TALK.L Regulatory News (TALK)

The COVID-19 pandemic is having wide-ranging impacts on the worldwide economy and could impact the Group's employees, operations, suppliers and customers, through lockdowns, disrupted supply chains, social distancing measures and wider impacts on the UK economy.

Further detail on the implications to the Group are provided in the Chief Executive Officer's review on pages 5-8.

Potential COVID-19 impacts:

• Continuing strong demand for the Group's services, but potential for a reduction in revenue/margin given the wider UK economic impacts;

• Lower new customer connections, but also lower customer churn;

• Adverse impact on trading cash generation;

• Financial and operational constraints could impact the delivery of change;

• Increase in bad debts, especially with small to medium enterprises due to financial distress;

• Reduction in operating costs primarily due to non-availability of third party customer service providers and changes to marketing activity; and

• An increase in volume and scale of financially motivated cyber attacks.

• Three governance workstreams have been set up to manage our overall COVID-19 response, led by members of our Executive Committee;

• Measures have been implemented to ensure the health and safety of our workforce and customers whilst we continue our provision of critical services;

• We continue to focus on our network resilience, constantly monitoring our network to forecast and respond to the ongoing demand, maintaining stability and minimising any congestion;

• The service of our vulnerable customers has been prioritised and our digital service channels have been enhanced for all customers;

• The change delivery plan is being closely reviewed and monitored by the Executive Committee to manage any COVID-19 impacts;

• We have worked closely with our supply chain to ensure we have adequate inventory coverage for our operations;

• Our well established information security controls have been enhanced and our Security Operations Centre has reduced the thresholds of existing monitoring; and

• We continue to closely monitor and forecast the financial impacts of COVID-19 to identify and manage any further risks and opportunities.

Customer confidence and trust are critical to TalkTalk's business, and the Group's operating approach always seeks to do what is right for the customer. However, as a value for money connectivity provider in the market, there is a risk that TalkTalk is perceived as a 'budget' provider, associated with price rather than quality and service.

Business and industry challenges including cyber threats, scam calls or poor customer experience also present a risk to brand reputation and trust.

Damage to customer trust and our reputation could materially adversely impact our business, attracting new customer, churn, operations and financial condition.

TalkTalk remains confident of the role for a well-regarded value operator in the market and is committed to improving the end-to-end customer experience across all touchpoints.

TalkTalk introduced their Fixed Low Price Plans (FLPP) in 2016 which continue to resonate strongly with customers and combined with the ongoing transformation of customer services, the Group has maintained the core business during the year with further attractive customer offerings. The organisation also continues to invest in the network and systems to support the provision of reliable products to customers as well as ongoing investment in and focus on security (see Data and Cyber Security Risk). These factors have contributed to a stable risk landscape with steady customer confidence and improving customer satisfaction. In addition, TalkTalk continues to support customers in dealing with the industry-wide issue of scam calls. Initiatives such as the 'Beat the Scammers' campaign and Call Safe which are designed to help customers protect themselves from the threat of scams. TalkTalk has also signed up to the Ofcom fairness charter which focuses on price transparency and supporting vulnerable customers.

TalkTalk will continue to focus on existing as well as new customers, guided by the four key principles we believe are critical to being a value for money connectivity provider - simplicity, affordability, reliability and fairness.

TalkTalk is established as a value for money connectivity provider in a highly competitive market.

Over the last year, significant competitor activity has continued from both existing and new entrants to the market. The future acceleration of FTTP rollout may also drive more new entrants to the market which will further increase the competitive landscape.

However, at present, the competitive activity remains largely unchanged with varying degrees of activity in most product channels. Therefore, the risk that this competitive backdrop makes it difficult for TalkTalk to maintain its value position differentiation remains consistent with prior year.

A clear pricing and promotional strategy is in place with ongoing monitoring of our pricing position and value proposition. The strategy is reviewed to ensure it remains competitive and continues to support our position as a value for money provider against the changing competitor activity landscape. TalkTalk Fixed Low Price Plans (FLPP) continue to see strong customer take-up and TalkTalk has outperformed the market on Fibre and Ethernet growth, which is expected to continue in the new financial year and further attractive customer offerings are planned. FLPP offers both new and existing customers the opportunity to lock in their price for the term of their contract guaranteeing no mid-contract price rises. The introduction of the new industry leading Wi-Fi Hub in 2018 is still driving great improvements in the customer experience and the Great Connection Guarantee gives new customers confidence in switching to TalkTalk as they can leave within 30 days if they are not happy with their new Fibre connection.

In addition, competitor pricing activity continues to be monitored to understand customer and market impact and plans are revisited accordingly if necessary. TalkTalk uses customer communications to promote our simple, affordable, reliable and fair message and is committed to helping customers understand the best positioned package to meet their needs.

TalkTalk recognises employees as a key asset and aspires to be a 'Great Place to Work' for all colleagues. We understand the increasing challenges and importance in the market of defining an effective operating model and attracting and retaining the right talent to deliver organisational performance and future growth aspirations.

Throughout the year, the vast majority of our London roles were successfully moved to a single main campus in the current Salford site to reduce operational complexity and deliver a more efficient focused business.

The main focus continues to be attracting and retaining the required talent and competencies in a competitive local employment environment. Failure to do so may negatively impact our ability to deliver on performance targets and strategic objectives.

COVID-19 has resulted in nearly all our workforce working remotely which could lead to business continuity, health and safety issues.

TalkTalk has established values which act as a cultural framework and are embedded through the business in recruitment and performance management processes.

Structured talent forecasting and assessment processes are in place to ensure required talent is proactively understood and actions plans are in place to actively manage attrition risks and succession. These processes also ensure a proactive review of the senior management level to ensure the right leadership is in place for motivating, inspiring and leading the workforce to deliver on the corporate objectives.

A people scorecard is in place for ongoing monitoring and oversight of people risk and, where required, actions to further mitigate risk exposures are identified and implemented. In addition, Group-wide activities are carried out to assess the level of employee engagement and insight gained is used to develop action plans to ensure a highly engaged and motivated workforce is maintained.

Due to COVID-19, further measures have been implemented to ensure the health and safety of our workforce and customers whilst we continue our provision of critical services. A specific charter is in place which, along with enhanced technical capabilities, has enabled nearly all of our workforce to successfully work from home. We are closely monitoring any potential impacts on our workforce through regular surveys with specific questions around our COVID-19 response.

Although the gross risk has been reduced as we successfully completed the relocation of London roles to our main Salford campus this is offset by the new COVID-19 risks.

The Government and Ofcom are committed to promoting investment in Full Fibre networks through infrastructure competition in the UK telecommunications market.

Government has sought to incentivise network competition, through the Future of Telecoms Infrastructure Review (FTIR), which included a range of measures to designed to make it quicker, simpler and cheaper for a range of companies to build Full Fibre networks. The FTIR complemented existing Government policy, including the Local Full Fibre Networks Programme and the work of Government's Barrier Busting Unit.

Since then, alternative networks have secured significant investment and have extensive FTTP build ambitions, primarily across urban areas in the UK.

The Conservative Party made a manifesto commitment to speed up nationwide gigabit capable networks, with a target date of 2025. We expect to see further details for a plan to subside rural network build in the coming months, with £5bn of funding available.

In light of Government's ambitions, Ofcom has proposed a considerably different regulatory structure for the next review period than the one which has been in place in the last decade, with prices set above costs in urban areas to encourage FTTP build by altnets, and a process of cross-subsidy proposed in rural areas to support Openreach FTTP rollout. These proposals, which are due to come into effect from April 2021, are currently under consultation.

TalkTalk continues to be a vocal advocate of competition and is well placed to benefit from an increasing trend towards a more pro-competition regulatory framework. This poses a risk to incumbent players in the market, whilst presenting potentially valuable opportunities for challengers. The business is actively engaging with the necessary external stakeholders, particularly Ofcom and Government, to share views and attempt to deliver the best market and customer outcomes, as well as to proactively understand and respond to the opportunities and challenges presented by structural market changes.

TalkTalk is well placed to benefit from the transition to Full Fibre networks. We are actively engaged with Openreach on product and service developments, including FTTP roll-out plans, in order to pursue favourable outcomes for TalkTalk. TalkTalk signed a wholesale agreement with CityFibre to connect customers onto their network in their roll-out areas at a competitive price. This agreement demonstrates how TalkTalk can benefit from increased network competition. We continue to discuss potential commercial arrangements with other FTTP network owners.

TalkTalk is currently engaging with Ofcom on its Wholesale Fixed Telecoms Market Review proposals, and will respond in due course to these proposals in order to attempt to achieve the most appropriate outcomes from the review.

The telecommunications sector is highly regulated, with compliance over key customer-focused regulations monitored by the governing body, Ofcom. Another of the key governing bodies relevant to the Company is the Information Commissioner's Office (ICO). The regulations and laws that TalkTalk must comply with, including Ofcom General Conditions and data legislation, are designed to support customers.

Although previous regulatory change risks around addressing the General Data Protection Regulation (GDPR) and the automatic compensation scheme have reduced year on year, the need to implement the enhanced consumer protection requirements in the European Electronic Communications Code leads to a stable overall risk assessment.

Failure to comply with regulatory obligations may result in negative customer impact and/or significant regulatory fines.

The Group's Regulatory Compliance Committee, a subcommittee of the Board, has continued to convene throughout the year to monitor the mitigation of operational risks which could give rise to customer complaints and regulatory breaches. The Group Legal Counsel and Company Secretary has chaired weekly compliance meetings throughout the year, attended by senior management.

There are clear lines of accountability both in first-line operations and in our second-line assurance function and there has been continued focus on embedding processes and controls to maintain compliance to industry regulations including focus on delivering improvements in our complaint handling processes and reducing complaint volumes.

Plans are also in place to deliver further regulatory changes which come into force over the next twelve months to eighteen months.

TalkTalk has established structured programmes to deliver changes resulting from Ofcom's end-to-end review of its General Conditions. The progress of this activity will be governed by the existing Compliance Committee to ensure effective delivery.

Security of customer, commercial and colleague data poses increasing reputational and financial risk to all businesses and the gross risk remains high. In particular, cyber and data related threats and crime is consistent with prior years but this year we note an increased risk around key third party vendors that presents a significant challenge in terms of securing data and systems against attack.

TalkTalk receives most of its revenue through card transactions and like many businesses utilises third parties as part of doing business. TalkTalk recognises that failure to successfully secure data and systems against attack may have a material impact on brand reputation and financial performance. Other associated costs may also be incurred, including potential regulatory fines.

COVID-19 could see an increase in volume and scale of financially motivated cyber attacks.

TalkTalk has continued to invest in and focus on actively implementing an ongoing programme to build and mature its security capability, including to address the increasing risks around key third party vendors. Investment is also planned to continue in the new financial year and beyond leveraging an updated Security Strategy centred around five focus areas:

• Governance, Risk and Compliance;

• Protective Controls;

• Vulnerability & Patch Management;

• Visibility & Response Capabilities; and

• Network Resilience.

The strategy is underpinned by the widely adopted NIST Cyber Security Framework and is leveraged to continuously improve the security maturity of the organisation. This includes an annual security maturity controls assessment by an independent third party to validate the controls that we've implemented and to provide recommendations on the security roadmap to help us prioritise our work.

Over the last four years significant investment has been made in building out a bigger security function and capability including successfully establishing an in-house 24x7 Security Operations Centre, which launched late 2017. During subsequent years, further projects were delivered to improve and mature our security control environment and capabilities. These activities and investments are supporting continuous improvement of security and the management of security threats and risks

In addition, a robust governance structure remains in place with a PLC Security Committee meeting every two months. This is a subcommittee of the Board, chaired by a Non-Executive Board member, with the CEO and other senior executive representation. Furthermore, there is a monthly Security Committee that is made up of senior management across all of key areas of the business to discuss the latest security threats and risks, approve changes and manage exceptions to security policies, and ensure that security projects are managed effectively.

In response to COVID-19, we have enhanced our well established information security controls and our Security Operations Centre has reduced the thresholds of existing monitoring.

TalkTalk is reliant on its infrastructure as well as key third party suppliers and partners in order to deliver quality products and services to its customers. Network, system or third party failure could result in significant disruption to services or business processes, which may have a negative impact on customers and therefore damage customer loyalty or result in complaints. It is therefore important to establish resilience in the network, systems and also require resilience from our third parties and partners.

The approach adopted for supporting infrastructure and associated resilience, including use of third parties, is regularly reviewed to ensure an optimal model is maintained which drives resilience and efficiency. There is a risk that changes to approach may not be delivered effectively resulting in negative impact to operations.

It is also noted that in the event of an incident, TalkTalk must be able to respond in an efficient and effective manner in order to minimise impact on customers and performance.

Due to COVID-19, there has been a significant uplift in daytime data and voice traffic, although peak traffic is still within usual demand. There is also an increased risk of business continuity issues due to our workforce working remotely.

Network resilience is assessed and monitored on a regular basis and again, over the last year, TalkTalk has continued to deliver network analysis, improvements and simplification at pace supporting greater resilience. Continuous monitoring of network availability is also in place to ensure any issues are identified in a timely manner and resilience testing takes place. Where an incident does occur, a robust incident response process is in place and exercised to ensure effective response, followed by a problem management review that is linked to service improvement. The Group recognises that network resilience is also reliant on Openreach for the last mile.

Other prioritised critical processes, systems and third parties are identified, and business owners are assigned accountability for assessing resilience and implementing business continuity plans to enable continuity of operations in the event of an incident. TalkTalk also continues to invest in supporting appropriate resilience on critical systems which will be a key focus for FY21 on a risk-based approach. For third parties, the relationship owners are assigned accountability for requiring critical third parties to have adequate business continuity plans in place and obtaining third party assurance where appropriate that their plans have been reviewed and tested on a regular basis.

Due to COVID-19, further measures have been implemented to ensure the health and safety of our workforce and customers whilst we successfully continue our provision of critical services.

We continue to focus on our network resilience constantly monitoring our network to forecast and respond to the ongoing demand, successfully maintaining stability and minimising any congestion.

As with many organisations, TalkTalk must actively manage its liquidity risk, ensuring the availability of sufficient long term funding and the Group's compliance with associated covenants and other terms of the funding arrangements. In addition the Group must manage other financial risks such as foreign exchange, interest rate and credit risk.

The Group Treasury function is responsible for managing the Group's liquid resources and managing compliance with the terms of funding agreements. Policies and operating procedures are in place and these are regularly reviewed to ensure they remain appropriate for the business. In addition, the Executive Committee and the Board oversee the liquidity, funding position and covenant compliance of the Group on a regular basis and are required to provide approval on major funding decisions. The Group's main financing facilities are typically renewed 18 to 24 months before expiry with new facilities based on the Group's forecast cash flow requirements and liquidity needs to ensure the Group has sufficient available cash. The Group Treasury function is also responsible for managing foreign exchange and interest rate risks in line with the Group's policy.

The Group has recently renewed all of its committed financing facilities which has ensured a longer average tenor and provided it with a lower cost of financing going forward. In addition, the sale of the Fibre Assets Business generated over £200m of consideration providing greater headroom in the Group's facilities. Whilst these developments have reduced the liquidity risk of the Group, given the uncertainty arising from COVID-19, the gross risk has been held stable until the effects of the pandemic are known with greater certainty or have materially passed.

Delivery of performance and strategic objectives and development of the business is reliant on the ability to successfully deliver innovation and other operational changes required to support growth and performance. Failure to effectively deliver significant change programmes and associated benefits critical to TalkTalk's strategy would result in an inability to deliver performance objectives and limit TalkTalk's competitive position in the market.

COVID-19 impacts could result in financial and operational constraints impacting the delivery of change.

A formal change framework is in place for delivery of change projects which helps ensure appropriate process and governance is in place to drive successful project delivery. The framework is intended to ensure a desired level of quality is reached throughout the lifecycle of each project and has continued to support successful delivery of key change programmes.

The Group Change function remains a key effective control for facilitating prioritisation discussions to ensure people and financial resources are appropriately engaged, allocated and focused. Performance measures for key change projects are defined and monitored and regularly reviewed by Group Change. Monitoring and oversight of key change projects occurs at both the business unit leadership team level and by the Executive Committee on a regular basis, enabling real-time consideration of the potential impact of other operational and strategic activities on change projects.

The gross risk has been reduced due to the organisational re-set in which TalkTalk has aimed for further simplification by concentrating on fewer, more focused initiatives to support delivery of simplified, clear strategic objectives. However, this reduction is somewhat off-set by the potential impacts of COVID-19 on the delivery of change due to financial and operational constraints. The change plan is being closely reviewed and monitored by the Executive Committee to manage any COVID-19 impacts.