliers throughout the lifecycle of a project.

Owner

Group management

Risk movement

No movement

Consistent application of the Group's reporting systems and diligent use of its short interval control processes across all stages of project delivery continues to provide greater certainty of operational outcomes.

4. Joint ventures

Failure of joint ventures (JVs) to deliver expected returns and minimise the risk of unexpected liabilities.

What impact it might have

A failure to execute a significant JV contract could result in a significant impact to profitability and reputational harm in the marketplace.

The failure of a JV partner may expose the Group to increased resourcing costs and ongoing warranty and insurance risks.

Disputes with strategic JV partners could impact the Group's ability to operate successfully and/or expand within its chosen markets.

Failure to share and embed the Group's health and safety management expectations could result in increased potential for injury and or fatality.

The risk could be realised through:

· ineffective assessment of potential partners including liquidity, capacity and capability;

· lack of clarity of the delegated levels of authority between partners;

· delayed and fettered decision‑making process between partners;

· segregation of management systems (financial and operational);

· lack of understanding of contract requirements and expectations; and/or

· failure to embed Balfour Beatty cultures and practices.

The Group Tender and Investment Committee process is in place to challenge all proposals.

The Group's first assumption is to deliver projects as a single entity rather than part of a JV.

The Gateway review process provides governance around the JV partner selection process. All proposals to enter into a JV must be authorised by Group management via the Agreement to Enter into a JV.

Within the Gateway review process significant due diligence on potential JV partners is undertaken closely aligned to Circles of Risk to highlight risks including those related to capacity, capability, previous experience with the Group and liquidity.

Experienced Project Directors are appointed to manage the JV including an ongoing assessment of operational delivery risk.

Balfour Beatty monitors the performance of its JV partners throughout the lifecycle of a project.

Best practice including joint reporting systems where possible is shared between all partners to embed the Group's expectations and culture throughout JV delivery teams.

Owner

Group Tender and Investment Committee

Risk movement

No movement

This risk represents an amplification of the work winning and project delivery risks. The process for entering JVs has improved but ongoing exposure continues.

5. Data protection

The Group suffers a serious breach of applicable data protection law.

What impact it might have

Crystallisation of this risk has the potential for:

· legal and regulatory proceedings, investigations or disputes;

· operational impact (disruption to business as usual);

· costs and losses, fines and penalties;

· reputational harm and potential debarment; and

· data subject rights process failure.

For more information please see 'Business integrity' on pages 46 and 47

If the Group deploys or is subjected to:

· ineffective training/lack of competency;

· third-party error;

· malicious act (internal/external);

· lack of awareness;

· human error; and/or

· lack of corporate accountability.

HR Data Protection Coordinators and Data Privacy Champions are embedded throughout the business to ensure breaches are reported promptly and risks are appropriately escalated to the Group Data Protection Officer (GDPO) for consideration and assessment.

Senior Information Risk Owner appointed as Executive Committee representative for data protection.

All employees are trained in and must comply with data protection and information security management obligations.

Implementation of standardised systems and appropriate policies, procedures and standard templates driving a culture of privacy across the organisation.

Owner

Group management

Risk movement

No movement

The risk is not considered to have moved throughout the year with the likelihood of a significant breach considered to be low.

6. Cybercrime

A failure to protect key Company data or other confidential information.

What impact it might have

Realisation of this risk could result in:

· reputational harm (loss of market and customer confidence);

· potential fines and prosecution;

· loss of intellectual property and competitive advantage; and

· operational impact (disruption to business as usual).

Some common themes which could drive risk realisation include several internal and external factors such as:

Internal factors:

· poor governance;

· failure to embed preventative; culture; and/or

· operational failure.

External factors:

· ransomware;

· inconsistent approach to data security with joint venture / external partners;

· increased use of cloud services without equivalent investment in modern threat prevention; and/or

· cyber attack.

The risk is controlled through four main channels:

Technology:

· network and endpoint protection;

· encryption;

· patching; and

· data back-up.

People:

· awareness training across all users; and

· employee vetting.

Process:

· data governance framework regularly reviewed;

· policies and certifications; and

· incident management feedback (embed lessons learned).

Partners and supply chain:

· vendor risk management assessments; and

· positive relationships with external security authorities.

Owner

Group management

Risk movement

Decreased

This risk has decreased as a result of improvements in controls including installation of anti-phishing software and dedicated risk management resource.

7. People

Inability to provide the required levels of skilled and competent staff to meet the Group's objectives.

What impact it might have

Failure to recruit and retain appropriately skilled people could harm the Group's ability to win or perform specific contracts, manage delivery costs, grow its business and meet its strategic objectives including its future order book.

A high level of staff turnover or low employee engagement could result in a reduction in confidence in the business within the market, stakeholder confidence being lost and an inability to drive business improvements.

For more information please see'Our people' on pages 42 to 45

A failure to effectively mitigate the Group's people risks may arise through:

· ineffective workload and location scheduling;

· increased competitor/sector strength and opportunities;

· inability to recruit and retain strong performers;

· failure to maintain a culture of pride and advocacy across the workforce;

· ineffective and or unfocused project and risk management training;

· lack of a diverse workforce; and/or

· restrictions in the availability of skilled labour.

Providing a positive working environment to support the development of its employees has been central to the Build to Last Transformation programme. Specific activities which mitigate this risk include:

· competency frameworks within core job families identify and support the development of key knowledge, skills and expertise;

· recruitment and retention rates are measured and regularly reviewed across all parts of the business and succession plans are in place for core disciplines;

· regular reviews of remuneration and incentive arrangements to ensure they are appropriate to help the Group attract, motivate and retain key employees;

· Group-wide employee engagement surveys are undertaken to measure engagement and appropriate actions are developed and communicated;

· the Balfour Beatty Academy has been established in the UK to provide professional development and knowledge sharing opportunities and to ensure employees feel valued and specialisms are recognised;

· strong employee communication channels are in place celebrating individual, business and Group-level successes;

· affinity networks have been established to create a diverse and inclusive working environment;

· emerging talent is supported via a range of graduate, apprenticeship, trainee and industrial placement/internship schemes including The 5% Club (see page 45);

· a focus on strategic workforce planning to prevent resource conflicts; and

· work winning and project delivery aligned to internal and external recruitment activities.

Owner

The Board

Risk movement

No movement

Through the Build to Last transformation programme, Balfour Beatty has created a culture with strong people policies and processes which continue to mitigate this risk. The Group will monitor the impact that any delays to strategic projects has on the availability of skilled resource.

8. Sustaining the transformation programme

The Group does not, or is perceived to not, sustain and build upon the good practice, policies and procedures and culture of the Build to Last transformation programme.

What impact it might have

Inconsistency in working practices could drive inefficiencies including increased costs and operational errors resulting in reputational harm and the Group's ability to deliver sustained profit being jeopardised.

For more information please see'Our strategy: Build to Last' on pages8 and 9

Failure to deliver and or demonstrate sustained momentum could arise from:

· ineffective communication and reinforcement of message;

· operational error within a high-profile project;

· inadequate resourcing (financial, physical assets and people);

· complacency and localised adaptations within core disciplines; and/or

· new systems and processes being used without appropriate controls being in place and/or tested.

Ensuring Build to Last continues to deliver and demonstrate value is a strategic priority for the Group and is being led by the Group Chief Executive.

Controls include:

· continuing to reinforce the Build to Last culture and framework within each business unit;

· a dedicated Communications and Investor Relations function to manage internal and external messaging;

· senior leadership engagement across the businesses is clear and frequent;

· new systems and processes are aligned to the Build to Last principles and deployed with training plans and in agreed phases;

· all agreed processes are held on the BMS and are frequently validated;

· employee surveys form a key part of the programme;

· leaders throughout the business frequently monitor and measure the delivery and impacts of the programme including through the outputs of the business improvement community; and

· senior leadership is well experienced in delivering business transformation successfully.

Owner

The Board

Risk movement

Increased

Realisation of this risk is possible and potential reputational impacts increase as the Group undertakes higher profile projects. Ongoing Executive level leadership will ensure controls remain effective in reinforcing the required cultures and working practices.

9. Financial strength

Inability of the Group to maintain the financial strength required to operate its business and deliver its objectives.

What impact it might have

Failure to protect and effectively deliver the required financial strength will mean the Group:

· fails to meet financial covenant tests, as set out in its financing facility agreements, that would lead to an event of default if not remedied within a specific grace period;

· fails to pass the required tests that allow it to continue to use the going concern basis of accounting in preparing its financial statements;

· loses the confidence of its chosen markets; and/or

· loses the ability to compete for key long-term contracts that are critical to the delivery of its long-term objectives and viability.

Failure to manage financial risks, including forecasting material exposures, and the financial resources of the Group that underpin its ability to:

· meet ongoing liquidity obligations so that it remains a going concern; and/or

· meet financial covenants as set out in financing facility agreements.

The Group now operates within a low financial risk environment with half its gross debt repaid in recent years.

The Group operates with a centralised treasury function that is responsible for managing key financial risks, cash resources and the availability of liquidity and credit capacity.

The Group maintains significant undrawn term committed bank facilities with a banking group of high credit quality to underpin the liquidity requirements of the Group.

The Group maintains significant bank and surety bonding facilities to deliver trade finance requirements of the Group on an ongoing basis.

The Group operates standardised reporting, forecasting and budgeting financial processes. This allows monitoring of the impact of business decisions on financial performance over future time horizons.

Sales across the asset portfolio can be used to generate cash.

Owner

The Board

Risk movement

No movement

Throughout 2019 the controls within Finance and Treasury functions have demonstrated a clear ability to manage existing and anticipated risk including completion of the Group's refinancing of its core term committed bank facility.

10. Supply chain

Supply chain partners are not able to meet the Group's operational expectations and requirements including capacity, competency, quality, financial stability, safety, environmental, social and ethical.

What impact it might have

Failure of a subcontractor or supplier would result in the Group becoming involved in disputes, having to find a replacement or undertaking the task itself. This could result in delays, business disruption, additional costs or a reduction in quality/increased defects owing to lack of expertise.

Mistreatment of suppliers, subcontractors and their staff, or poor ethical standards in the supply chain, could lead to legal proceedings, investigations or disputes resulting in business disruption, losses, fines and penalties, reputational damage and debarment.

Crystallisation of capacity, competency and stability risks to the Group's supply chain may arise through:

· lack of capacity in a buoyant market;

· failure to retain subcontractors in buoyant markets;

· over-reliance on a limited number of suppliers or a failure of key supplier relationships;

· failure to embed the Group's expectations within the procurement process;

· inadequate assessment of supply chain partner capabilities and process (including liquidity, quality, safety, ethics, materials stewardship, child labour, forced labour and modern slavery);

· failure to accurately assess project resource requirements and key deliverables; and/or

· unethical treatment of the supply chain.

The Group aims to develop long-term relationships with key subcontractors, working closely with them to understand their operations and dependencies. This includes relationship mapping with strategic suppliers, lessons learned from previous projects together and briefing on order book requirements.

The risk management framework and the Gateway review process allow for early (Gates 1-4) and ongoing (Gate 6) assessment of the appropriateness of resource allocation and dependencies.

Constructionline accreditation in place as pre-qualification tool for core suppliers (validated in Gates 1-3).

Contingency plans in place to address subcontractor failure, including replacement supplier list.

My Contribution programme generates ideas for more effective procurement and resourcing.

The Group obtains project retentions, bondsand/or letters of credit from subcontractors, where appropriate to mitigate the impact of any insolvency.

Suppliers and subcontractors reviewed for third-party suitability compliance via PAS 91 Assessment (Industry Standard).

Group-wide Code of Conduct and Supplier Code of Conduct, targeted training programmes and related policies and procedures in place.

Owner

Group management

Risk movement

No movement

The Group continues to be diligent in its assessment of its supply chain and has greatly reduced its number of active suppliers to improve oversight in operational delivery.

11. Business conduct/compliance

The Group operates in various markets that present business conduct related risks involving fraud, bribery or corruption, whether by its own staff or via third parties such as agents, partners or subcontractors. Those risks are higher in some countries and sectors. Overall, the construction industry has a higher risk profile than other industries.

What impact it might have

Failure by the Group, or employees and third parties acting on its behalf or in partnership, to observe the highest standards of integrity and conduct could result in legal proceedings (including prosecution under the UK Bribery Act), investigations or disputes resulting in business disruption, losses, fines and penalties, reputational damage and debarment.

For more information please see 'Business integrity' on pages 46 and 47

Failure to embed the Code of Conduct and Balfour Beatty values could leave the Group exposed to:

· instances of bribery and corruption;

· fraud, deception, false claims or false accounting;

· unfair competition practices;

· human rights abuses, such as child and other labour standards generally, illegal workers, human trafficking and modern slavery;

· unethical treatment of and by the supply chain; and/or

· ethics and values being compromised as a result of commercial pressures.

A Group-wide Code of Conduct and Supplier Code of Conduct, and related policies, procedures and training are in place, promoted, monitored and assessed by the Business Integrity function.

The function provides business integrity reports to the Board biannually and has its full support. Each business unit, supported by the Business Integrity function, is responsible for embedding the Code of Conduct and the correct values and behaviours within its operations.

The Group has a range of operational controls (commercial including procurement, due diligence and risk assessment) that are designed to identify and manage risks internally and with third parties.

An independent third-party whistleblowing helpline and dedicated email contact are in place and actively promoted. All in-scope complaints are independently investigated by the Business Integrity function and appropriate action is taken, where necessary.

Balfour Beatty works with a limited number of agents, all of whom are, in addition to the Group's due diligence and approval process, subject to specific contractual clauses, policies and agreements.

Owner

The Board

Risk movement

No movement

The Business Integrity function continues to actively promote the required behaviours and learning tools to comprehensively support the Group's conduct and compliance objectives.

12. Legal and regulatory

The Group does not adopt and implement all relevant legal, tax and regulatory requirements.

What impact it might have

The Group could face legal proceedings, investigations or disputes resulting in business disruption, losses, fines and penalties, reputational damage and exclusion from bidding.

Such action could also impact upon the valuation of assets within the affected territory.

A failure to recognise or adapt to potential impacts arising from changes in applicable laws affecting the Group's businesses may result from:

· lack of awareness of the changes made;

· ineffective communication of the requirements across relevant business units; and/or

· a deliberate breach.

The Group monitors and responds to tax, legal and regulatory developments and requirements in the territories in which it operates.

Changes in the law and the requirements of them are clearly cascaded to all affected businesses.

Local legal and regulatory frameworks are considered as part of any decision to conduct business in a new territory.

Appropriate and responsive policies, procedures, training and risk management processes are in place throughout the business.

Owner

The Board

Risk movement

Decreased

Unforeseen exposure to legal and regulatory change is considered extremely unlikely and the controls embedded across the Group are considered to have reduced the exposure further.

13. Legacy pension liabilities

The Group is exposed to and must effectively manage significant defined benefit pension risks.

What impact it might have

Failure to manage these risks adequately could lead to the Group being exposed to significant additional liabilities due to increased pension deficits.

This has the potential to affect the ongoing sustainability of the Group.

The Group is unable to ensure that the trustees of the pension funds react effectively to or manage:

· changes in interest rates;

· inflation or life expectancy trends;

· intervention by regulators or legislators; and/or

· investment performance of the funds' assets.

The Group constructively engages with the trustees of the pension funds to ensure that they are taking appropriate advice and the funds' assets and liabilities are being managed appropriately.

The funding and investment arrangements of the pension funds are subject to an in-depth triennial funding review with regular monitoring in between.

The Group's main UK fund has hedged in excess of 80% of its exposure to interest rate and inflation movements.

Owner

The Board

Risk movement

Decreased

Triennial funding review was completed in 2019. Positive valuation result means the Group can lower the risk profile of the asset portfolio.

14. Uncertainty within the economic environment

The effects of national or market trends or political or regulatory change (including the UK's exit from the EU), may cause customers to re-evaluate existing or future infrastructure expenditure and the procurement of services and/or lead to changes in the price and availability of labour and products.

What impact it might have

Any significant delay or reduction in the level of customer spending or investment plans could adversely impact the Group's strategy and order book, reduce revenue or profitability in the near or medium term and negatively impact the long-term viability of the Group.

Restrictions on the availability of skilled labour and competitively priced materials could lead to increased costs and hence potentially a devaluation of the business.

Financial failure of a customer, including any government or public sector body, could result in increased financial exposure to counterparty risk.

Failure to plan for any potentially negative impacts, manage uncertainty or capture any opportunities that may be presented could lead to:

· customers postponing, reducing or changing expenditure plans;

· wider than expected fluctuations in inflation;

· increased competition (e.g. in the UK from foreign investors acquiring competitors);

· increased supply chain risks (e.g. solvency, people and materials); and/or

· reduced revenue or pressure on margins.

The Group primarily operates across three geographies (UK, US and Hong Kong) and three sectors (Construction Services, Support Services and Infrastructure Investments). This balanced portfolio of projects provides resilience and stability as the Group is less exposed to a downturn in a single geography or sector.

The Group continues to actively monitor the terms of the UK's future trading relationship with the EU including the impact on movement of goods and people across borders. A well-established cross-functional working group is in place for this purpose.

The financial solvency and strength of counterparties is always considered before contracts are signed and assessments are updated and reviewed whenever possible during the project lifecycle. The business also seeks to ensure that it is not over-reliant on any one counterparty.

Owner

The Board

Risk movement

No movement

Macroeconomic factors continue to have the potential to impact the Group. Controls in place to mitigate risk and capture opportunity remain appropriate.

2019

£m

2018

£m

Anglian Water Group Ltd

Sale of goods and services

19

26

Amounts owed by related parties

-

-

URENCO Ltd

Sale of goods and services

2

19

Amounts owed by related parties

-

2

2019

£m

2018

£m

Short-term benefits

3.034

2.724

Share-based payments

1.314

1.728

4.348

4.452