Annual Report and Accounts Norcros plc
Operational risks
Reliance on production facilities Loss of key supplier Information technology
andcyber security
Risk movement Risk movement Risk movement
Stable
Stable
Increasing
Description
The Group operates a number of facilities for the
manufacture of tiles and adhesives.
Impact
If any of these facilities (including technology
used to operate them) were to fail, the effect on
the Group could be signiicant.
Mitigation
The Group has a well-established ongoing
preventative maintenance programme as
wellasa comprehensive and lexible “annual
shutdown” programme throughout its
manufacturing operations.
Furthermore, the Group has experienced,
globally co-ordinated product sourcing
functions, which could mitigate the risk of failure.
Finished goods inventory holdings across the
operations provide limited “buffer” stocks in the
event of operational failure. Disaster recovery
plans are in place and business continuity plans
have been developed and are tested.
Additionally, a business interruption insurance
policy is in place to mitigate losses caused by
aserious insurable event affecting
manufacturing capability.
Description
The Group’s extended supply chain, with its
dependency on interconnected third parties
for manufacturing, has several potential points
of failure. Raw materials, components and
energy represent a signiicant proportion of
theGroup’s input costs. The potential lack of
availability of, or poor quality standards in, these
key elements represents a signiicant risk.
Reliance on a single supplier within the supply
chain, or on several suppliers in close
geographical proximity, could lead to a failure
to acquire the required quantity or quality of
essential resources.
Impact
The lack of supply of raw materials such as clay
or sand, components such as electronics, glass
or brassware, or gas or electricity could have
signiicant impacts on the Group’s ability to
manufacture product. The risk of energy supply
interruption is elevated in South Africa as its
utility infrastructure is less well developed than
in the UK.
Mitigation
The Group manages supply chain risks through
long-term relationships with key suppliers,
audits of key suppliers, dual supply of critical
materials or components, where considered
appropriate, and holding appropriate levels
ofinished goods stock.
The Group maintains strict product quality
standards and has dedicated procurement
andquality control resource in China to ensure
these standards are adhered to. The Group
aims to mitigate risks on energy supply where
these arise. The Group regularly reviews the
geographical concentration of its supplier
baseand mitigates risks arising where it is
commercially and economically practical
todoso.
Description
The Group relies heavily on several processes
and automated systems to manage data and
conduct its business. The continuing prevalence
and increasing sophistication of cyber-crime
and data loss incidents, along with stringent data
protection legislation compliance requirements,
present risks to all businesses and organisations
across the globe. The risk from state-backed
cyber-attacks has increased recently.
The evolution of home and remote working
methods presents increased cyber security risks
due to remote system access from potentially
less secure working environments and
unfamiliar working practices.
Impact
A major failure of systems or a successful
cyber-attack could result in a temporary inability
to conduct operations or a loss of commercial
and/or customer data. Such an incident may
result in regulatory breaches, inancial loss,
operating disruption or damage to the
reputation of the Group.
Mitigation
During the year, the Group employed the
services of a third party cyber security specialist
company to carry out an independent evaluation
of our cyber security maturity. The review led to
improvement roadmaps being established for
each of the businesses reviewed, and for the
Group as a whole, which are being worked on to
improve our security posture across the business.
The latest network and security protocols are
deployed, updated and regularly tested.
Dedicated business cyber security managers
monitor services and networks in line with
established policies and procedures.
Each business maintains remote backups of
data. The Group undertakes annual penetration
testing conducted by certiied third parties and
conducts ongoing vulnerability scanning, which
takes place regularly throughout the year.
Data protection regulation compliance reviews
are undertaken to conirm the effectiveness of the
relevant processes and controls. Data protection
representatives have been nominated at each
business to help co-ordinate the Group’s approach
to data protection and provide local advice.
The Group operates an online awareness
training programme with cyber security,
information security and data protection
training mandated for all users of IT equipment.
A third-party specialist incident response
provider is retained to assist the Group with an
appropriate and quick response to any cyber
breach or data breach incidents that may occur.
New equipment, and security tools and
methods such as virtual private networks and
multi-factor authentication, are employed to
mitigate remote working risks.