Ncc Regulatory News (NCC)

19 January 2017

NCC Group plc

Solid growth in revenue & adjusted EBITDA despite H1 contract disappointments - clear opportunities for growth in advance of 2018 General Data Protection Regulation introduction

NCC Group plc (LSE: NCC, "NCC Group" or "the Group"), the independent global cyber security and risk mitigation expert, has reported its half year results for the six months to 30 November 2016.

Highlights

o Group revenues increased by 35% (November 2015: 50%) to £125.8m (November 2015: £93.5m). Organic growth of 18% (November 2015: 17%)

o Assurance Division revenue increased by 42% (November 2015: 57%) to £104.8m (November 2015: £73.8m) - organic growth 21% (November 2015: 17%)

o Escrow Division revenue increased by 14% (November 2015: 7%) to £18.7m (November 2015: £16.4m)

o Group adjusted EBITDA* increased by 15% to £21.3m (November 2015: £18.5m)

o Assurance Division EBITDA increased by 18% to £13.1m (November 2015: £11.1m)

o Escrow Division EBITDA increased by 14% to £10.6m (November 2015: £9.3m)

o Group adjusted profit before tax** increased by 5% to £16.7m (November 2015: £15.9m)

o Group profit before tax was £7.4m (November 2015: £7.5m)

o Adjusted fully diluted earnings per share^ 4.6p (5.0p in 2015)

o Interim dividend maintained at 1.50p (1.50p in 2015)

o Three large unrelated contract cancellations in quick succession and one deferral in the Assurance division impacted rate of growth

o Acquisitions of North American Payment Software Company in September 2016 and Virtual Security Research in November 2016

Board change

o Paul Mitchell, the Chairman, has notified the Board that he intends to step down on 31 May 2017 - see separate release.

Outlook

o Adjusted EBITDA* for full year to 31 May 2017 expected to be in the range of £45.5m to £47.5m - showing growth of up to 5% year on year

o H1:H2 adjusted EBITDA* expected split will be approximately 46%:54% based on the midpoint of £46.5m

o Orders and renewals up 49% totalling £112.8m (November 2015: £75.7m) for the current financial year

* Adjusted EBITDA is adjusted operating profit as defined at *** below, excluding depreciation and amortisation of software and development costs

** Adjusted profit before tax excludes exceptional items, the loss incurred by Domain Services, share based payments, unwinding of discount on deferred consideration and amortisation of acquired intangible assets.

*** Adjusted operating profit excludes exceptional items, the loss incurred by Domain Services, share based payments, unwinding of discount on deferred consideration and amortisation of acquired intangible assets.

^ Adjusted full diluted earnings per share is as calculated on page 25.

Rob Cotton, Group Chief Executive, commented:

"We have continued to see strong organic growth across the business, particularly in Assurance, albeit that earlier contract cancellations were disappointing. Our EBITDA has increased by 15% and we are maintaining our interim dividend at 1.50p - a clear indication of our confidence in our growth prospects for this year and beyond.

"With our global reach and increased product range, we are in a prime position to help organisations as they tackle compliance with the General Data Protection Regulation (GDPR) ahead of 25 May 2018.

"GDPR preparation should already be well underway but many organisations still believe that preparing for GDPR sits with the IT department and the legal team. In our view, it belongs with the Board."

Enquiries:

Overview

Group revenue increased by 35% to £125.8m (November 2015: £93.5m), with strong growth coming from both the Assurance and Escrow divisions.

Organic growth across the Group was 18% excluding the recent acquisitions of Fox-IT in November 2015, Payment Software Company Inc. ("PSC") in September 2016 and Virtual Security Research LLC ("VSR") in November 2016.

International revenue, which is mostly derived from the US, grew strongly by 89% to £64.2m. Following the acquisition of Fox-IT, PSC and VSR, international revenue now represents 51% (November 2015: 36%) of total Group revenue.

Group adjusted EBITDA increased by 15% to £21.3m (November 2015: 18% and £18.5m). As previously announced, three large unrelated contract cancellations in quick succession and one deferral in the Assurance division reduced the Group's rate of growth in the current financial year.

Assurance EBITDA grew by 18% to £13.1m (November 2015: £11.1m) and Escrow EBITDA grew by 14% to £10.6m (November 2015: £9.3m).

Group adjusted fully diluted earnings per share was 4.6p (November 2015: 5.0p).

The Group continues to be highly cash generative with the ratio of operating cash flow before interest and tax being 103% of operating profits (November 2015: 116%) after adjusting for exceptional items.

Net debt at the end of the period was, as expected, down to £48.8m (November 2015: £73.1m) against available facilities of £112.5m.

The Board is continuing with its dividend policy and is maintaining the interim dividend at 1.50p (November 2015: 1.50p).

Current trading & outlook

The outlook for NCC Group remains positive, especially with the market backdrop of ever-increasing high profile cyber security breaches as well as an increasing awareness and involvement by governments and regulators.

The Group remains focused on delivering client peace of mind and risk mitigation. It provides a complementary range of services with the breadth and depth to provide multinational clients with a total solution to their cyber security issues and needs.

The approach across both Divisions remains unchanged, to develop the business by a combination of acquisitions of earnings enhancing, high quality businesses and strong organic growth, all focused away from areas of discretionary expenditure.

Assurance order books have improved to £56.5m (November 2015: £41.0m) with £32.3m of managed services and monitoring renewals forecast for the current financial year (November 2015: £13.1m).

The Escrow business expects annual renewals to be £21.3m (November 2015: £19.3m) in this financial year, based on termination rates at 11%. The Escrow verification testing worldwide order book stands at £2.8m (November 2015: £2.3m).

In total, the Group's orders and renewals for the current financial year have increased by 49% to £112.8m (November 2015: £75.7m).

The Group continues to expect adjusted EBITDA for the year to 31 May 2017 to be in the range of £45.5m to £47.5m, which will see a growth in the range of up to 5% year on year. The H1:H2 adjusted EBITDA expected split will be approximately 46%:54% at the midpoint of the range.

Despite the disappointments of the first half of the year, the Group continued to trade well. The Board remains confident of a typically strong second half performance in the current financial year.

Financial review

Revenue

Group revenue was £125.8m (November 2015: £93.5m) with international revenues now making up 51% (November 2015: 36%) of total revenue.

Escrow accounted for 15% of NCC Group's total revenue (November 2015: 18%) with Assurance representing 83% (November 2015: 79%).

The movements in the global currency markets had a positive impact on the Group. On a constant currency basis, Group revenue would have increased by 28%.

The table below summarises revenue by division, including their key business areas.

The table below provides a geographical analysis of the Group's revenue based on where the customer is located. It highlights the significant increase in the scale of the US operations that make up the majority of the rest of the world revenue.

Profitability

Group adjusted EBITDA increased by 15% to £21.3m (November 2015: 18% and £18.5m) Depreciation was £2.5m (November 2015: £1.6m), and amortisation of software and development costs was £1.6m (November 2015: £0.5m). Interest charged was £0.6m (November 2015: £0.8m), and amortisation of acquired intangible assets was £5.1m (November 2015: £2.3m).

The adjustments include the transaction costs of the acquisitions of £0.6m and the losses incurred in Domain Services of £0.2m (November 2015: £1.0m) as the winding down process of that division completed.

Group adjusted EBITDA margin was 17% (November 2015: 20%). This is lower as a result of the impact of the investment made in Assurance and the adverse trading experienced in the first half of the year.

Assurance and Escrow adjusted EBITDA margins were 13% (November 2015: 15%) and 57% (November 2015: 56%) respectively.

Assurance and Escrow adjusted operating margins were 10% (November 2015: 14%) and 55% (November 2015: 56%) respectively.

Exceptional items

The exceptional items are as follows:

Following the Group's decision to withdraw from the Domain Services market at the end of the last financial year, the remaining assets, the Open Registry group of companies, incurred losses of £0.2m (November 2015: loss £1.0m) on revenues of £2.3m (November 2015: £3.3m).

On 4 January 2017, the Group announced the sale of the Open Registry group of companies, for a total consideration of £3.2m (€3.75m) subject to normal closing adjustments and settlement of the related intercompany debt of £120k (€140k). The cash consideration is above the carrying value of the net assets. This marks the completion of the Group's withdrawal from Domain Services.

Acquisition related costs of £0.6m (November 2015: £2.6m) consist of fees incurred in relation to the acquisitions of PSC and VSR. In the prior periods, the costs relate to fees incurred in relation to the acquisition of Fox-IT Holdings BV.

The revisions to estimates of deferred and contingent consideration of £2.6m (November 2015: gain £3.0m) relate to foreign exchange differences from revaluing the carrying value of consideration liabilities and the associated loan held in foreign currency. In the comparative period, there was a net gain of £3.0m principally relating to the re-assessment of the Open Registry contingent consideration.

The restructuring costs of £38k (November 2015: £0.5m) relate to the final retention bonuses paid to former employees of Accumuli plc. As previously reported, NCC Group became responsible for paying these bonuses on acquisition of the Accumuli group, as they were time related bonuses they impacted the Group's profit and loss account rather than pre-acquisition profits.

In the comparative period to November 2015, an exceptional cost of £4.1m was incurred for the write down of redundant technology.

The Group's reported pre-tax profit was £7.4m (November 2015: £7.5m) after including the unwinding of the discount on contingent consideration, amortisation of acquired intangible assets, share based payments and exceptional items.

Taxation

The tax rate for the six months ended 30 November 2016 is 26% (November 2015: 20%). The rate reflects the increased level of foreign profits in the first half of the year, the disallowance of the exceptional item relating to revision to estimates of deferred and contingent consideration, and one-off credits arising in the period. A tax rate of 31% is expected for the full year.

Earnings per share

The adjusted basic earnings per share was 4.7p (November 2015: 5.1p) and reported basic earnings per share were 2.0p (November 2015: 2.6p).

The table below analyses the effect on the Group's basic earnings per share of the amortisation of acquired intangibles, unwinding of the discount on contingent consideration for acquisitions, the effect of the exceptional items and share based payments.

Dividends

The Board is maintaining the interim dividend at 1.50p (November 2015: 1.50p). This will be paid on 24 February 2017 to shareholders on the register at the close of business on 27 January 2017, with an ex-dividend date of 26 January 2017.

This represents cover of 1.3 times (November 2015: 1.7 times) based on basic earnings, due to the exceptional items and cover of 3.1 times on an adjusted basic earnings basis (November 2015: 3.4 times).

Cash & funding

The Group's net debt decreased at 30 November 2016, as expected, to £48.8m (November 2015: £73.1m) against a total debt facility of £112.5m which comprises £80m revolving credit facility, £27.5m term loan and £5m overdraft.

The Group continues to be highly cash generative with the ratio of operating cash flow before interest and tax being 103% of operating profits (November 2015: 116%) after adjusting for exceptional items.

In H1, the Group has spent £15.7m ($20.3m) on the initial consideration for the purchase of PSC and VSR, as well as £2.0m (DKK17.6m) on deferred consideration to FortConsult for completing its earn out in full, £10.6m (€12.5m) to Fox-IT relating to its deferred payment schedule, and £1.6m deferred consideration relating to a previous acquisition by Accumuli plc.

The Group chose not to issue £2.1m (€2.5m) of new shares as part of the deferred payment to Fox-IT as had originally been intended preferring to make the payment in cash.

Capital expenditure which relates to buildings and IT equipment was £4.0m (November 2015: £1.1m). The Group anticipate the capital expenditure for H2 will be £7m.

The Group's working capital requirements have changed as the mix of business has evolved as the bias moves more towards Assurance. This was accentuated most by the acquisitions of Accumuli and Fox-IT and to a lesser extent by PSC and VSR.

Combined with the organic growth within the Group's businesses, these acquisitions have caused the amount of accrued income to grow. Consultants' salaries, the Group's main costs, are incurred in advance of their chargeable time being invoiced to clients, accordingly the value of trade and other receivables has increased ahead of trade and other payables.

Trade and other receivables were £77.3m (November 2015: £57.8m) at the half year, a 34% increase on the prior year. This trend will continue as the Group grows organically and by acquisition, although to date the age profile of the Group's trade and other receivables has not changed. Trade and other payables are £31.9m (November 2015: £34.0m).

In accordance with IAS38, the Group capitalises the software development of internal systems or products that are being delivered to the market, such as performance tools, portals and platforms. These tools are commercially developed for use on, and sale to, clients in the Assurance division.

The Group has capitalised direct costs of £3.0m (November 2015: £1.9m). This has increased marginally reflecting the change in the business due to the additions of Accumuli and Fox-IT and offset by the curtailment of Domain Services, where the rate of capitalisation has substantially fallen.

Operational review

Assurance Division

The Assurance Division revenue grew by 42% to £104.8m (November 2015: £73.8m) reflecting strong organic growth in all areas. On a constant currency basis the revenue grew 36%.

However, during the first half of the year, the Group reported that a sequence of unrelated events in the Assurance Division would result in a shortfall in the reported and expected performance in the current year.

The loss, due to client cancellation of three unrelated, higher margin contracts, which would have delivered £14m - £18m revenue during the financial year along with issues surrounding the renewal of some managed security services contracts has had a marked impact.

Organic revenue grew by 21% to £89.2m (November 2015: £73.8m) and US revenue grew 38% to £21.6m (November 2015: £15.6m).

Assurance EBITDA* increased by 18% to £13.1m (November 2015: £11.1m) and operating profits were £10.2m (November 2015: £10.3m).

The operating profit was impacted by increases in the depreciation charge for plant and equipment and in the amortisation charge for software and development costs which together amounted to £2.9m (November 2015: £1.2m). The 2016 depreciation and amortisation charge for software and development costs has increased from the acquisition of Fox-IT and additionally more development costs are being amortised as the projects have completed.

The Assurance EBITDA margin was 13% (November 2015: 15%) and the operating profit margin was 10% (November 2015: 14%). Both were lower as a consequence of the cancelled and deferred key contracts, which were higher margin work.

While the Group is confident that the Division's margins will improve, there will not be a quick return to levels seen before, until a better mix of work is delivered and a return on the investments made is seen. Investments include those made in the areas of management and delivery and also new offices with state-of-the-art facilities. In the medium term, more normal Group margin levels will be achieved.

Within the Assurance Division, staff retention and recruitment is the most significant issue and treating it as such ensures that the Group's exemplary reputation remains intact. Indeed, the importance the Group places on recruitment and retention is one of the reasons why employees choose to join NCC Group.

The Division now employs over 1,600 people globally and it is believed to be the largest multinational accredited team of security consultants in the industry.

Carefully balancing paid-for utilisation, quality of deliverable work and research, ensures that employee churn in the delivery teams is less than the 10% staff separation target. This is significantly less than the 30% market norm in high skilled IT environments.

NCC Group's world-class research has continued to focus on the problems faced by organisations globally today, as well as their future challenges in cyber security.

The Group actively promotes co-ordinated responsible disclosure for both paid for and self-funded vulnerability research. As well as being market leaders in state-of-the art vulnerability discovery, over the last year the Group has focused on developing research in the automotive and maritime sectors, as well as moving into quantum computing resistant cryptography, block chains and biometrics.

In the past year NCC Group published 97 blog posts and 12 whitepapers globally and spoke at numerous global industry events and forums.

Fox-IT continues to work with various threat intelligence partners and clients, supporting them in the analysis, detection and prevention of sophisticated and organised attacks. In 2016, it published a threat intelligence report about a sophisticated geo-politically aligned hacking campaign originating from Asia against organisations across the globe and was also recognised by SWIFT in a major joint partnership to help combat the cyber security challenges affecting the global financial community.

Significant investment has already been made into the Assurance Division, with management and delivery structures to support the Group's future ambitions. In addition, new offices and relocations this year will provide state of the art facilities and environments for teams to flourish, as well as ensuring the ability to deliver clients' requirements.

The investment in a Security Operations Centre (SOC) in Leeds, is already seeing good returns as will the future developments in Reading, Leatherhead, Edinburgh, Copenhagen, Delft, Chicago and San Francisco. The Group's move to a larger office facility in Manchester is expected to complete in July 2017.

Today, the Group's UK based 24 hour SOC, services over 900 customers and manages over 5,000 devices across 50 countries worldwide. So far this year, 20 billion events were received and processed by the facility across its customer base.

The managed security scanning and monitoring service currently runs over 6,500 (2015: 6,000) application, infrastructure and monitoring scans per month. This equates to monitoring over 130,000 (2015: 100,000) live IP addresses monthly or over six million live and non-live IP addresses annually.

Currently this service is identifying over 500,000 (2015: 320,000) incidents a month, which is a 56% increase from the same time last year.

The integration of Fox-IT is taking place steadily and carefully due to the size and the complexity of the business. A new managing director and finance director have been appointed which will greatly assist with this process. The benefits of mutual cooperation and shared opportunities in new markets are already being seen.

The high assurance unit, which represents approximately 35% of Fox-IT revenues in H1, creates, designs, develops, manufactures and implements secure communication products, using advanced cryptology. It is technically very advanced and highly confidential, as well as being difficult to plan for as the contracts are lumpy by their nature.

One of the largest customers of the high assurance unit is the Dutch Government. As anticipated, the Group is in complex and sensitive negotiations with them about the wider Group's engagement given the highly confidential nature of so much of this unit's work.

The impact of these discussions has seen work being deferred but on completion it is expected that future opportunities will come to fruition.

The web monitoring, performance and load testing business continued to see recurring revenue of 85% (November 2015: 90%) as businesses continue to recognise the importance of their website to their business prospects.

Escrow

Escrow continues to underpin the Group's profitability and cash generation. All of the businesses offer substantial margins, a high degree of recurring revenue due to the contract renewal rates, as well as notably strong cash conversion characteristics.

The Escrow Division continued to perform strongly. Revenue grew by 14% (November 2015: 7%) to £18.7m (November 2015: £16.4m). On a constant currency basis revenue growth, would have been 8%.

The Division's recurring revenues through the renewals process will grow to £21.3m this financial year, up from £19.3m.

Escrow EBITDA grew by 14% to £10.6m (November 2015: £9.3m) and operating profits grew by 12% to £10.3m (November 2015: £9.2m).

Escrow UK revenue as expected, grew by 6% (November 2015: 7%) to £12.8m (November 2015: £12.1m) which reflects a good performance against an exceptionally strong performance last year.

In North America, revenue grew sharply by 43% (November 2015: 10%) to £4.0m (November 2015: £2.8m) and in mainland Europe, the smallest part of the Escrow Division, revenue grew by 19% (November 2015: 3%) to £1.9m (November 2015: £1.6m). On a constant currency basis, the growth for the combined overseas entities was 12%.

The underlying termination rate remained at about 11% (November 2015: 11%), with no discernible change in the reasons for termination.

GDPR introduction in 2018: "A right to security is about to begin"

Being breached is a now a way of life, as seen by the hacks that affected Tesco Bank, The National Lottery, Yahoo, TalkTalk and many others. It is a daily occurrence for corporations and individuals alike.

Most breaches go largely unreported but that is about to change.

NCC Group has long championed the right of individuals to know that their data has been stored safely and in a trustworthy way.

The Group believes that organisations should, at a minimum, form a Board level cyber security committee to address and govern how it manages and mitigates cyber risk, to ensure individual's information is protected.

This position has been significantly helped by the confirmation that the UK is to adopt the EU GDPR.

GDPR will come into force across all member states, including the UK, on 25 May 2018.

Any doubts around what would happen post-Brexit were removed by an announcement by the Secretary of State for Culture, Media and Sport, Karen Bradley on 24 October 2016. The UK will opt in.

The reach of the new regulation extends to any organisation providing services and/or goods to individuals within the EU, as well as those monitoring the behaviour of EU citizens.

The main purpose of GDPR is to allow individuals to regain control and ownership of their data, both of which NCC Group has always been passionate about.

GDPR is an extremely tough standard to adopt and the few organisations who have looked at it to date have recognised that there are some significant challenges in the way that they currently store and think about data usage.

This is making compliance time consuming, difficult and also expensive. It is not something that organisations can leave to the last minute to seek to achieve compliance, as it quite often requires processes and protocols to be completely changed.

Consent to process data will only be obtainable through clear and accurate explanations about what precisely is being collected, why it is being collected, where it will be used, shared or stored and for how long.

As importantly, individuals must also be given the right to easily withdraw consent should they change their minds.

Much has been written about the hefty fines that can be imposed for non-compliance but gaining a reputation that an organisation can be trusted with individuals' data will be just as important.

Fines up to 4% of global turnover, albeit capped at £20m, will provide a real incentive to get it right. Contrast this to the fine levied on TalkTalk in 2016 of just £400k.

While much of the new regulation is relevant to the general activities of information security professionals, much is devoted to the security of personal data.

There are two areas of GDPR that will require particular focus 'privacy by design' and 'incident management'. While privacy and security inevitably overlap, there is a clear conflict of interest which means that different individuals will be required in an organisation to assume each role.

Privacy by design means that any new processes or systems processing personal data (or changes to existing processes or systems), must include privacy considerations from the start. This will be achieved, in part, through Data Protection Impact Assessments, which merit their own article in the regulation.

Incident management, as it relates to personal data, includes a 72-hour deadline for notifying the supervisory authority. In certain high-risk circumstances, the requirement is to notify the individuals affected 'without undue delay'.

As well as complying, organisations will be required to demonstrate their compliance. This means any decisions that impact personal data must be consistent, involve the right people and be recorded. Guidelines and company processes must be accessible and easily understood.

NCC Group's Risk Management & Governance team provides a range of data privacy services to help customers gain a holistic view of their state of compliance towards GDPR.

Through awareness workshops, privacy impact assessments, health checks and remediation support, we are actively working with organisations at all levels of maturity as they assess their readiness in advance of 2018.

As if that was not enough of a driver for change, in mid-December, the UK government Cyber Security regulation and incentives review was published.

https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/579442/Cyber_Security_Regulation_and_Incentives_Review.pdf

It concluded that the approach the UK is taking to implement the GDPR "presents an opportunity to incentivise significant improvements in cyber risk management", such as around developing detailed guidance, information security principles and fining structures.

It also stated that "businesses must accept responsibility for their cyber security and ensure that they have the appropriate controls and systems in place to deter and deal with breaches if they do occur".

It concluded that there are a number of non-regulatory interventions to incentivise better cyber risk management, delivered mostly through the National Cyber Security Centre (NCSC).

These include:

o Government efforts to raise awareness on cyber security, including linking cyber security to data protection;

o Using breach reporting data to increase threat understanding and sharing;

o The creation of a regulators' forum to share best practice and ensure consistent messaging;

o NCSC work with the Financial Reporting Council positively to engage Boards around cyber risk understanding, and with the Investment Association to give investors the tools to challenge Boards and

o Potential certification of cyber health checks to complement technical certification.

In NCC Group's view, it is crucial to raise awareness with key stakeholders, so that everyone is aware of the changes required and the amount of work to be planned for.

As the compliance deadline approaches fast, along with the Government looking to drive compliance, the work to prepare businesses should already be well underway.

Many organisations believe that preparing for GDPR sits solely with the IT department and the legal team. It does not. It belongs with the Board.

Principal risks & uncertainties

The Group faces operational risks and uncertainties, which the Directors take all reasonable steps possible to mitigate, however, the Directors recognise that they can never be eliminated completely.

The principal operational risks and uncertainties the Group faces include those in relation to; the failure of information technology in the business, the loss of key management, the recruitment of additional staff to meet the Group's ambitious growth plans; conduct risk which can arise from failing to maintain discipline and meet customer expectations, the protection of critical assets and information against the threat of cyber-crime; the impact of a successful cyber-attack on company reputation, share price and customer confidence; the occurrence of unforeseen difficulties in the integration of current or future acquisitions; changes in the competitive landscape and failing to respond to market trends, investing in new areas that are unsuccessful, the impact of ethical and legal breaches on company reputation, share price and customer confidence and a failure to protect intellectual property.

There are no persons with whom the Company has contractual or other arrangements that are deemed to be essential to the Group. 

Independent Review Report to NCC Group plc

Introduction

We have been engaged by the Company to review the condensed set of financial statements in the half-yearly financial report for the half year period ended 30 November 2016 which comprises the condensed consolidated income statement, the condensed consolidated statement of comprehensive income, the condensed consolidated balance sheet, the condensed consolidated cash flow statement, the condensed consolidated statement of changes in equity and the related explanatory notes. We have read the other information contained in the half-yearly financial report and considered whether it contains any apparent misstatements or material inconsistencies with the information in the condensed set of financial statements.

This report is made solely to the Company in accordance with the terms of our engagement to assist the Company in meeting the requirements of the Disclosure Guidance and Transparency Rules ("the DTR") of the UK's Financial Conduct Authority ("the UK FCA"). Our review has been undertaken so that we might state to the Company those matters we are required to state to it in this report and for no other purpose. To the fullest extent permitted by law, we do not accept or assume responsibility to anyone other than the Company for our review work, for this report, or for the conclusions we have reached.

 Directors' responsibilities

The half-yearly financial report is the responsibility of, and has been approved by, the directors. The directors are responsible for preparing the half-yearly financial report in accordance with the DTR of the UK FCA.

As disclosed in note 1 the, annual financial statements of the group are prepared in accordance with IFRSs as adopted by the EU. The condensed set of financial statements included in this half-yearly financial report has been prepared in accordance with IAS 34 Interim Financial Reporting as adopted by the EU.

 Our responsibility

Our responsibility is to express to the Company a conclusion on the condensed set of financial statements in the half-yearly financial report based on our review.

 Scope of review

We conducted our review in accordance with International Standard on Review Engagements (UK and Ireland) 2410 Review of Interim Financial Information Performed by the Independent Auditor of the Entity issued by the Auditing Practices Board for use in the UK. A review of interim financial information consists of making enquiries, primarily of persons responsible for financial and accounting matters, and applying analytical and other review procedures. A review is substantially less in scope than an audit conducted in accordance with International Standards on Auditing (UK and Ireland) and consequently does not enable us to obtain assurance that we would become aware of all significant matters that might be identified in an audit. Accordingly, we do not express an audit opinion.

Conclusion

Based on our review, nothing has come to our attention that causes us to believe that the condensed set of financial statements in the half-yearly financial report for the half year period ended 30 November 2016 is not prepared, in all material respects, in accordance with IAS 34 as adopted by the EU and the DTR of the UK FCA.

Stuart Burdass for and on behalf of KPMG LLP

Chartered Accountants

1 St Peter's Square, Manchester, M2 3AE

19 January 2017

Group condensed statement of financial position

Group condensed statement of cash flows

Group condensed statement of changes in equity

Notes to the Half Year Report

1 Accounting policies

Basis of preparation

The Group condensed half-year financial statements for the six months ended 30 November 2016 have been prepared in accordance with IAS 34, "Interim Financial Reporting" as adopted by the EU.

As required by the Disclosure Guidance and Transparency Rules of the Financial Services Authority the financial information contained in this report has been prepared using the accounting policies and presentation that were applied in the company's published consolidated financial statements for the year ended 31 May 2016. They do not contain all the information required for full annual financial statements and should be read in conjunction with the annual financial statements for the year ended 31 May 2016.

The financial statements of the Group for the year ended 31 May 2016 are available from the Company's registered office, or from the website www.nccgroup.trust.

The comparative figures for the financial year ended 31 May 2016 are not the company's statutory accounts for that financial year. Those accounts, which were prepared under IFRS as adopted by the EU ("adopted IFRS"), have been reported on by the company's auditors and delivered to the registrar of Companies. The report of the auditors was (i) unqualified, (ii) did not include a reference to any matters to which the auditors drew attention by way of emphasis without qualifying their report, and (iii) did not contain a statement under section 498(2) or (3) of the Companies Act 2006.

NCC Group plc ("the Company") is a company incorporated in the UK.

Significant accounting policies

As required by the Disclosure Guidance and Transparency Rules of the United Kingdom's Financial Conduct Authority, this condensed set of financial statements has been prepared applying the same accounting policies and computation methods that were applied in the preparation of the company's published consolidated financial statements for the year ended 31 May 2016.

There are no IFRS or IFRIC interpretations effective for the first time in this financial period which are relevant that have had a material impact on the Group.

Going concern

The Group's activities, together with the factors likely to affect its future development, performance and position are set out in the financial and operational reviews.

The directors have reviewed the trading and cash flow forecasts as part of their going concern assessment, together with the available facilities at 30 November 2016, (see note 11), including reasonable downside sensitivities which take into account the uncertainties in the current operating environment.

Taking into account the above uncertainties and circumstances, the directors formed a judgement that there is a reasonable expectation that the group has adequate resources to continue in operational existence for the foreseeable future. Accordingly they continue to adopt the going concern basis in preparing the group's condensed half-year financial statements for the period ended 30 November 2016.

Use of estimates and judgements

The preparation of the consolidated half-year financial statements in conformity with IFRSs requires management to make judgements, estimates and assumptions that affect the application of accounting policies and the reported amounts of assets, liabilities, income and expenses. Actual results may differ from these estimates.

In preparing the consolidated half-year financial statements, the significant judgements made by management in applying the Group's accounting policies and key sources of estimated uncertainty were the same as those applied to the consolidated financial statements for the year ended 31 May 2016.

2 Segmental information

The Group is organised into three operating segments (30 November 2015: three): Escrow, Assurance and Domain Services each of which is separately reported.

Whilst revenue and profitability are monitored by individual business units within these operational segments it is only at the operating level that resource allocation decisions are made.

Performance is measured based on segment profit, which comprises segment operating profit excluding amortisation of acquired intangible assets, share based payment charges and exceptional items. Interest and tax are not allocated to business segments and there are no intra-segment sales.

The Group's revenue has always been biased towards the second half of the financial year. This is expected to continue this year.

The table below provides an analysis of the Group's revenue by geographical market where the customer is based.

3 Exceptional items

The Group identifies separately items as "exceptional". These are items which in the management's judgement, need to be disclosed by virtue of their size or incidence in order for the user to obtain a proper understanding of the financial information.

Acquisition related costs in the period of £637,000 (November 2015: £2,583,000) consist of fees incurred in relation to the acquisitions of Payment Software Company Inc on 28 September 2016 and Virtual Security Research LLC on 11 November 2016 (note 12). In the prior periods, the costs relate to fees incurred in relation to the acquisition of Fox-IT Holdings BV.

The adjustments to deferred and contingent consideration of £2,570,000 (November 2015: £2,992,000) relate to foreign exchange revaluation differences on the carrying value of consideration liabilities and the associated loan held in foreign currency. In the prior periods, the net gains principally relate to the re-assessment of the Open Registry contingent consideration.

The £188,000 loss made during the wind down and sale of Domain Services represents the operating loss generated by this business in the six months to November 2016.

The restructuring cost of £38,000 (November 2015: £497,000) relates to retention bonuses paid to former employees of Accumuli plc. As previously reported NCC Group became responsible for paying these bonuses on acquisition of the Accumuli group. In the year to 31 May 2016, restructuring costs also included headcount and other costs associated with the wind down of the Domain Services division.

In the periods to November 2015 and May 2016, the intangible asset write down of £4,086,000 and £6,858,000 respectively relates to the impairment of capitalised costs for redundant technology and the goodwill impairment of £11,877,000 relates to Open Registry.

4 Taxation

The Group tax charge is based on the estimated annual effective rate and for the half year is calculated at 26% (30 November 2015: 20%) and applied to the profit before tax for the period.

5 Earnings per share

The calculation of earnings per share is based on the following:

6 Dividends

7 Intangible assets

The Group acquired Payment Software Company Inc on 28 September 2016 and Virtual Security Research LLC on 11 November 2016. The goodwill and acquired intangibles in respect of both acquisitions included above are provisional values and will be confirmed in the 31 May 2017 Annual Report (Note 12).

The reclassification of costs relates to internal development costs associated with systems development which the directors consider is more appropriate to report as capitalised development costs rather than software.

8 Capital expenditure

Additions to plant and equipment during the period ended 30 November 2016 amounted to £4,001,000 (November 2015: £1,132,000) and depreciation charged in the period amounted to £2,513,000 (November 2015: £1,569,000).

9 Trade and other receivables

10 Trade and other payables

11 Interest bearing loans

The Group has a multi-currency revolving credit facility of £80m (November 2015: £80m), a £27.5m multi-currency term loan (30 November 2015: £30m) and an overdraft facility of £5m (November 2015: £5m). The effective interest payable on drawn down funds as at 30 November 2016 was 0.9% above LIBOR (2015: 2.0%).

12 Acquisitions

Payment Software Company Inc

NCC Group Inc acquired Payment Software Company Inc, a company based in California, USA, on 28 September 2016. PSC is a global payment and security consulting company, providing services to organisations that require specialist compliance, forensics and consulting support.

The consideration paid was $16.6m initial cash consideration with contingent consideration payments of $1.9m due on earn-out periods to 31 December 2017 and 31 December 2018. The two contingent payments are payable in cash on the achievement of specific profit based performance targets.

The goodwill of £10.4m represents the benefits expected to be generated from sales and profit growth from the wider NCC Group customer base in the US market. The goodwill is not expected to be deductible for tax purposes. Acquisition costs relating to professional fees totalling £0.4m were incurred and are recognised as exceptional costs in the income statement (note 3). The Group's consolidated income statement includes two month's post acquisition trading, with PSC Inc contributing £1.6m revenue and £0.4m operating profit.

Virtual Security Research LLC

NCC Group Inc acquired Virtual Security Research LLC, a company based in Boston, Massachusetts, USA, on 11 November 2016. VSR is an information, network and application security consulting company based in Boston, Massachusetts providing services to corporate clients of varying sizes primarily in the US Technology and Financial Services sectors.

The consideration paid was $3.7m initial cash consideration with contingent consideration payments of $0.9m due on earn out periods to 31 December 2017 and 31 December 2018. The two contingent payments are payable in cash on the achievement of specific profit based performance targets.