Principal risks and uncertainties - Bodycote plc annual report 2017

The Board is responsible for the Group’s risk management and determining the Group’s risk appetite. The review of financial risk has been delegated to the Audit Committee. The Group’s risk framework, using a variety of top-down and bottom-up approaches, is used to identify, monitor and report risks. The risks are aggregated first at a divisional level and then at Group level. For each business critical risk, assurance activities have been documented in risk assurance maps and these are used to direct assurance activity including that of Internal Audit.

The Group Head of Risk is supported by the Risk and SHE Committee, which met three times during 2017, attended by senior managers from each of the operating divisions and the Group Head of SHE. The Risk and SHE Committee assists the Group Head of Risk in identifying critical risks, embedding risk management and facilitating the implementation of risk management measures throughout the Group. The Group Head of Risk provides an update to the Audit Committee on the Group’s risk activities at every meeting and a comprehensive review of the Group’s business critical risks is presented to the Board in June and December. The Board concluded that an ongoing process of identifying, evaluating and managing the Group’s significant risks has been in place throughout 2017 and a robust assessment of the principal risks had been undertaken.

The table below highlights the major risks that may affect Bodycote’s ability to deliver the strategy, as laid out in the Strategy and objectives. These risks have been reviewed throughout the year and two new risks have been added since 2016; Environment and Capital Projects. The inclusion of the Environment risk reflects increasing regulatory intervention and a level of uncertainty in a number of jurisdictions in which Bodycote operates. The inclusion of the Capital Projects risk reflects the Group’s continued investments of significant amounts of capital to grow the business and these projects can be highly complex and rely upon factors outside the Group’s control.

In determining the principal risks the Board once again considered the result of the 2016 referendum on the future of the UK’s membership in the European Union. The Board does not expect this will have a material impact on Bodycote as customers are served locally and cross-border trading is minimal and this therefore remains as an element of the existing market risk.

Details of the Group’s financial risks (funding, foreign exchange, interest rate and counterparty risks), which are managed by the Group’s treasury function, are provided in note 18 to the financial statements. The mitigating activities described below will help to reduce the impact or likelihood of the major risk occurring, although the Board recognises that it will not be possible to eliminate these risks entirely. The Board recognises that there could be risks that may be unknown or that may be judged to be insignificant at present but may later prove to be significant. For this reason business continuity plans have been prepared for all plants to provide for situations where specific risks have the potential to severely impact the business.

Risk description	Impact	Mitigation and control
Market and customer risks
Markets Bodycote operates in 23 countries and a substantial amount of sales are closely linked to the economic cycle and the general macroeconomic environment. The result of the referendum on the future of the UK’s membership in the European Union is not expected to have a material transactional impact as customers are typically served locally and cross-border trading is minimal.	Stable The high proportion of short-term fixed costs in the business means that a drop in sales will have a significant impact on profitability. Sales in the markets served by the AGI businesses (69% of the total Group) tend to develop in line with or ahead of the economic cycle, whereas aerospace and defence sales (23%) tend to track behind the economic cycle. Sales to the energy sectors (8%) are closely linked to energy prices, which in turn can be affected by general economic activity.	Bodycote’s presence in 23 countries across a wide variety of end-markets acts as a natural hedge to neutralise localised economic volatility. There is some short-term flexibility in the cost base e.g. by ensuring that a proportion of the workforce is employed on temporary contracts. Changes in customer demand on a local or a Group-wide level are responded to quickly.
Loss of key customers Bodycote benefits from many long-term relationships with key customers and the damage to, or loss of, any of these relationships would be detrimental to the Group.	Stable The loss of a key customer could adversely affect the Group’s financial results and the viability of one or more of Bodycote’s facilities.	There is no significant customer dependency, with the Group’s top ten customers accounting for less than 17% of sales and the balance made up by many thousands of customers. There is a continued focus on customer service and quality processes to maintain excellent relationships with major customers. Key account management is in place and customer satisfaction is monitored.
Competitor action The entry of competitors into one or more of the Group’s Specialist Technologies.	Stable The erosion of market share resulting in loss of revenue and profit.	The close control of proprietary knowledge. Rapid increase in the scale of the Group’s offerings to maintain the position as supplier of choice.
Corporate and community risks
Safety and health The nature of Bodycote’s activities presents safety and health risks.	Stable Bodycote is committed to providing a safe work environment for its employees but Bodycote’s operations, if not properly managed, could have a significant impact on individual employees. Furthermore, poor safety and health practices could lead to disruption of business, financial penalties and loss of reputation.	Group-wide health and safety policies set by the Group Chief Executive. OHSAS 18001 and ISO 14001 compliant SHE management systems being used by Group Head of Safety, Health and Environment with support of divisional safety, health and environmental teams. Programme in place to focus on reduction of incidents which could have a high impact. Safety compliance audits at all plants at least every two years. Oversight of safety and health framework provided by the Group Risk and SHE Committee.
Environment Actual or potential environmental contamination could lead to health risks, disruption of business, financial costs and loss of reputation.	Increasing Bodycote is committed to providing the highest level of protection to the environment. Environmental regulators in many jurisdictions in which Bodycote operate can impose obligations on Bodycote to investigate potential contamination and remediate where required.	Environmental procedures and measures in place conforming to ISO 14001 (2017: 87% of plants). Environmental due diligence of businesses for acquisition. Remediation of contaminated sites or additional emission abatement as required by local legislation.
Operational risks
Service quality The Bodycote brand is reliant on the repeatable delivery of parts to agreed specification to an agreed time.	Increasing Deterioration in quality or service levels can cause serious long-term damage to Bodycote’s reputation with financial consequences such as the loss of a customer and the cost of damages or litigation. Work that is released into use which is not in compliance with specification could arise as a result of system or human failure. The Automotive ISO technical specification 16949 has recently undergone major revision and is being replaced by IATF 16949 (IATF being the International Automotive Task Force). The new standard requires additional work, for example additional quality inspections.	Bodycote has stringent quality systems in place managed by qualified staff. Quality systems and processes operated at plant level with oversight by divisional quality teams. Where necessary, plants maintain industry relevant accreditations, such as ISO 9001, Nadcap and IATF 16949 . All plants subjected to internal and external quality audits and inspections at least once a year.
Major disruption at a facility Bodycote’s business processes are inherently risky and there is a possibility that a major fire such as that suffered in 2016 at the Huntington Park facility (USA) or utility outage could lead to closure of a facility’s operation. In addition a number of sites are exposed to natural hazards, such as earthquakes, flooding and storms.	Stable Any significant incident at a site could result in the service to Bodycote’s customers from the affected site being disrupted.	Bodycote has a global network of 187 facilities. These facilities create a framework to provide back-up capability for affected facilities. Business continuity plans are in place for all plants. These are updated and tested annually. This process has been subject to a Board risk deep dive in 2017. Independent insurer inspections to assess hazard and business interruption risks. Insurance cover, including business interruption cover. Scheduled equipment maintenance and inspections.
Capital projects The Group invests capital in developing existing plants as well as into Greenfield developments and acquisitions.	Increasing Capital projects can be highly complex and rely on factors outside of the Group’s control. This may cause projects to be delivered late or at a higher cost than forecast. Market conditions may also change making a project less profitable than initially projected.	There is a well established capital investment approval process that applies to all major capital projects. Project Management frameworks are in place to deliver projects on time and on cost. All major projects are subject to post implementation reviews. Capital project risk will be subject to Internal Audit review in 2018.
Information Technology The efficient operation of the Group relies upon the continued development and operation of its IT systems. Bodycote is currently undergoing a Group wide implementation of an ERP system.	Stable Failure to protect the Group’s IT systems from cyber threats, or to maintain and upgrade the Group’s ERP system, could result in significant disruption and expense to the business.	Project approval and progress subject to regular Executive Committee and Board review. Project teams made up of skilled subject matter experts supplemented with third party advisers. Best practice project management processes in place with assurance provided by third parties. Defined disaster recovery planning and data backup procedures.
Regulatory risks
Regulatory and legislative compliance The global nature of Bodycote’s operations means that the Group has to comply with a wide range of local and international legislative requirements, including anti-bribery and anti-competition legislation, taxation legislation, employment law and import and export controls.	Stable Failure to comply with legislation could lead to substantial financial penalties, disruption to business, diversion of management time, personal and corporate liability and loss of reputation.	Business processes are supported by HR policies and the Group Code of Conduct alongside training and awareness programmes. The “Open Door Line” whistle-blower facility which is managed by a third party. Engagement of local specialists to support Bodycote at local, divisional and Group level. Regular audit of the effectiveness of implemented procedures.

Viability statement

In preparing this statement of viability, the directors have considered the prospects of the Group over the three year period immediately following the 2017 financial year. This longer term assessment process supports the Board’s statements on both viability, as set out below, and going concern in the Chief Financial Officer’s report. A three year period was determined as it is a reasonable period over which the business could be restructured in the event that any material changes to demand for the Group’s services transpired. As a result, the Board determined that a period of longer than three years would not be meaningful for the purpose of concluding on longer term viability.

The forecast used considers metrics which enable assessment of the Group’s key performance indicators (including return on capital employed, headline earnings per share and headline operating cash flow) in addition to net debt, liquidity and financing requirements.

In conducting the review of the Group’s prospects the directors assessed the three year plan alongside the Group’s current position, the Group’s strategy and the principal risks facing the Group (all of which are detailed in the Strategic report). This assessment considered the impact of the principal risks on the business model and on future performance, liquidity and solvency and was mindful of the limited forward visibility that the Group has as it carries no order backlog. The directors’ viability assessment included a review of the sensitivity analysis performed on the three year plan, whereby the principal risks were applied to the plan in a number of diverging scenarios. The developed scenarios were designed to be plausible, yet severe. Examples of scenarios reviewed were:

A decrease in forecast revenue of similar magnitude to the largest year-on-year decrease suffered in the last ten years.
A 10% decrease in revenue, debtor days and sterling strengthening to reflect an economic downturn

In making this viability statement the directors considered the mitigating actions that are taken by the Group in the event that the principal risks of the company become realised. The directors also took into consideration the Group’s financial position at 31 December 2017, with net cash of £40m, available committed facility headroom of £230m and a history of strong cash generation.

The directors have assessed the viability of the Group and, based on the procedures outlined above in addition to activities undertaken by the Board in its normal course of business, confirm that they have a reasonable expectation that the Group will be able to continue in operation and meet its liabilities as they fall due over the period to 31 December 2020.