Ncc Regulatory News (NCC)

7 July 2016

NCC Group plc

Continued rapid growth of international cyber security drives profits up 48%

NCC Group plc (LSE: NCC or "the Group"), the independent global cyber security and risk mitigation expert, has reported its full year results for the 12 months to 31 May 2016.

Highlights

§ Group revenue up 56% to £209.1m (2015: £133.7m), organic growth 19%

§ Group EBITDA* up 48% to £43.7m (2015: £29.5m) before £18.9m exceptional charge

§ Group adjusted operating profit* up 46% to £38.4m (2015: £26.4m)

o Assurance operating profit up 52% to £25.8m (2015: £17.0m)

o Escrow operating profit up 6% to £20.1m (2015: £18.9m)

§ Group adjusted profit before tax* up 45% (2015: 1%) to £37.0m (2015: £25.5m)

§ Adjusted fully diluted earnings per share up 19% to 11.2p (2015: 9.4p)

§ Total dividend up 17% to 4.65p (2015: 3.98p) - since July 2004 flotation, dividend increased from 0.42p to 4.65p, CAGR of 25%

Operational

§ Fox-IT integration on track - global roll out of services expected to start during current financial year

§ Accumuli fully integrated - focus on substantial cyber security market opportunities

§ Strongest Escrow revenue growth in 10 years

§ Withdrawal from Domain Services but domain security capability retained

o Open Registry to be realised and other assets written down

o Exceptional charge of £13.7m, including £0.9m cash cost

§ Employees increased by 40% to 1,857 worldwide (2015: 1,388)

§ First PLC to form Cyber Security Committee - on a par with Audit and Remuneration Committees

Outlook for 2016/2017

§ Group's forecast contracted recurring revenue and current order book up 67% to £104.6m (2015: £62.7m)

o Group contracted recurring revenues are £48.5m

* All Group adjusted figures exclude the amortisation of acquired intangibles, exceptional charges, share-based charges and unwinding of discount on deferred consideration.

Rob Cotton, Group Chief Executive, comments:

"This has been a year of notable progress for the business. We fully integrated Accumuli, considerably expanded our capabilities with the acquisition of Fox-IT and delivered a significant increase in earnings, up 19% - and increased dividends by 17%, a 12 year CAGR of 25%.

"The threat intelligence capabilities that Fox-IT brings to the Group are proving to be a key point of differentiation. We look forward with increasing confidence as we roll out its services to customers across the Group.

"The threat of being hacked or having valuable data stolen continues to grow at a seemingly unstoppable pace. With our global reach and increased product range, we remain tightly focused on exploiting the opportunities to deliver sustained long term growth.

"The cybercrime arms race is the single biggest threat to corporates and individuals globally particularly as cybercrime is not bound by national borders or political and trade treaties.

"Regardless of when or how the various negotiations develop with the EU, if the UK wants to trade with the EU on equal terms, UK data protection standards will have to be equivalent to the EU's General Data Protection Regulations ("GDPR"). For the UK to do business with the EU, or any other country for that matter, it is vital that data protection standards and legislation is of the highest order.

"Although cyber threats are now an everyday occurrence for businesses and individuals alike, there needs to be a cultural shift as it is clear that the required behavioural change at all levels is severely lagging. A recent government cyber survey of FTSE 350 companies indicated that only 33% of boards understood their appetite for cyber risk - 67% do not!

"All listed companies should have a Board-led Cyber Security Committee. As such, we are creating a Cyber Security Committee to sit alongside our Audit and Remuneration Committees."

*FTSE 350 Cyber Governance Health Check Report 2015 published on 8 May 2016.

Enquiries:

Overview

The twelve months to 31 May 2016 was yet another year of strong and consistent growth for NCC Group. Notably during the year, the Group joined the FTSE250 index. This is yet another milestone for the Group and demonstrates how far the business has grown and developed over the last 12 years.

During the last 12 months, Group revenues grew by 56% to £209.1m (2015: £133.7m) with Group EBITDA increasing by 48% to £43.7m (2015: £29.5m). Adjusted pre-tax profits and adjusted fully diluted earnings per share were up 45% to £37.0m (2015: £25.5m) and 19% to 11.2p (2015: 9.4p) respectively.

Reflecting the Board's commitment to a progressive dividend policy, which broadly tracks earnings growth, a final dividend of 3.15p is being recommended, making a total for the year of 4.65p, up 17%.

The Group continues to be highly cash generative with underlying operating cash conversion representing 107% of operating profit (2015: 107%) with net debt down to £12.7m (2015: £50.6m).

2015/2016 was a year of tangible progress, strategically, operationally and financially. The Group raised £126.3m by way of a firm placing and a placing and an open offer in November and December 2015, which helped fund the acquisition of Fox-IT.

Operationally, the Group completed the integration of Accumuli plc, which has been rebranded NCC Group Managed Security Services and has commenced the process with Fox-IT. Both are performing in accordance with expectations.

Following a strategic review after the year-end, the Board has taken the disappointing decision to divest and reallocate some of the assets in the Domain Services division. This has resulted in an exceptional charge of £13.7m of which £0.9m is a cash cost.

The Group continues to believe that safe, controlled open or branded domains will play a major part in the Internet landscape in the years to come, but has recognised that other opportunities will provide a faster return on Group assets and investments.

As a result, certain parts of the Division will be divested in due course, although the capability to provide a secure domain environment will be retained.

NCC Group is committed to leading the push to make the Internet a safer place for all and as its markets continue to quickly evolve, the Group remains active in innovating and creating new services to address the numerous emerging opportunities.

Both the Assurance and Escrow divisions have continued to grow strongly. Assurance has yet again shown stellar revenue growth of 74%, of which 25% was organic, while Escrow achieved record organic growth of over 10%, all of which translated into Group adjusted pre-tax profit growth of over 45%.

In line with the acquisition strategy, the Group added another security technology company. Fox-IT provides complementary security consulting services in Europe and offers advanced threat analytics, cryptography services and products, which the Group was previously lacking.

This enables the Group to supply a wider range of security related services to its customers globally and ensures that the Group is a comprehensive one-stop consultancy led security services company that caters for all of a client's requirements.

Overall, the Group's strategy remains fundamentally unchanged. The Group aims to develop both complementary divisions organically and by acquisition to deliver excellent service and value for money to customers. This will continue to drive growth across the Group.

The Group will continue to actively seek to acquire services-led businesses in both Europe and North America to complement its geographical and technical presence. In addition, new offices will be opened in Singapore and Dubai, with consideration being given to a significant central London office.

Cyber Security Committee

NCC Group has stated on a number of occasions that the responsibility for cyber security rests directly with a company's Board and should be approached and managed with the same vigour and transparency as audit, remuneration, health and safety and CSR.

This year NCC Group will form a Cyber Security Committee, led by the Senior Independent Non-Executive Director, and comprising the Non-Executive Directors and the CEO. The CEO will report monthly to the Committee on the performance of the Group's internal security and defences. The Group believes it is the first listed company to create a Cyber Security Committee at a Board level.

The Group believes that with the ever rising threat of cyber-attacks, all listed companies should have a Board led Cyber Security Committee.

Outlook

The whole organisation is focused on client risk mitigation and delivering peace of mind, through a complementary range of services offered to an increasing range and number of multinational clients to address their business issues.

NCC Group has established itself as one of the leading pure play cyber security services businesses with an extremely wide geographical footprint and has the largest number of industry experts.

Across the Group, the current financial year has started well and the market for the Group's services remains as strong as ever. It is still too early to assess how the decision made by the UK to leave the EU will affect the Group but this is being carefully monitored.

The Group's recurring income is significant and has increased. The start to the year sees Escrow renewals increasing to £20.5m (2015: £19.3m) and Assurance has £28.0m (2015: £6.8m) of managed services, threat intelligence and monitoring renewals forecast for the current financial year.

The Assurance division's order book has improved to £53.1m (2015: £32.3m) and Escrow verification orders total £3.1m (2015: £2.4m).

The Group's total renewals and order books now stand at £104.6m (2015: £62.7m).

The outlook for NCC Group remains very positive. The Group is operating in a number of fast growing international markets where it can offer its existing extensive capabilities as well as a range of new and innovative products and services.

As a consequence of all these factors, alongside the integration and roll out of Fox-IT products and services, the Board is confident that the Group can continue to deliver sustainable growth and enhanced shareholder value.

Strategic report

Group strategy - delivering sustained growth based on innovation, expertise & independence

NCC Group is a global expert in cyber security and risk mitigation providing organisations worldwide with market leading escrow and verification, security consulting and web performance solutions.

The Group set about building its future around the software escrow business while looking for new areas of growth in the then uncharted territory of information and cyber security. Since then, through carefully constructed, controlled and sustainable organic growth along with a carefully planned and well-executed strategic acquisitions programme, the Group has developed into a leading multinational provider in both areas.

The Group now operates in two distinct but complementary divisions, Assurance and Escrow, having taken the decision to withdraw from providing Domain Services.

The two Divisions do not actively cross-sell. However, they do share information, intelligence and relationships to ensure that the appropriate products across the portfolio are made available to all our clients.

Both divisions are tasked with and measured on providing the best client service, allied to offering appropriate services to help mitigate risk. The Group is cautiously and diligently looking for acquisition opportunities of complementary businesses that either further strengthen its market position, geographic presence or appropriately extend the service offering.

Each division has a common objective, to innovate and develop further its product sets, to ensure that it remains at the forefront of thought leadership and delivery, as well as to expand geographically where appropriate.

Markets and positioning

The Group's markets continue to evolve quickly and it remains active in innovating and creating new services to address the numerous emerging opportunities.

Innovation, creation and research and development are the key touchstones of the Group's development and growth. Never has this been more important as the world finally wakes up to the cyber threat that is now an everyday occurrence for businesses and individuals alike.

The Group is committed to making the Internet a safer place for all. NCC Group's continued investment in people and research led initiatives means that it is well placed to call for changes to make Boards truly accountable for the security of their organisations.

Online security continues to fail to keep up with the numerous types of individual and indeed organisations that transgress the Internet. The threat of being hacked or having valuable data stolen continues to evolve rapidly and it is growing at a seemingly unstoppable pace.

Phishing, fake payment requests and ransomware attacks are every day events and have increased massively, providing lucrative rewards to the miscreants who perpetrate these attacks.

The world cannot be made completely safe from cybercrime. As the number and range of threats proliferate, being innovative and using the Group's experience and skills to protect against attacks becomes more important than ever. NCC Group is doing this by providing the best security consultants to world leading clients as well as conducting world-renowned security research.

Employees

The talent, dedication and experience of the people employed by the Group is vital to its success. The motivation and retention of staff remains key for the Group's future. The Group aims to be the employer of choice. It proactively monitors staff retention and manages all aspects of individuals' roles, responsibilities and aspirations.

The Group now employs 1857 people across the world, including 206 associates.

General Data Protection Regulation and Brexit

The current UK data protection regime was due to be modified by new EU regulation, primarily the General Data Protection Regulation ('GDPR'). GDPR will be implemented across the EU by May 2018.

This legislation will enable individuals to gain the right to know when their data has been hacked and companies and organisations will be required to notify the national supervisory authority of serious data breaches as soon as possible.

Any breach of the new data protection rules will be punished with fines of up to four per cent of global turnover with the prospect of significant financial fines for non-compliance as an additional incentive to focus minds at Board level.

Regardless of when or how the various negotiations develop with the EU, NCC Group strongly believes that the UK should implement similar data protection legislation. Cybercrime is not bound by national borders or political and trade treaties.

NCC Group shares the ICO's (Information Commission's Office) practical view that if the UK wants to trade with the Single Market on equal terms UK data protection standards would have to be equivalent to the EU's GDPR.

For the UK to do business with the EU, and any other country for that matter, it is vital that data protection standards and legislation is of the highest order.

The government's National Cyber Security Strategy for the next five years is due for publication later this year. NCC Group strongly believes that it must have a clear commitment to protect citizens, businesses and public administration more than ever from cyber threats. Crucially it needs to put in place reforms that allow continued European and international trading as well as data protection for both citizens and businesses. It should also address the major challenge concerning a dearth in skills in order to continue the UK's unrivalled expertise in security consulting.

Board responsibility

Cyber security and the associated risk mitigation should be the Board's responsibility and in particular that of the CEO. All Directors must be fully accountable and a lack of understanding or knowledge is not an acceptable excuse.

A recent government cyber survey of FTSE 350 companies indicated that only 33% of boards understood their appetite for cyber risk, so 67% do not. The Group is committed to putting cyber security onto companies' main boards' agendas.

Currently companies do not have any responsibility to report on cyber breaches or the costs spent mitigating or remediating after a breach has occurred. Boards fully discuss and become expert on accounting policies, health & safety, CSR and executive remuneration and report on them in detail in their Annual Report and Accounts. This is not the case with a company's most valuable assets, its data and information.

While the measure and assessment of cyber risk can be contracted out to third parties, the determination and judgement of what is an acceptable level of risk and what appropriate mitigations can be used to reduce or minimise that risk, cannot be delegated or outsourced.

It is no longer acceptable for cyber security to be passed down to an IT director or risk manager. It is the responsibility of the CEO and the main board as it is the most significant issue facing businesses today.

No FTSE 350 company currently has a separate Cyber Security Committee that reports to the Board monthly. Most, incorrectly, believe that this responsibility is that of the Audit Committee which usually meet at most, on a quarterly basis.

Audit committees do not always have the necessary skill, gravitas, capability or mandate to deal with what is a daily threat. It is also unclear what cyber expertise and know-how a non-executive accountant would bring. Nor is it clear why cyber risk would be managed in a domain where the CEO is not the key member of a committee since it is the biggest risk on his/her watch.

A cultural change is needed as the majority of boards do not have executives with the necessary IT skills, let alone an understanding of cyber security. Most board directors who have extensive operational and financial expertise in their industries and the corporate world, have minimal, if any, formal education in IT.

As directors undergo training for anti-bribery or health and safety, they should also undertake training for cyber security, as without it they will not be able to judge or score the threat on the corporate risk register.

Assurance Division

Information security & security consulting

The strategic direction and cultural philosophy of the Assurance Division is about constant evolution and therefore research is key to being successful in the marketplace. Information security and cyber security continue to change at a rapid pace with new areas of concern or vulnerabilities frequently and regularly discovered.

To stay ahead in the cyber-arms race, the Group's global corporate culture is aligned with this rapid and constant change. The Group has created boutique ways of working with cultural values that encourage individuals to fulfil their full creative potential.

Apart from determining security weaknesses, the Group is also committed to making the Internet a safer place for the world to interact, communicate and transact. While combatting the threat of cyber-crime is a clearly stated objective, so is finding a safe way for the world to navigate, communicate and transact on the Internet.

Today, cybercrime is the single biggest threat to businesses and individuals around the world. To put this into perspective, a recent Kaspersky survey stated that the damage from cyber-attacks costs UK business more than £27 billion each year.

The average cost to recover from a DDoS attack is £275,000 and more than 90% of businesses have experienced some form of cyber security threat. On average, it takes almost 120 days for an organisation to find out that it has been compromised.

In the UK, the public is still largely in the dark about what data of theirs has been compromised or how poor companies are at safeguarding their data. Individuals should have the right to expect their data to be protected to the highest standards and if it is not, they should be made aware of what has happened to it.

Furthermore, from the Group's own research into the safety of the Internet, almost two-thirds of consumers believe an online data breach will compromise their financial information within the next year.

The fact that some 60% of consumers are more worried than ever before about protecting their personal and financial information online should certainly confirm the threat as the greatest to face business today.

Division's strategy and positioning

The Division's strategy is to constantly demand the generation of new ideas and initiatives. Not all ideas make it to product development or design but each is critically, technically and commercially appraised before any financial commitment is made.

In conjunction with this creativity, the organisation is committed to remaining independent and listening to its clients' requirements as well as looking to supply complementary Group capabilities and services that are currently not supplied.

To that end, new product or service lines are reviewed from a make or buy standpoint. Acquisitions are carefully analysed and decisions to acquire Assurance businesses are based upon culture, fit and service but never on the basis of profit enhancement by cost reduction or the ability to turn around an ailing business.

Threat intelligence and cryptology is the most recent example of this, where the Group acquired a business, Fox-IT, to directly fill a product and service need and will be rolling its services out to multi-national customers during 2016. Threat intelligence is one of the most important tools in an organisation's armoury to help prevent and mitigate cyber-attack.

The Group has been product agnostic and has avoided being a reseller of third parties' products, software or services, but this can in certain situations compromise the Group's ability to effectively deliver client solutions.

The acquisitions of Accumuli and Fox-IT required the Group to ensure that these businesses' channel and product models did not blur the Group's product independence positioning, nor its independent service capabilities.

Following a detailed due diligence process, the Group is satisfied that its clients are being supplied the right set of products from a controlled process of recommendation even if the product is not sold by the Group.

As one of the worlds' largest service led security consultancies, the Group is capable of leading all bids rather than having to look for support from larger third parties. NCC Group does not provide white label solutions for third parties to resell, nor does it enter into any strategic alliances that compromise the Group's objectivity or independence.

Integrity and credibility, alongside technical capability, are the leading cultural values of the Group and the fundamental underpinning of its strategy to innovate, create and make safe. This will ensure the Group remains an independent, unbiased organisation and maintains its place as the trusted provider of choice in the security services marketplace.

Since much of the work carried out by the Group is research based, in order to maintain its equitable and ethical disclosure policies, research paid for by third parties and customers is not disclosed, unless requested by the paying organisation.

Self-funded research by the Group will always be provided to the organisation that it affects in full, free of charge and without disclosure, until such time as the vulnerability has been resolved in a reasonable timeframe.

However, this does not preclude the Group making a full public disclosure if there is a threat to life or to the general public's online security and if the third party is unwilling to remediate or fix the issue.

Escrow

The Escrow Division remains the foundation of the Group and is the platform upon which the organisation has been built. The fundamentals of the Group are fully encapsulated in this division, which is based around the very highest standards of customer care and the equitable treatment of both customers in the contractual relationship.

Escrow offers a high value product for a low, in comparison, investment. Due to its importance to clients, it provides the Group with excellent recurring revenues along with good margins and cash generation.

Escrow can be provided both in the traditional software market as well as in all iterations of the outsourced model, as the basic underpinnings are the same, protection from an event that disrupts the relationship between the owner and licensee of a software product.

Escrow is also a requirement for all registrars and registries of domains. The Group provides registry data escrow services, where the IP address of each domain registered within a TLD is safely secured along with Registrar Data Escrow particularly to support European customers.

The Escrow business has continued to develop its SaaS service and although not yet a major contributor to profitability, it is a very important tool in providing a complete service for clients as they seek to mitigate risk.

This year has been very successful as the team has worked hard to consolidate the positive performances of previous years in both Europe and the US. The performance is underpinned by a stable management team that has driven success from the UK to the rest of the world.

The cash flow and profitability of Escrow are reinvested to produce not only better Escrow products and services but also other areas of complementary services across the Group to help clients mitigate their information and cyber security risks.

Domain Services

Following a strategic review, the Group has decided to withdraw from the Domain Service marketplace and reinvest some of the assets and resources in areas that will provide a more suitable return in the near term.

While this will involve the diminution and realisation of assets, the Group is still committed to the concept behind domain services and has retained the ability to provide a secure, managed environment when the marketplace changes, with the objective being to create a safer Internet for all who traverse and use it. The Internet will only survive as a usable vehicle for commerce and industry if there are radical changes to operators' and users' behaviours.

It is clear that the open generic domains and city codes have not been taken up by businesses and consumers as well as expected with all of these falling well short of their initial registration targets. Coupled with the fact that the branded domains are still either undelegated or those that are, are unused, it is clear that the market is not ready for the very necessary changes that need to happen to strengthen security on the Internet.

As it appears that the process for new applications is unlikely to happen in the near term, so actual use of those newly applied for domains is still years away, the Group has decided to cut its losses at this stage.

The Group will maintain and continue to publish the .trust security standards since these are fundamental to a safer Internet regardless and will continue to use .trust as the Group's domain.

Financial review

Revenue

For the financial year ended 31 May 2016, the Group increased revenue by 56% to £209.1m (2015: £133.7m) with the revenue split being H1 45%: H2 55% (2015: H1 47%: H2 53%) between the first and second halves of the year. Organic revenue growth was 19% (2015: 18%).

On a constant currency basis, the Group revenue growth would have been 54% (2015: 19%) as both the dollar and euro exchange rates against the pound varied considerably during the year. Due to the natural hedging through the intercompany loans, the impact on the Group's operating profits was minimal. The Group does not hedge against currency fluctuations.

In the year, 58% (2015: 54%) of revenue, £122.0m (2015: £72.1m) was derived from the UK. Continental Europe contributed £34.2m (2015: £13.5m) or 16% of Group revenue, with the Rest of the World revenue increasing to £52.9m (2015: £48.1m), some 25% of Group revenue.

Assurance accounted for 81% of the Group's revenue (2015: 74%) as it continues to see faster organic growth as well as benefiting from six month's revenue from the newly acquired Fox-IT.

Domain Services saw revenues reach £4.9m (2015: £4.7m). The Group expects to withdraw from the sector by the end of the financial year 2017.

The Group's recurring income is significant and has increased. Assurance, benefiting from the acquisition of Fox-IT, saw 94% of its revenues renewed (2015: 83%), representing 61% of all customers (2015: 52%). In addition, 90% (2015: 91%) of the performance monitoring revenues renewed and are recurring.

The increasing number of customers that are renewing in Assurance has resulted in renewing Assurance customers' annual expenditure increasing from £73.7k to £83.2k with total average customer spend moving to £51.9k from £53.7k.

In Escrow UK nearly 90% of all contracts renewed (2015: 89%).

The Group continued to have minimal reliance on any one customer or sector. Within Assurance the largest customer represents 4% of Assurance revenue which is 3% of Group revenue. The largest customer in Escrow is 1% of total Escrow revenue.

The majority of revenue for Domain Services came from the withdrawal of the application for .secure and so has not been included in the sector analysis.

Assurance Division

Assurance now accounts for 81% (2015: 73%) of Group revenues with total divisional revenues increasing by 74%, 25% organically, to £168.9m (2015: £97.0m).

Security consulting revenues grew 87% to £138.9m (2015: £74.4m). Included within this was £14.0m of revenue from Fox-IT for the period December 2015 to the year end.

Software Testing and Web Performance revenues grew by 33% to £30.0m (2015: £22.6m) with a recurring revenue of £7.0m within web performance, some 90% (2015: 91%) of customers, which continues its strong track record of client retention.

The Assurance division primarily provides expert security assurance and penetration testing, cyber defence operations, incident response and forensics, managed security services and security operations centres as well as risk management and governance. 

Fox-IT complements these services and provides a number of them as well as providing threat intelligence services and cryptography based products to clients.

Following the integration of Accumuli, the Group's managed scanning service (MSS) offerings have been consolidated so that there is a single client solution. Accumuli has been rebranded NCC Group and the majority of services offered are either security consulting or MSS, although the Group also sells a limited number of security and big data related third party product sales.

Software Testing delivers secure UK based testing to clients. Web performance testing involves continuously monitoring the performance and load capability of organisations' websites. This is a SaaS-based service that relies heavily on a world-class product with the highest levels of customer support.

The business unit employs 1323 employees globally (2015: 929) and uses 206 associates (2015: 158).

Escrow Division

The Group's Escrow business, the cornerstone of NCC Group, produced another very solid year's performance with a substantial margin and very strong cash conversion, as well as a high degree of recurring revenue, due to the consistent contract renewal rates of almost 90%.

The Escrow division increased revenue by 10% to £35.3m (2015: £32.0m).

Group Escrow recurring revenue renewals, grew to £20.0m (2015: £18.5m). Group Verification revenues grew by 20% in the year to £10.0m (2015: £8.3m).

Escrow UK. Escrow UK revenue was £25.7m (2015: £23.7m). This 8% growth in revenue (2015: 5%) was delivered through contract growth and verifications, with only a limited amount coming from the effects of the price increase introduced during the year.

Escrow UK recurring revenues increased to £13.7m (2015: £13.2m) and terminations remain below 11%.

Escrow Europe and Escrow US. Escrow US revenues grew by 20% to £6.2m (2015: £5.2m) and Escrow Europe revenues grew by 9% to £3.4m (2015: £3.2m).

Escrow UK now has 107 employees (2015: 99), Escrow Europe has 15 employees (2015: 14) and the North American Escrow businesses have 59 employees (2015: 32).

Domain Services

The Division was established in May 2012 in California, but has now been wound down due to the slow take up of the new domains and the lack of awareness of customers and businesses about the changes in the domain world.

The division was set up to develop the critical infrastructure and know-how to create a universal environment for end users to operate and navigate the Internet with complete safety and security.

In January 2015, the Group acquired Open Registry to provide the technical know-how and software to operate as a secure registry and registrar in order to offer a complete end to end service for all of a client's ICANN related and domain requirements.

Domain Services accounted for less than 2% (2015: 4%) of Group revenues.

The domain, .trust and associated capital assets valued at £4.2m continue to be used elsewhere in the Group and have not been written down in value. Impairment and other charges for the remainder of the Division are shown in the Exceptional items section below.

Profitability and margins

As product development, intellectual property and tool development are now such integral parts of the Group, especially following the acquisition of Fox-IT, the impact of amortisation and depreciation has a material effect on NCC Group's financial statements.

Accordingly, in line with many of its peers in the UK and the US, the Board has decided to publish the Group EBITDA (earnings before interest, tax, depreciation, amortisation and exceptional charges). Group EBITDA is £43.7m (2015: £29.5m), up 48%.

NCC Group continues to generate strong margins despite the increased percentage of revenue from the non-escrow businesses and the effects of the Domain Services operational loss.

Overall adjusted operating margins remained strong at 18% (2015: 20%). Excluding Domain Services operating margins would have been 19%.

Assurance's profitability grew by 52% to £25.8m (2015: £17.0m) and Escrow's by 6% to £20.1m (2015: £18.9m).

The Assurance division's margin was 15% (2015: 18%) due to the effects of a full year of NCC Group MSS product sales. This is over one percentage point better than at the half year. The underlying margin will continue to improve, ultimately achieving the division's medium term objective of 20%.

The Escrow division's operating margins remained strong at 57% (2015: 59%), almost one percentage point better than in the first half of the year.

Adjusted Group operating profit was up by 46% to £38.4m (2015: £26.4m), including a net operational loss of £1.7m (2015: loss £4.9m) in Domain Services. It excludes the amortisation of acquired intangibles, exceptional charges, share-based charges and unwinding of discount on contingent consideration.

Adjusted Group pre-tax profit improved by 45% to £37.0m (2015: £25.5m) after an interest charge of £1.4m.

The Group's reported pre-tax profit was £10.7m (2015: £21.4m), after the inclusion of the unwinding of the discount on the acquisitions' deferred consideration, amortisation of acquired intangible assets, share based payment charges and the exceptional items.

Exceptional items

Total Group exceptional charges were £18.9m (2015: £0.6m), of which £0.9m is cash cost in the financial year ended 31 May 2017.

As a result of the acquisition of Accumuli in April 2015, the Group, as previously reported, became responsible for paying retention bonuses to a large number of employees and former employees of Accumuli as well as the costs of a fundamental restructure and reorganisation of the company. This resulted in an exceptional charge of £1.7m

In November and December 2015, the Group raised £126.3m through a firm placing and a placing and open offer and simultaneously acquired Fox-IT on 27 November 2015 for €133.25m (£93.5m).

The costs associated with the fund raising and acquisition were £3.5m, which is comprised of fees of £2.3m and related foreign exchange exposure of £1.2m on the deferred consideration.

As a result of the decision to withdraw from the Domain Services market place, the Group has taken a number of one off charges, totalling net £13.7m, of which £0.9m is a cash cost that will be paid in the financial year ending 31 May 2017. These include:

· The impairment of capitalised assets, the critical infrastructure and know-how to create a universal environment for end users to operate and navigate the Internet with complete safety and security is £6.9m.

· The net impairment in the goodwill in Open Registry is £5.9m. This includes the £5.9m of deferred consideration that will not be paid as the earnings targets have not been achieved.

· A further £0.9m for headcount and associated restructuring costs related to winding down the Division.

Taxation

The Group's effective tax rate is 22% (2015: 22%), which is marginally above the average standard UK rate of 20% (2015: 21%). The higher effective rate reflects the higher tax rates incurred in the overseas businesses.

Earnings per share

The adjusted basic earnings per share from operations was 11.3p (2015: 9.5p).

The table shows the effect on the Group's basic earnings per share of the amortisation of acquired intangibles, share based payment charges, unwinding of the discount on the deferred consideration for acquisitions and the effect of the exceptional items.

The adjusted fully diluted earnings per share from continuing operations was 11.2p (2015: 9.4p) whilst reported fully diluted earnings per share was 3.2p (2015: 7.8p).

Dividends

The Board is recommending a final dividend of 3.15p per ordinary share, making a total for the year of 4.65p. This represents cover of 2.4 times (2015: 2.4 times) based on basic adjusted earnings per share from continuing operations.

Since the Group's flotation in July 2004, the dividend has increased from 0.42p to 4.65p, a compound annual growth rate of 25%.

Cash

The Group continues to be highly cash generative with an operating cash flow before interest and tax of £23.1m (2015: £24.3m), which gives a normalised cash conversion ratio of 107% of operating profit before interest and tax (2015: 107%) after adjusting for exceptional working capital movements associated with acquisition related payments and the non-cash exceptional items in the cash flow.

It is expected as the mix of business continues to change due to the increase in Assurance revenues, the percentage will be closer, normally, to 100%.

After accounting for net cash inflows of £123.8m from the fund raisings and after the outflows for the acquisitions and contingent acquisition payments, the Group ended the year, as expected, with net debt of £12.7m (2015: £50.6m).

In November 2015, the Group increased its banking facilities to £110m (May 2015: £78m) with a new five year multi bank facility, comprising a £80m (May 2015: £78m) revolving credit facility and a £30m (May 2015: nil) five-year term loan and completed a firm placing for £63.1m.

In December 2015 a placing and open offer for a further £63.2m was completed.

In November 2015, the Group completed the acquisition of Fox-IT for £93.5m (€133.25m) of which £76.6m (€108.3m) was paid on completion.

At the year end, contingent payments relate to Fort Consult of £1.8m, which was paid in full in June 2016 and ArmstrongAdams of £1.7m due in August 2016. A non-contingent amount of £18.5m is due to be paid to Fox IT comprising of €10m in cash and €2.5m shares in November 2016 and November 2017.

The deferred payments of £5.9m to Open Registry are now no longer due as the profit targets cannot be achieved.

In the financial year to May 2016, due to the refurbishment and opening of new offices, the development of new security products and tools, as well as the roll-out of the new IT solution, the Group spent as planned some £13.5m (2015: £12.9m) on capital expenditure.

In the financial year to May 2017, the investment programme capital expenditure is expected to increase to about £18.0m representing the development of the Group's new head office in Manchester and other facilities around the world. Particular consideration is being given to a significant central London facility.

Business performance measures

The Group manages the business using the Key Performance Indicators shown in the table below. Reporting is daily, weekly and monthly and has different levels of granularity according to each manager's responsibility. The provision of accurate and quickly produced management information has always been integral to the Group.

Consolidated income statement

For the year ended 31 May 2016

Consolidated Statement of comprehensive income

for the year ended 31 May 2016

Consolidated statement of financial position

at 31 May 2016

These financial statements were approved by the Board of Directors on 6 July 2016 and were signed on its behalf by:

Rob Cotton

Chief Executive

NCC Group plc

4627044

Consolidated statement of cash flows

for the year ended 31 May 2016

Statements of changes of equity

for the year ended 31 May 2016

Group

Notes

(forming part of the financial statements)

1 Accounting policies

Basis of preparation

NCC Group plc ("the Company") is a company incorporated in the UK. The Group financial statements consolidate those of the Company and its subsidiaries (together referred to as the "Group"). The parent company financial statements present information about the Company as a separate entity and not about the Group.

These financial statements have been approved for issue by the Board of Directors on 6 July 2016.

The financial information set out herein does not constitute the Company's statutory financial statements for the year ended 31 May 2016 or the year ended 31 May 2015 but is derived from those financial statements. Statutory financial statements for 2015 have been delivered to the Registrar of Companies, and those for 2016 will be delivered in due course. The auditors have reported on those statutory financial statements; their report was (i) unqualified, (ii) did not include references to any matters to which the auditors drew attention by way of emphasis without qualifying their report, and (iii) did not contain statements under sections 498(2) or 498(3) of the Companies Act 2006.

In accordance with EU law (IAS Regulation EC 1606/2002), the group financial statements have been prepared in accordance with International Financial Reporting Standards ('IFRS') adopted for use in the EU as at 31 May 2016 ('adopted IFRS'), International Financial Reporting Interpretations Committee ('IFRIC') interpretations and those parts of the Companies Act 2006 applicable to companies reporting under IFRS. The preliminary results consolidate those of the Company and its subsidiaries.

The Group financial information has been prepared in accordance with International Financial Reporting Standards ("IFRS") as adopted for use within the European Union and in accordance with the accounting policies included in the Annual Report for the year ended 31 May 2015. A number of new standards and amendments to existing standards were effective for the financial year ended 31 May 2016. None of these have had a material impact. A number of standards, amendments and interpretations have been issued and endorsed by the EU, but which are not yet effective and accordingly the Group has not yet adopted. The cumulative impact of the adoption of these standards is not expected to significant.

Going concern

The Group funds its strategic acquisitions and meets its day to day working capital requirements via a multi-currency revolving credit facility of £80m, a £30m multi-currency term loan and an overdraft of £5m. At 31 May 2016, the amount drawn down under the facilities was £33.3m. This facility was agreed in November 2015 and is due for renewal in November 2020.

The Directors have reviewed the trading and cashflow forecasts of the Group as part of their going concern assessment and have taken into account reasonable downside sensitivities which reflect uncertainties in the current operating environment. The possible changes in trading performance show that the Group is able to operate within the level of the banking facilities and as a consequence, the Directors believe that the Group is well placed to manage its business risks successfully. After making enquiries, the Directors have a reasonable expectation that the company and the Group have adequate resources to continue in operational existence for the foreseeable future.

Accordingly, they continue to adopt the going concern basis in preparing the annual report and accounts.

2 Segmental information

The Group is organised into three operating segments (2015: three) Escrow, Assurance and Domain Services each of which is separately reported. While revenue and profitability are monitored by individual business units within these operational segments it is only at the operating level that resource allocation decisions are made. Performance is measured based on segment profit, which comprises segment operating profit excluding amortisation of intangible assets, share based payment charges and exceptional items. Interest and tax are not allocated to business segments and there are no intra-segment sales.

All revenue is in relation to services provided.

There are no customer contracts which account for more than 10% of segment revenue. Exceptional items include goodwill impairment of £11,877,000 attributable to the Domain Services segment, note 3.

3 Exceptional items

The Group identifies separately items as "exceptional". These are items which in management's judgement, need to be disclosed by virtue of their size or incidence in order for the user to obtain a proper understanding of the financial information. Subsequent revisions of estimates for items initially recognised as exceptional provisions are recorded as exceptional items in the year that the revision is made.

In November and December 2015, the Group raised £126.3m through a firm placing and a placing and open offer, part of which was used to fund the initial cash consideration to acquire Fox-IT Holdings B.V. The costs associated with the fund raising and acquisition were £2,295,000.

Following a strategic review, the Group decided in June 2016 to withdraw from the Domain Services market place, the Group has taken a number of one off charges, totalling net £13,709,000. These include:

· The write down of capitalised assets, the critical infrastructure and know-how to create a universal environment for end users to operate and navigate the Internet with complete safety and security is £6,858,000.

· The impairment of goodwill in Open Registry of £11,877,000.

· A credit of £5,940,000 in respect of contingent consideration that will not be paid as the earnings targets have not been achieved.

· A charge of £914,000 for headcount and associated restructuring costs related to winding down the Division.

As a result of the acquisition of Accumuli in April 2015 the Group, as previously reported became responsible for paying retention bonuses to a large number of employees and former employees of Accumuli as well as the costs of a fundamental restructure and reorganisation of the company. This resulted in an exceptional charge of £1,713,000.

During last year, the Group received a settlement of £2,000,000 in respect of a claim to recover costs incurred on an IT system termination in May 2012. Associated legal costs amounting to £201,000 were incurred in that financial year. In addition, acquisition costs in respect of the acquisition of Open Registry and Accumuli totalling £2,387,000 were included as exceptional charges in the prior year.

The tax effect in the income statement relating to the exceptional items recognised is:

4 Taxation

Recognised in the income statement

Reconciliation of effective tax rate

Current and deferred tax recognised directly in equity was a credit of £619,000 (2015: charge of £47,000).

The UK Government has announced that it intends to reduce the rate of corporation tax to 17% with effect from 1 April 2020. As this legislation was not substantively enacted as at year end the impact of the anticipated rate change is not reflected in the tax provisions reported in these accounts. Finance Act 2015 (No.2), which was substantively enacted in October 2015, included provisions to reduce the rate of corporation tax to 19% with effect from 1 April 2017 and 18% from 1 April 2020. Accordingly, the UK deferred tax balances have been revalued to the rate of 19% in these accounts which has resulted in a credit to the profit & loss account of £53,000 and a debit to reserves of £11,000. To the extent that the deferred tax reverses after 1 April 2020 then the impact on the net deferred tax liability will be increased.

5 Dividends

6 Earnings per share

The calculation of earnings per share is based on the following:

The average market value of the Company's shares for purposes of calculating the dilutive effect of share options was based on quoted market prices for the period during which the options were outstanding.

7 Intangible assets - Group

Management have used business forecasts in determining the recoverability of the asset value of software and development costs relating to the creation of new products and services. The remaining useful economic life of customer contracts and relationships is between 2 and 10 years.

For the purpose of impairment testing, goodwill has been allocated to the Group's three operating divisions, which are also operating segments, as these represent the lowest level at which goodwill is monitored for internal management purposes.

Goodwill considered significant in comparison to the Group's total carrying amount of such assets has been allocated to cash generating units for the purposes of impairment testing as follows:

When assessing impairment, the recoverable amount of each CGU is based on value in use calculations. These calculations require the use of estimates, specifically, pre-tax cash flow projections, long-term growth rates, and a pre-tax market discount rate.

Cash flow projections are based on the Group's detailed annual operating plan for the forthcoming financial year with assumptions applied for expected revenue growth and gross margins to forecast years two to three. The judgement on these assumptions is based on management's past experience of growth and knowledge of the industry sectors and markets. The projections beyond three years are forecast using an estimated long-term growth rate of 2.5% (2015: 2.5%) which represents management's best estimate of a long term annual growth rate in EBITDA. A different set of assumptions may be more appropriate in future years dependent on changes to the macro-economic environment.

The discount rates used are based on management's calculation of the weighted average cost of capital using the capital asset pricing model to calculate the cost of equity. Specific rates are used for each CGU sector in the value in use calculation and the rates reflect management's assessment on the level of relative risk in each CGU. The discount rate has been calculated to reflect the latest market assumptions for the risk-free rate, the Equity Risk Premium and the net cost of debt. The pre-tax discount rates used in the value in use calculations are:

The Directors do not believe that a reasonably possible change of assumptions would cause the recoverable amounts to fall below book value for any of the cash generating units due to the significant levels of headroom, with the exception of Domain Services.

The Domain Services CGU value in use calculation, based on conservative forecasts of future growth, resulted in a value significantly below the carrying value of the CGU net operating assets at 31 May 2016 and the Directors have concluded that the goodwill is fully impaired. The business forecasts are below the initial expectations due to the slow market development for the use of domain names. Accordingly, the goodwill balance of £11,877,000 has been fully impaired and the impairment charge is included in exceptional items in the income statement (note 3). For sensitivity, based on a change in discount rate of 1%, this would impact the discounted future cash flows by £0.3m, and a 10% change in forecast profits would have an impact of less than £0.1m.

During the year, the Group acquired Fox-IT Holding B.V., a group of companies based in the Netherlands with a principal activity of delivering cybersecurity and assurance services to customers. The goodwill of Fox-IT Holdings B.V. has been included in the European Security Services CGU for the purpose of annual impairment testing.

8 Plant and equipment - Group

The company has no plant and equipment.

9 Trade and other receivables

10 Acquisitions

Fox-IT Holdings BV

NCC Group (Solutions) Limited acquired Fox-IT Holdings BV, a company based in the Netherlands, on 27 November 2015. Fox-IT has a leading market position in Europe for high-end Cyber Security solutions and is a leading European provider of Advanced Incident Response Services. Fox-IT's activities of Advanced Threat Protection, Threat Intelligence and Web/Mobile Event Analytics, High Assurance and Secure Infrastructure, provide further depth to NCC Group's cyber and assurance services and growth opportunities from new markets.

The consideration for the acquisition of Fox-IT was €108,250,000 initial cash, with deferred payments due on each of the first and second anniversaries of completion comprising: €10,000,000 cash and €2,500,000 newly issued NCC Group plc shares each.

The acquisition had the following effect on the Group's assets and liabilities:

The fair value of trade and other receivables represents £7,511,000 of gross contractual receivables and a provision for doubtful debts of £216,000.

The goodwill of £70.9m represents the value expected to be generated from cross-selling Fox-IT products and services to existing group customers, sales growth from new customers in wider geographic markets and from future product development using the knowledge and expertise of the Fox-IT technical team. The goodwill is not expected to be deductible for tax purposes. Acquisition costs relating to professional fees totalling £1.9m were incurred and are recognised as exceptional costs in the income statement account (note 3).

The Group' consolidated income statement includes six month's post acquisition trading, with Fox-IT contributing £14.0m revenue and £1.3m operating profit. The combined results of NCC Group and Fox-IT B.V. for the twelve month period ending 31 May 2016 are revenue of £218.2m and pre-exceptional operating profit of £30.5m.

Accumuli plc

On 30 April 2015, the Group acquired 100% of the share capital of Accumuli plc for consideration of £52.5m in a share for share exchange plus cash consideration agreement. NCC Group plc issued 20,389,472 new ordinary shares of 1 pence with a closing share price of 208.5p amounting to a share issue valuation of £42.5m. £10.0m cash consideration was paid on a pro-rata basis to the Accumuli shareholders under the Scheme Arrangement.

Accumuli is a leading, rapidly growing, UK based independent specialist in IT security and risk management, providing industry leading solutions and services. The group's business activities are in the Assurance business segment. Prior to the acquisition, Accumuli was a public company quoted on the AIM market of the London Stock Exchange.

The acquisition had the following effect on the Group's assets and liabilities:

The goodwill represents the profitable sales growth expected from the cross-selling opportunities using shared product knowledge, expertise, and customer markets, the value of the workforce's industry knowledge and technical skills, and some central cost saving synergy. In the financial year to 31 May 2016, the goodwill value has increased by £1,368,000. This represents a £1,100,000 increase in contingent consideration liability for an acquisition previously made by Accumuli plc and a £268,000 adjustment to the fair value of Accumuli plc's acquired balance sheet relating to additional working capital liabilities and provisions. The goodwill is not expected to be deductible for tax purposes.

Open Registry Group

On 20 January 2015, the Group acquired the entire share capital of Open Registry S.A (Luxembourg), CHIP S.A. (Luxembourg), Nexperteam C.V.B.A (Belgium) and Sensirius C.V.B.A (Belgium) for total consideration of €19.5m. Of this amount, €10.1m was paid in cash immediately and €0.2m was paid as a retention in June 2015. Additionally, the acquisition agreement provided for contingent consideration of €9.2m payable in cash depending on specific profit based performance targets on the second and third year anniversaries of the completion date.

Open Registry S.A.(Open Registry) is the leading European Registry Service Provider for global brands. Clearinghouse for Intellectual Property S.A. (CHIP) is one of three key service providers that form the consortium that has been authorised by ICANN to operate the Trademark Clearinghouse (TMCH). Nexperteam CVBA (Nexperteam) is an accredited registrar for several TLDs managing over 8,000 domain names. The Company provides domain registrar services ranging from domain name registration, name serving to email and web hosting. 

The goodwill on acquisition represented the expected future customer growth in the Domain Name Registry and TMCH services, incremental revenue from cross-selling opportunities with NCC Group's developing domain services activity, and the value of the workforce's industry knowledge and technical skills.

The acquisition had the following effect on the Group's assets and liabilities: