Ocado Regulatory News (OCDO)

Market proposition (OSP & OIA)

Partner success (OSP)

What is the risk? Our OSP and OIA product offer, features, implementation schedule, pricing or terms may not be sufficiently attractive to potential partners or may not be commercially attractive to them at a level that delivers adequate and sustainable returns for us.

What is the risk? We invest in robots and MHE alongside our partners in the CFCs that we develop for them and we rely on the growth of our partners' online businesses to generate appropriate economic returns from this investment. If our partners do not achieve sustainable returns from their investment then they may not expand their utilisation of the capacity that we have jointly invested in, in which case we may fail to generate our planned returns. It is also possible that if our partners are unable to generate acceptable returns themselves they may close existing CFC facilities.

Key risks

? Commercial viability both for us and our partners

? Our pricing is not competitive

? The functionality of our products is not sufficiently attractive

? We fail to market our products professionally

? Competitive environment

Key risks

? Partners may be unable to generate sufficient demand to fill the capacity of the CFCs in which they have invested

? Partners may be unable to operate their online grocery businesses efficiently enough to generate the planned returns, including the ability to generate density in last mile operations

? The strategies that our partners adopt may compromise their ability to generate viable ecommerce businesses

Risk owner John Martin, Mark Richardson

Risk owner John Martin

Movement - no change

Movement - increasing

Link to strategy - Grow our revenue; Optimise OSP Economics; Embed a responsible business approach

Link to strategy - Grow our revenue; Optimise OSP economics; Deliver transformational technology; Drive success for our partners

Responsible business - Environment and natural resources;

Platform resilience and innovation

Responsible business - n/a

How we manage this risk

? Our regional and commercial teams undertake quarterly pricing reviews, review market pricing and seek price disclosure from prospective partners to ensure that we remain competitive.

? We analyse prospective partner profitability to ensure that our products can deliver benefits to both ourselves and our partners. Ocado is in the position of running a large scale operation of our own using the same products that we are selling to our clients, which provides us with a unique and valuable perspective of the value that our products bring.

? We constantly develop our products to reduce their costs in order to maximise market appeal and commercial viability.

? We review the features and functionality that our solutions provide, and discuss this with potential clients and partners to understand how well our solutions fulfil their needs and determine whether it is appropriate to develop specific features that our prospective partners require.

? We invest substantially in product teams to develop our technology roadmaps to ensure that our products are as relevant as possible and cost effective to our current and prospective partners.

? We invest significant sums in the development of our products to ensure that they remain leading-edge.

? We assess the potential for new business in each of our three international regions.

? In 2023 we launched OIA to deploy our product to a new market segment.

? Our Board approves all material new deals.

How we manage this risk

? We have established and expanded our Partner Success teams with the sole aim of supporting our partners in the profitable growth of their online businesses. The Partner Success teams include specialists in ecommerce, marketing, retail media, retention, operations, last mile and solutions.

? We review and benchmark partner performance at least monthly to identify areas for improvement which we discuss with our partners.

? We review our technology roadmap with our partners to identify specific, relevant features that we can develop to support their growth and profitability.

? We develop training and development materials and best-practice information which we share with our partners.

? We appoint dedicated account management and development teams to support professional account management and partner success. These teams are encouraged to locate either on or close to partner sites.

Product innovation, protection & performance (OSP & OIA)

Supply chain

What is the risk? Our innovation and development processes may not meet partner needs, or we may fail to provide protected, reliable and commercially viable products. This could undermine our ability to attract and retain partners.

What is the risk? Disruption in our extended and complex supply chain may adversely affect product availability and responsible sourcing. This could result in increased costs and fines, delays to contractual commitments and loss of revenue.

Key risks

? Product strategy and roadmap

? Disruptive technologies are not adopted and invested in early enough, e.g. AI

? IP infringement and lack of protection

? Insufficiently sustainable design

? Insufficient product quality and performance

? Site implementation timeframes

Key risks

? Contract performance and forecasting demand

? Regulation and responsible sourcing (natural resources)

? Supplier dependencies

Risk owner James Matthews, Neill Abrams

Risk owner James Matthews

Movement - no change

Movement - no change

Link to Strategy - Optimise OSP economics; Deliver transformational technology; Embed a responsible business approach

Link to Strategy - Grow our revenue; Optimise OSP economics; Deliver transformational technology; Drive success for our partners; Embed a responsible business approach

Link to ESG - Our people and skills for the future; Environment and natural resources; Platform resilience and innovation

Link to ESG - Our people and skills for the future; Environment and natural resources; Platform resilience and innovation

How we manage this risk

? The Technology Solutions Committee and Risk Committee provide overarching governance.

? Our design development (or engineering) teams undertake quarterly product planning meetings within each stream that are presented to the Executive Committee for oversight and approval.

? Our research teams continually monitor the market and actively participate in funded research with academic institutions, and we are currently involved in three parallel Horizon projects where Ocado Technology is funded to undertake state of the art research.

? Our IP team conducts freedom to operate searches and IP filing monitoring.

? Our specialist patent attorneys work with product developer teams to ensure we protect not just the systems we build but also the other ideas and concepts that are generated during the innovation and development lifecycle. For example, in 2023 we had a successful outcome in the AutoStore litigation.

? Innovation development lifecycle including: ideation sessions with IP; mergers and acquisitions strategy; integration of AI into our systems; and partner conferences to demonstrate our latest technology innovations. For example at our Beyond Conference we presented the latest iteration of the OGRP system.

? Our "Build Right, Run Right" initiative embeds product industrialisation within the development lifecycle for our ASRS product to meet the needs of our OIA client base.

How we manage this risk

? Improved internal forecasting of product demand and client requirements in 2023 has helped better manage Ocado's requirements.

? Governance is provided by the Sales and Operations Planning executive review meetings.

? Management KPI reporting packs are reviewed to align supply and demand.

? We are embedding strategic sourcing and supplier relationship management into the business.

? Supplier assessments, due diligence and site audits are undertaken during the product development process.

? We are deploying materials resource planning across new categories which helps manage the areas of higher global supply chain volatility.

? The Responsible Sourcing Working Group monitors multiple work streams and reports to the ESG Committee.

? Combining the above capability we are now better able to review our supply chain suitability, developing deeper strategic relationships and systematically aligning scale of supply with demand to maintain confidence in our delivery. In addition, our enhancements in our people capability, systems, data and root cause analysis allow us to provide greater insight to the business to underpin strategic decision-making.

Talent & capability

Cybersecurity & data

What is the risk? Difficulty in filling key positions, a loss of top performers and an inability to embed diversity could undermine business operations and growth plans.

What is the risk? The disruption or loss of critical assets and sensitive information as a result of a cyber attack, insider threat or a data breach within our Group network or our supply chain could result in business interruption, reputational damage or regulatory impacts, for both Ocado and our partners.

Key risks

? Retention and rewards

? Attraction

? Training and development

? Diversity and inclusion

? Succession planning

? Culture and wellbeing

? Organisational structure

Key risks

? Deliberate destruction of systems

? Commercial data loss

? Third party compromise

? Infrastructure outage

? Personal data loss

Risk owner Claire Ainscough

Risk owner James Matthews

Movement - no change

Movement - increasing

Link to Strategy - Deliver transformational technology; Drive success for our partners; Embed a responsible business approach

Link to Strategy - Deliver transformational technology; Embed a responsible business approach

Link to ESG - Our people and skills for the future; Platform resilience and innovation

Link to ESG - Platform resilience and innovation

How we manage this risk

? We launched new Technology Solutions values and measured these in our regular employee survey.

? We also have very transparent communication processes (e.g. open Q&A tools and Slack) and we prioritise our goals process to ensure it is highly aligned between our commercial and technical teams.

? We continue to work with our employees to create lifestyle policies to support our culture and launched Fertility and Menopause community groups.

? Governance is provided by the Risk Committee and People Committee.

? We conduct periodic reviews of remuneration and incentive plans to align with market trends and internal and external fairness.

? We continue to undertake employee surveys to analyse opinions and engagement levels.

? We launched a talent and performance framework to help us differentiate, develop and deploy the talent we have, supporting future business growth and high performance.

? We launched two new learning platforms, LinkedIn Learning and Learnerbly, to better support our people in developing the skills they need to grow their careers.

? We have invested in developing management capabilities by launching a signature programme focused on critical practices for leading a team, including creating a feedback culture.

? We have launched DE&I and wellbeing learning programmes to build awareness of unconscious bias and how to create an inclusive culture with practical tools, guidance and resources.

How we manage this risk

? Our security strategy defines priorities and is agreed with the Ocado Board.

? Regular governance and oversight of our security programme is provided by the Information Security Committee.

? Our Information Security function is led by our Chief Information Security Officer who is responsible for the management of our security strategy, the security programme and security risks.

? Our dedicated Security Operations team, supported by a 24/7 specialist security partner, detects and responds to security incidents.

? We regularly test our cyber incident response plan, including annual cyber simulations for the Executive Committee.

? We have developed secure build standards for our core IT assets.

? Security patching is in place for our core IT assets and is measured each month.

? Regular penetration testing is carried out for the Ocado Platform.

? Our zero trust solution provides employees with secure access to Ocado's systems.

? Each year the security controls environment for the Ocado Platform is externally audited as part of our SOC2 certification.

? The Ocado Platform is PCI compliant and is externally audited every year. No payment card data is processed directly by the Ocado Platform.

? Cyber insurance is in place to reduce the cost impact of a major cyber incident.

? Immutable backups have been set up to help protect the Ocado Platform from deliberate destruction.

? Our Data Protection Officer oversees the Group's privacy compliance programme.

Fire & safety

Regulatory & compliance

What is the risk? Fire, or injury to a worker or customer, caused by product design or operating failures could result in business disruption, loss of assets and reputational loss.

What is the risk? Failure to comply with local and international regulations could lead to loss of trust, penalties and personal liability for our employees, and undermine our ability to operate.

Key risks

? Fire safety

? Product safety

? Food safety

? People safety (construction, operation and logistics)

Key risks

? Statutory compliance across jurisdictions of operation

? Fraud, bribery, sanctions and industry specific compliance

? New geographies

? Accelerating pace of global regulatory change (mandatory climate-related disclosures, and wider sustainability reporting and supply chain requirements)

? Governance

Risk owner James Matthews

Risk owner Neill Abrams

Movement - no change

Movement - increasing

Link to Strategy - Drive success for our partners; Embed a responsible business approach

Link to Strategy - Embed a responsible business approach

Link to ESG - Our people and skills for the future; Platform resilience and innovation

Link to ESG - Platform resilience and innovation

How we manage this risk

? Our governance programme is overseen by the Safety Committee.

? Our team of technical experts monitors and audits compliance against regulations, policies and procedures in safety areas including food, product, occupational health, fire and construction.

? We deploy training and carry out risk and safe systems of work assessments to raise awareness and knowledge.

? We monitor regulatory change, leveraging third-party expert advice to introduce appropriate mitigations.

? This year we continued our programme of fire insight days for local authorities; and introduced an expert third-party Fire Risk Assessment programme for UK premises. This is supplemented by our annual programme of risk engineering surveys.

? Following the Andover CFC fire, we started to investigate fire retardant tote designs. The activity involved lengthy investigations supported by FM Global and its fire research campus. This has resulted in the current metal tote design which is anticipated to significantly reduce our fire risk These are currently being deployed at significant cost across our global footprint.

How we manage this risk

? Governance is provided by the Risk Committee.

? Co-ordinated by the Regulatory & Compliance team, the business tracks global regulatory changes, leveraging third-party advice as needed to inform our actions and respond to new requirements. The business has had to respond rapidly in 2023 to minimise disruption to our operations and supply chain and ensure we operate in a compliant manner with the dynamic changes to sanctions and export control laws in particular.

? In 2023 our global regulations tracking process broadened to encompass wider ESG requirements and was aimed at supporting the business to prepare to meet multiple new non-financial reporting requirements.

? Our Due Diligence and Territory Research teams conduct extensive research and engage specialist advice to understand local market regulatory issues when exploring new territories and new partners to ensure we understand and fully cost the potential risks.

? We have deployed and continue to develop a compliance framework of policies and procedures underpinned by employee training, guidance and tailored awareness campaigns, refreshing policies where needed to reflect evolving standards, including updating our Human Rights Policy, and we are also implementing a new Sanctions and Export Control Policy.

? We conduct periodic risk assessments on core compliance topics to ensure that we identify and close gaps arising from organisational change and evolving standards. This year we refreshed our anti-bribery risk assessment and next year we will focus on our fraud risk assessment to account for new legislation on this topic.

Climate, environment & geopolitical

Liquidity & cash management

What is the risk? Transformation pressures and adverse external events could increase cost, disrupt our supply chain and operations, and the demand for our product.

What is the risk? Insufficient liquidity (cash balances plus undrawn facilities) to deliver our business goals and/or settle our liabilities.

Key risks

? Internal combustion engine vehicles ban

? Energy usage

? Natural resources

? Net Zero Challenge

? Extreme weather

? War, conflict and sanctions

? Civil unrest and activism

? Societal disruption (pandemic, cost of living)

Key risks

? Inability to access the capital markets to refinance our debt as it approaches maturity

? Inability to extend or access our RCF including due to failure to comply with its financial covenants

? Deterioration in financial performance (profitability and cash flow generation) that causes refinancing of existing debt to become difficult

? Poor cash management forecasting processes leading to unanticipated shortfalls in liquidity which compromise our ability to meet our commitments

Risk owner Stephen Daintith, Neill Abrams

Risk owner Stephen Daintith

Movement - no change

Movement - no change

Link to Strategy - Grow our revenue; Optimise OSP economics; Deliver transformational technology; Drive success for our partners; Embed a responsible business approach

Link to Strategy - Embed a responsible business approach

Link to ESG - Our people and skills for the future; Environment and natural resources; Platform resilience and innovation

Link to ESG - Platform resilience and innovation

How we manage this risk

? Governance is provided by our ESG Committee and Risk Committee, with other relevant forums such as our Environmental Sustainability Compliance and Reporting Working Group co-ordinating environmental sustainability risk, compliance and reporting activities.

? We are involved in several vehicle manufacturer engagement programmes to aid the development of zero-emission vehicle alternatives.

? We use various energy supply monitoring and diversification initiatives, including the use of an anaerobic digester.

? Our MHE stock levels provide resilience in construction and operation.

? Our global client footprint provides resilience from local shocks.

? We conduct risk assessments prior to entering new geographical markets or undertaking new ventures.

? We maintain financial and physical reserves to cushion any operational impact.

? This year we engaged external experts to support our physical climate risk assessment using third-party scenario-based data.

? In 2023 we formally established our Net Zero programme.

How we manage this risk

? We ensure that we carry out our refinancing activities well in advance of our maturity dates.

? We monitor the capital markets carefully and, with the assistance of our advisors, assess the accessibility of the capital markets on a regular basis (at least monthly).

? We prepare robust five-year cash flow forecasts (which are updated annually and are tested on a regular basis for their integrity).

? We have also prepared a five-year cash flow forecast that includes various downside scenarios and used this to determine future cash requirements, liquidity levels and covenant compliance metrics under these scenarios.

? The five-year cash flow forecasts include all investment plans. These are reviewed by the Board (subject to materiality tests) and approved only after meeting strict return requirements.

? Over the course of the year we have enhanced our cash flow forecasts to include quarterly compliance with financial covenants. This helps us assess our ability to access the RCF on a quarter-by-quarter basis. This gives us further comfort in our testing of sufficient liquidity headroom.

? We engage regularly with our relationship banking group to maintain the strong relations that we have with them. We also ensure that they are well informed of our cash flows and liquidity.

? We have recently appointed a new Head of Capital Markets to work alongside the CFO and the Group FD to maintain these strong working relationships with our relationship banks.

? We continue to monitor the capital markets and our refinancing strategy and update the Board on these matters at each Board meeting. These Board discussions will also include a review of the optimal time to carry out any refinancing activities.

Ocado Group plc

Group General Counsel & Company Secretary

Neill Abrams

email: company.secretary@ocadogroup.com

Head of Investor Relations Chandler Benet

+44 1707 228 000

investor.relations@ocadogroup.com