NCC Group
Annual Report 2017

Plain-text annual report

securing tomorrow, today NCC Group plc Annual Report and Accounts for the year ended 31 May 2017 N C C G r o u p p l c A n n u a l R e p o r t a n d A c c o u n t s f o r t h e y e a r e n d e d 3 1 M a y 2 0 1 7 www.nccgroup.trust Stock Code: NCC NCC AR2017 - proof 8-Front.indd 3 09/08/2017 16:03:37 25546.04 9 August 2017 3:58 PM Proof Six BUSINESS OVERVIEW Why we exist NCC Group is a global expert in cyber security and risk mitigation, working with businesses to protect their brand, data (including intellectual property), value and reputations against the ever- evolving threat landscape. The Group’s independence, knowledge, experience and global footprint ensures that NCC Group can help businesses identify, assess, mitigate and respond to the risks they face within this fluid and hostile environment. NCC Group is passionate about changing the shape of the internet to make it safer and revolutionising the way in which organisations think about cyber security. NCC Group currently operates from over 30 offices across the UK, continental Europe, North America, Australia, Canada, Singapore and the United Arab Emirates. NAVIGATING THE REPORT For further information within this document and relevant page numbers Additional information available online Visit us online at www.nccgroup.trust www.nccgroup.trust Stock Code: NCC NCC AR2017 - proof 8-Front.indd 4 25546.04 9 August 2017 3:58 PM Proof Six 09/08/2017 16:03:39 Financial highlights (1) Revenue (£m) Adjusted EBIT (£m) 244.5 209.1 38.4 Contents BUSINESS OVERVIEW Financial highlights Executive Chairman’s statement Group at a glance A day in the life… STRATEGIC REPORT Highlights The strategic review and target operating model The market opportunity Business model Our strategy 23.9 26.0 26.4 27.6 Q&A with Chris Stone and Brian Tenner 99.2 110.7 133.7 2013 2014 2015 2016 2017 2013 2014 2015 2016 2017 Operating Profit/Loss (£m) Adjusted EPS (pence) 24.1 22.6 19.8 11.4 11.2 9.3 9.4 8.4 Interim Chief Executive’s review Group performance review for 2017 Principal risks and uncertainties Corporate social responsibility GOVERNANCE Chairman’s letter Governance framework Board of Directors CONTENTS LISTING HERE Operations board Board composition and division of responsibilities Shareholder relations 6.7 Audit committee report (53.4) 2013 2014 2015 2016 2017 2013 2014 2015 2016 2017 Investment case z NCC Group operate in high growth markets z Our expertise is highly valued by our customers z We are at the forefront of thought leadership in cyber security z NCC Group Escrow is an attractive niche business z Self-help measures to improve margins through an updated Target Operating Model and efficient business processes in both divisions z In a highly fragmented market, NCC Group’s scale creates opportunity for significant value creation through targeted acquisitions. (1) All from continuing operations NCC Group plc Annual Report and Accounts for the year ended 31 May 2017 Nomination committee report Cyber security committee report Remuneration committee report Directors’ report Directors’ responsibilities statement FINANCIAL STATEMENTS Independent auditor’s report Consolidated income statement Consolidated statement of comprehensive income Consolidated statement of financial position Consolidated statement of cash flows Company statement of cash flows Statements of changes of equity Notes to the accounts ADDITIONAL INFORMATION Glossary of terms Company information 1 2 6 14 16 17 18 20 24 26 28 30 44 48 54 58 •• 59 61 62 64 65 71 74 82 84 86 108 112 113 114 118 119 120 122 124 125 127 170 172 1 NCC AR2017 - proof 8-Front.indd 1 09/08/2017 16:03:40 25546.04 9 August 2017 3:58 PM Proof Six BUSINESS OVERVIEW Executive Chairman’s statement Introduction My first statement to shareholders as Executive Chairman reflects on two strong but contradictory themes. Firstly, the past year has been very challenging, both operationally and financially. Business performance has fallen short of expectations, we have outgrown some of our business processes and controls, and we have experienced significant changes to our Board. Equally, and more importantly, it is already clear that the years ahead present significant upside opportunities. Strong value creation will result if we effectively implement our new strategy and successfully manage NCC Group through the transitional period in which we now find ourselves. Our business is not broken – indeed it has some notable strengths, both financial and operational. We still enjoy significant organic growth in our core markets and have a strong balance sheet. Furthermore, in a constantly evolving and complex market, our unique market leading skills and capabilities are keeping us at the forefront of thought leadership. This is recognised by customers, who reward us with high levels of repeat business. If we improve our organisation and how we go to market, we will also see material value creation. NCC Group has a unique opportunity: we hold leading positions in growing markets around the world, our customers value us and our workforce is exceptionally skilled. However, we need to change how we organise ourselves and improve our internal business processes. Only by doing this will we be able to capture the significant value available to us Business performance The financial performance for the year was clearly disappointing, though in line with revised expectations. Despite delivering revenue growth of almost £35.4m (up 17 per cent), adjusted* EBIT went backwards to £27.5m from £39.7m in the prior year. Operating profit fell from £11.4m in the prior year to a loss of £53.4m. This outcome reflected a number of historical weaknesses in our operating model. Our business performance is shown in more detail in the Strategic Report on pages 16 to 57. Strategic review and strategic plan Following the trading update on 21 February 2017, the Board commissioned a Strategic Review. The Review focused on three key areas. Firstly, to develop a better understanding of our marketplace, our competitors and our customers. Secondly, to assess the relative strengths and weaknesses of NCC Group in the market. Thirdly, to assess the value created by the current portfolio of businesses. The Review confirmed that our markets remain attractive and, more importantly, that customers regard NCC Group as a very strong competitor in these markets with a strongly differentiated proposition. The strong cyber security theme (or “golden thread”) that runs through the Assurance Division represents a unique set of competencies and capabilities that we can leverage to deliver greater customer value in a highly complex and fragmented market. Our sector and application specific product offerings are leading edge and our solutions capabilities are highly valued and sought after. The Review also confirmed the current financial logic of the relationship between Assurance and Escrow. Escrow itself is an attractive business and provides a stabilising influence on the Group. * This is a non-GAAP or Alternative Performance Measure (APM). Adjusted figures exclude the amortisation of acquired intangibles, individually significant items, share-based charges, the unwinding of discount on deferred and contingent consideration, the results of the exited Domain Services business and any associated tax thereon. www.nccgroup.trust Stock Code: NCC 2 NCC AR2017 - proof 8-Front.indd 2 25546.04 9 August 2017 3:58 PM Proof Six 09/08/2017 16:03:44 Finally, the Review identified two of the smaller Assurance businesses that sit outside the cyber golden thread whose future would be better served under alternative ownership. These businesses, Web Performance and Software Testing, will be disposed of in due course. Subsequently, we initiated the development of a new three-phase Strategic Plan and revised Target Operating Model in order to underpin our “go to market” and delivery strategies. In the next 12 to 24 months, we intend to focus more of our efforts on internal self-help measures than has been the case historically. This should ensure that we reverse the margin compression seen in both trading divisions and across most territories in the last two years. The Group will then benefit from further organic growth with foundations built on scalable products and business processes. These new foundations will also significantly enhance our ability to leverage acquisition related growth when the Group returns to being acquisitive. Acquisition activity, if any, is therefore likely to be limited during this period to smaller “bolt-ons”. The results of the Strategic Review are set out further in the Strategic Report on pages 18 to 23. Dividends The Board has reviewed the business performance in the current year alongside our historical progressive dividend policy. While mindful of the need for investment over the next few years, the Board is confident in our prospects and hence recommends that the dividend is maintained at the current level. Governance During the year, the Board has undertaken a major review of some of the Group’s governance structures. In part, this was prompted by a combination of shareholder and employee feedback. In addition, there was also the realisation that rapid growth in recent years had taken the Group beyond the design limits of the previous operating model. A final dividend of 3.15p is therefore being recommended by the Board, making a total for the year of 4.65p, equal to the prior year. If approved, the final dividend in respect of the year ended 31 May 2017 will be paid on 29 September 2017 to shareholders on the register as at 1 September 2017 with an ex-dividend date of 31 August 2017. As a matter of note, an administrative non-compliance issue has been identified with respect to distributable reserves and the payment of historical dividends. At all times the Group had adequate returns within subsidiary companies to meet these dividends. We expect to remedy the position by means of shareholder resolutions at the AGM in September. The Board remains committed to high standards of corporate governance. We are working actively to enhance governance as well as our business processes and internal controls to match our ambitions for the Group’s future. The results of the Governance Review are set out in the Governance Report on pages 59 to 60. Board composition There have been a number of changes to the Board during the year. I joined the Board on 6 April 2017 as a Non- Executive Director, becoming Executive Chairman in April when Paul Mitchell stood down as Chairman. Last year we noted our intention to strengthen the team further with an additional independent Non-Executive Director. As a result, Jonathan Brooks joined the Board as a Non-Executive Director on 13 March 2017. Jonathan brings significant valuable experience of the technology sector. NCC Group plc Annual Report and Accounts for the year ended 31 May 2017 3 NCC AR2017 - proof 8-Front.indd 3 09/08/2017 16:03:44 25546.04 9 August 2017 3:58 PM Proof Six BUSINESS OVERVIEW Executive Chairman’s statement Brian Tenner was appointed Chief Financial Officer on 1 February 2017 following a search process prompted by the resignation of Atul Patel on 10 August 2016. He became Interim CEO on 1 March 2017, following the decision of Rob Cotton to step down as CEO. The current model of an Executive Chairman working closely with Brian as Interim CEO and CFO has been a necessary and effective bridge to deliver the Strategic Review and also maintain stability in the management of the business. Recognising that this is not a sustainable long-term solution, the Board has commenced a process to identify a permanent CEO using a firm of independent executive search consultants. Board effectiveness As Executive Chairman, I am responsible for the leadership of the Board and ensuring its effectiveness in all aspects of its performance. During the year, the Board has reviewed its performance and effectiveness in accordance with the requirements of the Code. We note that the recent and significant changes in membership and new strategic direction represent a transition period for the Board as well as the Group. Our business is entirely reliant on the skills and experience of our staff. We are fortunate to have them choose to build their careers with NCC Group, and I look forward to working with all of them as we take our business forward The Board will work to enhance oversight of the Group’s strategic development, monitoring the delivery of its business objectives and the development of the new Target Operating Model. We will also work hard to ensure that we maintain an effective, corporate governance framework that keeps pace with the rate of growth and change inside and outside of NCC Group. Employees Our staff are the foundation for most of the value inherent in NCC Group. In developing and implementing our new Strategic Plan and Target Operating Model we will work to ensure that we create a working environment that values the individual and allows each one of us to contribute to our full potential. This will include creating organisational values and clearer structures, roles and responsibilities. The coming financial year will also see a greater focus on personal development and training. I would like to record my own and the Board’s sincere thanks to all of the Group’s employees, who have maintained their focus on delivering excellent service to our customers. This has been achieved against a backdrop of uncertainty caused by the Group’s volatile financial and share price performance, particularly in the latter quarters of the year. Our business is entirely reliant on the skills and experience of our staff. We are fortunate to have them choose to build their careers with NCC Group, and I look forward to working with all of them as we take our business forward. 4 www.nccgroup.trust Stock Code: NCC NCC AR2017 - proof 8-Front.indd 4 25546.04 9 August 2017 3:58 PM Proof Six 09/08/2017 16:03:46 Current trading and outlook All businesses go through transitional phases as they grow and mature. NCC Group is no exception. Where we are different, and at a significant advantage to many, is that change has not been forced upon us by mounting losses, a stretched balance sheet, technological obsolescence or a sudden shrinkage in our markets. We are operating in a rapidly growing international market in which our core skills and competencies will allow us to lead rather than follow. Our challenge is to manage the transition from one business model to another, as the growth in scale and complexity has made our early stage model ineffective. We now need to create structures and products that allow us to benefit from our scale and deliver additional value for our customers while never losing sight of our core competencies and strengths, most notably represented in our staff, their energy and their commitment. So while there is a lot of work to do to implement new processes, systems and structures, the outlook for NCC Group remains very positive. In fast growing international markets with a range of innovative products and services, the challenge is to execute effectively the planned changes in strategy and operating model. The Board is confident that the Group can deliver sustainable earnings growth and enhanced shareholder value once it has more robust foundations in place. We are not only “securing tomorrow, today” for our customers, but for all of our long-term stakeholders. In terms of trading for the current financial year, the Board expects Escrow to return to low single digit revenue growth and see some margin improvement. The Assurance business is expected to see high single-digit organic revenue growth as we build from the low point of the second half of last year. Assurance gross margins will improve as we implement our new operating model over the course of the new financial year. Set against these gains in gross profit are some cost headwinds arising from higher overheads linked to property costs and the amortisation and depreciation of capital spend in 2017. Finally, the disposal of the Web and Software Testing businesses will reduce EBIT on a pro rata basis by £2.7m based on 2017 results. Overall, the Group’s expectations for adjusted EBIT in 2018 are unchanged. Chris Stone EXECUTIVE CHAIRMAN 18 July 2017 There is a lot of work to do to implement new processes, systems and structures but the outlook for NCC Group remains very positive NCC Group plc Annual Report and Accounts for the year ended 31 May 2017 5 NCC AR2017 - proof 8-Front.indd 5 09/08/2017 16:03:47 25546.04 9 August 2017 3:58 PM Proof Six BUSINESS OVERVIEW Group at a glance NCC Group is a global expert in cyber security and risk mitigation, providing organisations worldwide with market leading business continuity services focused on the digital world. We aim to innovate and continually develop new products and services to match the rapidly evolving and complex digital world. Our goal is to stay at the forefront of thought leadership and delivery in our current markets while expanding geographically where appropriate. The Group now operates in two distinct but complementary divisions: Assurance and Escrow. A short summary of the activities of each is set out below and on the following pages. ASSURANCE KEY FACTS z One of the leading pure play cyber security businesses focusing on services as opposed to products z Customers in 50+ different countries z Largest customer is 4 per cent of sales z Services sold across multiple industry sectors (see across) ESCROW KEY FACTS z Leading provider of Escrow services in the UK z Growing positively in the US and Europe z Customers in 85 different countries z Top ten customers represent 7.6 per cent of sales z Largest customer is 1.2 per cent of sales z Revenue by industry sector shown opposite 6 www.nccgroup.trust Stock Code: NCC NCC AR2017 - proof 8-Front.indd 6 25546.04 9 August 2017 3:58 PM Proof Six 09/08/2017 16:03:53 USA £58.5m UK £144.2m Europe £37.2m Rest of World £2.0m Where NCC Group operates We have a significant market presence in the UK, the USA, Continental Europe, and a smaller footprint in a number of other international locations. All of our geographical markets present opportunities for growth by leveraging our core competencies. Revenue split Escrow revenue £37.1m Assurance revenue £204.7m Adjusted Revenue Adjusted EBIT Total staff Adjusted EBITDA NCC Group plc Annual Report and Accounts for the year ended 31 May 2017 7 NCC AR2017 - proof 8-Front.indd 7 09/08/2017 16:03:55 25546.04 9 August 2017 3:58 PM Proof Six BUSINESS OVERVIEW Group at a glance ASSURANCE DIVISION OVERVIEW The Assurance Division operates in two discreet segments as described below. Security consulting The cyber landscape presents an ever increasing and ever changing threat to security as cyber intruders develop increasingly sophisticated ways to attack corporate networks, thereby gaining access to organisations’ sensitive and valuable data and systems. The Assurance Division brings together a number of diverse product and service offerings in a number of different business lines. The “golden thread” running through the core businesses is “cyber security” – whether through the provision of consulting and professional services, managed services or hardware and software products. These core areas all focus on cyber security – in other words – how to maintain and protect our customers’ data and critical business systems from interruption by malicious or accidental events. Information security and cyber security continue to change at a rapid pace with new areas of concern or vulnerabilities frequently and regularly discovered. To stay ahead in the cyber-arms race, our global corporate culture is aligned with this rapid and constant change. We have created boutique ways of working with cultural values that encourage individuals to fulfil their full creative potential. In conjunction with this creativity, the business is committed to listening to its clients’ requirements. Since much of the work carried out by the Group is research based, in order to maintain its equitable and ethical disclosure policies, research paid for by third parties and customers is not disclosed, unless requested by the paying organisation. Self-funded research by the Group will always be provided to the organisation that it affects in full, free of charge and without disclosure, until such time as the vulnerability has been resolved in a reasonable timeframe. This does not preclude the Group making a full public disclosure if there is a threat to life or to the general public’s online security, and the third party is unwilling to remediate the issue. Historically, Assurance Division acquisitions have been based upon culture, fit and service but never on the basis of profit enhancement by cost reduction or the ability to turn around an ailing business. Threat intelligence and cryptography is the most recent example of this, where the Group acquired a business, Fox-IT, to fill directly a product and service need. While progress in rolling these services out to a much broader range of multinational customers has been much slower than expected, the opportunity remains an attractive one if we can reorganise ourselves effectively to deliver on it. Threat intelligence is one of the most important tools in an organisation’s armoury to help prevent and mitigate cyber-attack. Our future acquisition strategy will be reviewed and developed after a necessary period of stabilisation and rebuilding of strong foundations in scalable business systems and processes. Following the acquisition of Accumuli plc, the Group has the opportunity to offer an integrated managed scanning service as a single client solution (hence now referred to as MSS). A project is also underway to put all of our internal and external monitoring services on to the “CTMp” platform acquired with Fox-IT. While the Group will continue to be open to the sale of third party products, our focus will be on instances where we can offer value added after sales services. Not all of the Group’s sales of products are third party products. Particularly through the Fox business, we offer some very high-end products to customers that combine hardware and software in one package. This includes “DetACT” (for use by transactional financial services companies) and Data Diodes (a product range that helps secure one-way data communications such as a utility meter). Both products are sufficiently differentiated that they can attract better margins than third party product reselling. As one of the world’s largest service led security consultancies, the Group is capable of leading all cyber security bids rather than having to look for support from larger third parties. Software testing and website performance Essential websites, software and infrastructure that support an organisation do not just need protection from malicious attacks, they also need guaranteed performance levels. Flaws in code can prevent software from operating at optimum levels and spikes in online traffic can throw websites offline. Currently, NCC Group undertakes more than three million web page tests per day for clients worldwide. Employees globally (2016: 1,323) Average monthly no. of Associates globally (2016: 176) 8 www.nccgroup.trust Stock Code: NCC NCC AR2017 - proof 8-Front.indd 8 25546.04 9 August 2017 3:58 PM Proof Six 09/08/2017 16:03:55 ASSURANCE ACQUISITIONS CURRENT YEAR ACQUISITIONS PSC PSC was acquired in September 2016 as part of the Group’s strategy of acquiring relatively small bolt-on consulting businesses. The maximum price that will be paid is $18.75m in cash ($15.0m up front and $3.75m contingent on performance over two years). VSR VSR was acquired in November 2016, again as part of the Group’s strategy of acquiring relatively small bolt-on consulting businesses. The maximum price that will be paid is $6.0m in cash ($4.0m up front and $2.0m contingent on performance over two years). PSC is a leading provider of cyber security, payment and compliance-related consulting services to the global payments industry. PSC also serves the financial and retail sectors and fits well with similar services the Group delivers for a number of global customers around the world (www.paysw.com). Key statistics for PSC z Based in Silicon Valley, with presence in 29 states in the US z Employs 37 staff z Service lines include a cyber security practice and PCI (Payment Card Industry) sector services that complement the existing NCC Group PCI business in the UK z Broad range of blue chip clients with relationships at Board level including major financial institutions and other businesses across the payment sector PSC financial information Constant fx Revenue EBIT Pre-acquisition Year ended 31 December 2015 Post acquisition 7 months ending 31 May 2017 £7.4m £1.2m £5.9m £1.2m It is estimated that approximately 85 per cent of PSC’s revenue is annually repeating in nature. Acquisition rationale PSC is one of a very small group of companies that can provide expert services and solutions to organisations that require specialist compliance, consulting and cyber security testing services in the substantial and growing global payments industry. VSR is an information, network and application security consultancy. It provides expert value added services to US corporate clients. Several are in the Fortune 500 and are mainly in the technology and financial services sectors. (www.vsecurity.com). Key statistics for VSR z Established in 2004 in Boston, Massachusetts z Employs 11 staff z Earnings enhancing and financed from existing debt facilities and internally generated cash flow VSR financial information Constant fx Revenue EBIT Pre-acquisition Year ended 31 December 2015 Post acquisition 6 months ending 31 May 2017 £1.6m £0.6m £1.1m £0.5m It is estimated that approximately 83 per cent of VSR’s revenue is annually repeating in nature. Acquisition rationale Strong technical ability of senior security consultants and the high quality of its services. VSR is based in Boston’s financial district and is an important addition to the Group’s technical skill set as well as being a valuable extension of NCC Group’s US office network. VSR will provide a foundation stone into Boston and that part of the north-eastern region of North America. NCC Group plc Annual Report and Accounts for the year ended 31 May 2017 9 NCC AR2017 - proof 8-Front.indd 9 09/08/2017 16:03:56 25546.04 9 August 2017 3:58 PM Proof Six BUSINESS OVERVIEW Group at a glance ASSURANCE CORE CAPABILITIES Identify Understand your current security posture and maturity, which will assist in prioritising your investment Respond Rapid access to cyber incident containment, investigation & crisis management Mitigate Managing and maintaining control of your business enabling you to focus on strategic priorities Assess Deliver assessment on how to improve your maturity and mitigation In today’s threat landscape, understanding the risks that organisations and their customers are exposed to is more important than ever. Understanding the impact and the steps that organisations can undertake to make themselves resilient is key to protecting their brand, reputation and sensitive customer information. Building a cyber-resilient organisation can be a complex process but it is not impossible. Through an extensive suite of services, NCC Group provides organisations with peace of mind that that their most important assets are protected, available and operating as they should be, at all times. With extensive technical depth and strategic vision, NCC Group is ideally placed to help organisations identify, assess, mitigate and respond to the risks they face. 10 www.nccgroup.trust Stock Code: NCC NCC AR2017 - proof 8-Front.indd 10 25546.04 9 August 2017 3:58 PM Proof Six 09/08/2017 16:03:56 A WIDE RANGE OF SERVICES Identify Assess Mitigate Identify strategic improvement z Strategic advice and planning z Data risk identification z Enabling digital transformation z Compliance accreditation Examples Æ M&A technical due diligence Æ Incident response planning Æ Data mapping Æ Payment card compliance gap analysis Æ Web advisory services Technical assessments to enable effective mitigation z Threat identification z Vulnerability identification z Digital performance z Planning for change z Strategic advice and planning z Data risk identification z Government and industry compliance z Software development life cycle Examples Æ Penetration testing Æ Reverse engineering Æ Cryptographic review Æ Static code analysis Æ Policy review Effective solutions to business challenges z Software assurance z Web performance z Implementing change z NCC Group products z Asset verification z Industry standards compliance z Hosted and managed services z Virtual security team Examples Æ Managed threat protection Æ Technology solutions Æ Security analytics Æ User acceptance testing Æ First responder training Respond Trusted services for effective recovery z Cyber incident response z Post incident analysis z Asset recovery Examples Æ Cyber incident helpline Æ Cyber forensics Æ Software escrow Æ Takedown services Æ Trusted advisor Identify Services designed to help organisations understand their current security posture, allowing strategic improvements to be identified and investment prioritised. These solutions aim to help an organisation understand what the Board’s cyber security strategy is or should be, the data and assets they have, where high value data resides and if they are meeting regulatory obligations. Assess Technical assessments to enable effective mitigation. This allows organisations to conduct informed risk mitigation planning and understand how to improve their cyber maturity. These services help organisations to understand their: z Digital performance z Cyber threats z Vulnerability exposure z Regulatory obligations and whether they are compliant z Applications security and functionality z Change plan Mitigate Mitigating organisations’ cyber risks through a complete spectrum of consultancy and managed services which can help organisations to: z Ensure their software and applications meet business requirements z Comply with industry standards z Implement change effectively z Improve online performance z Manage and monitor their cyber infrastructure effectively z Understand staff training and support needs z Protect investment in business critical software Respond Trusted discreet services for effective recovery support. An end-to-end response solution, from incident planning to investigation, crisis management and asset recovery. With one of the largest incident response teams in the world, NCC Group is equipped to reduce the likelihood of a breach becoming a greater problem than it ought to be. NCC Group offers services across the entire incident response life cycle. NCC Group plc Annual Report and Accounts for the year ended 31 May 2017 11 NCC AR2017 - proof 8-Front.indd 11 09/08/2017 16:03:56 25546.04 9 August 2017 3:58 PM Proof Six BUSINESS OVERVIEW Group at a glance ESCROW San Francisco Atlanta Manchester Amsterdam Switzerland Munich Dubai Where Escrow operates The business began in the UK where we now see a mature market. We have a growing presence in the USA and have a foothold in a number of European markets as well as in the Middle East. Escrow background The Escrow Division offers a high value product to customers who rely on mission critical applications and software packages for the day-to-day running of their business functions and processes. In today’s integrated business world, these applications typically extend well beyond accounting and reporting systems into Enterprise Resource Planning (ERP) tools and even deeper into an organisation’s service delivery capability such as design tools in an advertising agency or manufacturing equipment in an engineering company. These applications are often supplied by third party vendors. However, if a software or Software as a Service (SaaS) supplier goes out of business and/or changes hands, the continuing availability of these applications could be in doubt and hence business continuity is potentially put at risk. NCC Group’s escrow and verification services assure the long-term availability of these applications, protecting both end users and software suppliers. Working with all parties involved in the development, supply and use of business critical software applications, NCC Group assures that source code, data and other information is constantly accessible and can be properly rebuilt from its components, if required. Core services Both through contractual arrangements and through verification testing services, Escrow’s service offering is to provide a safe and independent environment in which customers and their software suppliers can entrust NCC Group with source code that will allow continued access to key systems in the event of an interruption in supply. Revenue by geography UK £25.4m USA £7.9m Europe £3.9m 12 www.nccgroup.trust Stock Code: NCC NCC AR2017 - proof 8-Front.indd 12 25546.04 9 August 2017 3:58 PM Proof Six 09/08/2017 16:04:00 Employees globally (2016: 181) 51.3% EBIT Margin (2016: 56.9%) 19.1m* Adjusted EBIT (2016: £20.1m) * Operating Profit £18.1m The potential benefits include the continued operation of the customers’ core business systems at a relatively low cost. Escrow services are provided in both the traditional software market as well as in all iterations of the outsourced model. We continue to develop our SaaS service to respond to the continuing evolution of our marketplace, as well as developing server testing services in order to enhance the proposition. Further, we provide registry data escrow services (a regulatory requirement) for all registrars and registries of domains. The IP address of each domain registered within a TLD is safely secured along with Registrar Data Escrow. Due to its importance to clients, Escrow provides the Group with excellent recurring revenues along with good margins and cash generation. Escrow can be provided both in the traditional on-premise software market as well as in the cloud, as the basic underpinnings are the same; protection from an event that disrupts the relationship between the owner and licensee of a software product. The Escrow Division remains a key cornerstone of the Group and is the platform upon which the organisation has been built. The fundamentals of the Group are fully encapsulated in this division, which is based around the very highest standards of customer care and equitable treatment to all parties in the contractual relationship. While there are limited cross linkages or shared sales opportunities with the Assurance Division, Escrow does offer services that complement those in Assurance to protect customers against the full range of cyber risks. A good example of this has been the development of offering SAST (static application security testing) services to software vendors on source code that has been deposited and verified with the Group’s Escrow Division. The Group is one of the world’s leading and most established software escrow providers, with more than 35 years’ experience and protects over 15,000 organisations worldwide, combining longevity and trust with technical expertise. The expertise contained within the Escrow Division, along with its credentials, offerings, global scale and reputation, sets NCC Group apart from other escrow providers. NCC Group plc Annual Report and Accounts for the year ended 31 May 2017 13 NCC AR2017 - proof 8-Front.indd 13 09/08/2017 16:04:06 25546.04 9 August 2017 3:58 PM Proof Six BUSINESS OVERVIEW A day heading one in the life... 7.30pm 6.30pm 5.10pm 1.00pm 12.45pm 12.30pm ATM £ 12.20am 9.15am 11.00am 9.25am 7:10am 7:50am A walk through a typical day reveals an array of areas where NCC Group helps create a more cyber resilient world as we support our customers in millions of daily interactions with their own customers. This work is never finished but our impact is felt everywhere which makes our staff proud to help create a safer world, both online and more generally. 14 www.nccgroup.trust Stock Code: NCC NCC AR2017 - proof 8-Front.indd 14 25546.04 14 August 2017 10:14 AM Proof Eight 14/08/2017 10:20:08 7.30pm 6.30pm 5.10pm 1.00pm 12.45pm 12.30pm ATM £ 12.20am 9.15am 11.00am 9.25am 7:10am 7:50am 5:10pm HEALTH CHECK see page 33 for a related case study The medical imaging system used at the doctors was assessed by NCC Group technical experts. When the recent ransomware outbreak occurred, NCC Group’s cyber defence operation and response specialists supported the hospital to continue operating with minimal disruption. 6:30pm COOK DINNER see page 37 for a related case study The distribution supply chains which provide the food to your door have been assessed by NCC Group risk management and governance experts and benefited from security improvement programmes undertaken by the retailers who deliver them. 7:20pm RECYCLE RUBBISH The recycling centre is protected by a cyber insurance policy that is supported by NCC Group experts. 7:30pm PUT BABY TO BED The Internet-of-Things baby monitor has been subject to assessment by NCC Group’s hardware labs. 7:30pm WATCH AN ON-DEMAND MOVIE From the setup box you use to the service you use. NCC Group risk and technical experts have ensured that piracy risk is minimised while ensuring your data is safe. ATM 7:10am MORNING ROUTINE NCC Group protects the critical national infrastructure that provides power, water and gas 24/7 through its Security Operations Centres. Its data diode products allow these providers to connect their most sensitive networks to the Internet, powering smart grids. The smart meter in your house has been through NCC Group’s government approved hardware testing laboratories. 7:50am DRIVE TO WORK see page 39 for a related case study The car you drive has benefited from NCC Group’s transport security practice who has worked with the manufacturer and their supply chain to identify and mitigate risks through threat modelling, applied research, and ethical hacking before it has even rolled off the production line. 9:15am CROSS THE STREET The traffic lights and traffic control systems have been subjected to technical assessment and risk advice by NCC Group consultants. 9:25am TAKE THE ELEVATOR TO THE OFFICE The building management system that controls the modern offices in which you work has been assessed for novel attack and defence approaches by NCC Group researchers. This knowledge has allowed the building owner to minimise the risk that a building outage can be caused by a cyberattack. 11:00am WORK ON THE INTERNET From the software on your desktop, laptop or mobile device through the carriers that connect you to the cloud and the cloud providers themselves, NCC Group has worked with the largest firms to produce more resilient environments. NCC Group’s web performance team has tested the website to ensure it was working at optimal performance levels. 12:20pm MAKE CASH MACHINE WITHDRAWAL see page 38 for a related case study The cash machine, the networks upon which it operates and the financial system fabric is assessed regularly by Red Team technical specialists at NCC Group on behalf of the institutions and their regulators. When incidents occur, NCC Group’s Cyber Incident Response team provides experts in intrusion and malware analysis to supplement an organisation’s own capabilities. 12:30pm BUY LUNCH NCC Group’s threat intelligence tipped off the point-of-sale operator that their systems were breached. This allowed the organisation to respond and minimise impact on their customers while ensuring commerce can occur with confidence. 12:45pm BUY SHOES see page 43 for a related case study NCC Group’s software testing team worked on the roll-out of the new EPOS system and loyalty scheme application across the store’s network of shops. 1:00pm BOOK A HOLIDAY see page 42 for a related case study NCC Group’s Escrow Division hold the software that is required to run the travel agent’s reservations system in escrow, which would be released in the event of certain trigger events where the software owner was unable to perform its contractual duties. This helps ensure minimal disruption to the travel agent’s business critical software. 4:00pm PICK CHILD UP FROM NURSERY The biometrics used to gain access to the nursery benefits from research and advice provided to the manufacturer, avoiding a system which could be bypassed with a selfie. NCC Group plc Annual Report and Accounts for the year ended 31 May 2017 15 NCC AR2017 - proof 8-Front.indd 15 09/08/2017 16:04:07 25546.04 9 August 2017 3:58 PM Proof Six STRATEGIC REPORT Contents The strategic review and target operating model The market opportunity Business model Our strategy Q&A with Chris Stone and Brian Tenner Interim Chief Executive’s review Group performance review for 2017 Principal risks and uncertainties Corporate social responsibility 18 20 24 26 28 30 44 50 54 The Strategic Report includes an overview of our strategy and business model as well as our markets and competitive position. We explain our performance over the financial year ending 31 May 2017 and also outline the principal risks we face and how we manage them. In addition to the Financial Review included within this section, we provide additional analysis and commentary on the overall performance of the Group as well as our two operating segments. 16 NCC Group plc Annual Report and Accounts for the year ended 31 May 2017 www.nccgroup.trust Stock Code: NCC NCC AR2017 - proof 8-Front.indd 16 25546.04 9 August 2017 3:58 PM Proof Six 09/08/2017 16:04:08 Highlights Financial highlights z Group revenue grew by 17 per cent to £244.5m (2016: £209.1m) made up of: — Organic growth of 3 per cent (excluding the impact of FX and acquisitions) — Impact of acquisitions (prior year and current year): £21.1m (all in Assurance) — Impact of changes in foreign exchange rates: £9.8m z In terms of business segments, underlying organic growth can be broken down as follows: — Assurance – UK Security Consulting: 19.4 per cent; US Assurance: 13.9 per cent — Assurance – Software Testing and Web Performance: down 11.3 per cent — Escrow: 0.3 per cent rise z Adjusted1 EBIT: £27.5m (2016: £39.7m) z Operating loss: £53.4m (2016: £11.4m profit) — Assurance Adjusted EBIT down to £16.6m (2016: £25.8m) — Escrow Adjusted EBIT down to £19.1m (2016: £20.1m) — Head office costs increased to £8.2m (2016: £5.7m) z Individually significant charges of £71.0m, including intangible asset write downs of £62.0m z Adjusted EBITDA: £36.2m (2016: £45.0m) z Adjusted basic earnings per share: 6.7p (2016: 11.8p) z Total dividend maintained at 4.65p per share with final dividend of 3.15p per share z Net debt reduced to £43.7m from half-year level of £48.8m Strategic and operational highlights z Strategic Review of the Group, its portfolio, market and competitive position completed (see pages 18 to 23) z Strategic Plan created, based on output from the Strategic Review z Work ongoing on Target Operating Model designed to improve organisational clarity and efficiency as well as margin improvement (see pages 19 and 23) z Significant changes to the Board and Executive management team z Acquisitions completed of two small bolt-on businesses in the US to enhance the product offering of our existing Assurance businesses and expand our US footprint. Outlook for 2017/18 z Implement new Target Operating Model to drive more effective “Go to market” strategies and operational efficiencies. z Leverage high value products and services from acquisitions through the NCC Group global footprint and sales channels by lowering internal barriers to Group-wide co-operation. z Short-term focus on internal self-help measures and efficiencies in a buoyant market will deliver margin growth 1 This is a non-GAAP or Alternative Performance Measure (APM). Adjusted figures exclude the amortisation of acquired intangibles, individually significant items, share-based charges, the unwinding of discount on deferred and contingent consideration, the results of the exited Domain Services business and any associated tax thereon. NCC Group plc Annual Report and Accounts for the year ended 31 May 2017 17 NCC AR2017 - proof 8-Front.indd 17 09/08/2017 16:04:08 25546.04 9 August 2017 3:58 PM Proof Six STRATEGIC REPORT The strategic review and target operating model The Group began a Strategic Review in February 2017. The objectives of the review fell into three broad categories: z Assessing our marketplace and customers’ buying preferences and criteria z Customer and market views of NCC Group and our capabilities, strengths and weaknesses z Assessing the commercial and portfolio logic of the current business lines within the Group As findings began to emerge from the initial scope of work in the Strategic Review, we began a parallel work stream to consider: z Assessing how we currently organise ourselves to address and capture the opportunities presented in our markets by best leveraging our strengths and unique selling propositions Key findings from the Strategic Review The key findings from the Strategic Review are set out in more detail in the later sections of this report but can be summarised as follows: Marketplace: Our markets continue to grow strongly at or around a double-digit rate. Companies’ buying decisions are more about technical expertise and value for money than a simple price basis. See page 21 for more detail. Our customers: NCC Group scores well on the issues that matter to customers: technical expertise, value for money and speed of delivery. The quality of customer service does appear to be an issue for the industry generally and NCC Group is similar in this regard. Our customers want to buy more from us and value our brand and reputation for excellence. See page 21 for more detail. Our portfolio: The two divisions of Assurance and Escrow see little crossover in customer purchasing. However, Escrow is a robust stabilising influence on the Group. Within Assurance, we have identified two service lines that would have a better opportunity to flourish under alternative ownership and these will be sold in due course. See pages 8 and 29 for more detail. As we digested the emerging outputs from the Strategic Review it became clear that to reach our full potential we would need to reorganise how we go to market and how we do business (in terms of our internal processes and structures). We have therefore started work on developing and implementing a new Target Operating Model (TOM), as further described on page 19. 18 www.nccgroup.trust Stock Code: NCC NCC AR2017 - proof 8-Front.indd 18 25546.04 9 August 2017 3:58 PM Proof Six 09/08/2017 16:04:11 Target Operating Model CEO ASSURANCE ESCROW MD NORTH AMERICA MD UK (& ROW) MD NETHERLANDS MD DENMARK HEAD OF ESCROW Sales & Marketing Sales & Marketing Sales & Marketing Sales & Marketing Operations Sales Software verification UK Sales Escrow contracts (legal) US Sales Europe Sales I G N T L U S N O C I E C V R E S D E G A N A M T C U D O R P HEAD OF ASSURANCE DELIVERY Consulting including RMG TSC IR / CDO Consulting including RMG TSC IR / CDO Consulting including RMG TSC IR / CDO Consulting including RMG TSC IR / CDO Managed Security Services Managed Security Services Managed Security Services Managed Security Services Threat Intelligence Threat Intelligence Threat Intelligence Threat Intelligence Products Products Products Products Research and Thought Leadership Finance Internal IT Legal HR CTO CFO CISO CHRO KEY: Management Sales & Marketing Consulting Managed Service Product Central Service Escrow Not currently offered 19 NCC Group plc Annual Report and Accounts for the year ended 31 May 2017 NCC AR2017 - proof 8-Front.indd 19 09/08/2017 16:04:11 25546.04 9 August 2017 3:58 PM Proof Six STRATEGIC REPORT The market opportunity Introduction Fundamentally, NCC Group is operating in a dynamic and fast growing market. Or rather, a series of related but separate fast growing markets. These statements apply whether one considers the marketplace from a product and service perspective, from a geographical perspective, or from an industry vertical perspective. Change is literally the one constant in almost all aspects of the market. Today, cyber crime is one of the single biggest threats to businesses and individuals around the world. The average cost to recover from a DDoS attack is £275,000 and more than 90 per cent of businesses have experienced some form of cyber security threat. On average, it takes almost 120 days for an organisation to find out that it has been compromised. Furthermore, from our own research into the safety of the Internet, almost two-thirds of consumers believe an online data breach will compromise their financial information within the next year. The fact that some 60 per cent of consumers are more worried than ever before about protecting their personal and financial information online should certainly confirm the threat as one of the greatest to face businesses today. Online security still seems to be behind the curve in failing to keep pace with the numerous types of organisations and individuals that seek to disrupt the Internet and organisations’ use of systems and data. The threat of being hacked or having valuable data stolen continues to evolve rapidly and at a seemingly unstoppable pace. Attacks using phishing, fake payment requests and ransomware are now everyday events. These attacks often cause significant operational disruption whose economic consequences can vastly outweigh any cost of remediation or prevention. Our challenge is to ensure that customers understand that a relatively modest up front investment in advice or other cyber services can ultimately save significant sums in remediation costs or arising from reputational damage. The world in which we live cannot be made completely safe from cybercrime. As the number and range of threats proliferate, being innovative and using our experience and skills to protect against attacks becomes more important than ever. NCC Group is doing this by providing the best security consultants to world leading clients as well as conducting world-renowned security research. Market dynamics The relevant sub-segments that NCC Group’s core cyber offering competes in are shown below: SIZE $BN* MARKET SEGMENT NCC GROUP OFFERING Fully Outsourced IT Security NCC GROUP PROVIDES LIMITED SERVICES IN THIS SEGMENT Managed Security Services MONITORING Advisory, Governance & Assessment PROCESS & GOVERNANCE Forensic & Legal Response SECURITY TESTING Operational SECURITY TESTING E C N E G L L E T N I I T A E R H T 7.0 11.0 6.0 4.0 10.0 *OC&C estimated 20 NCC AR2017 - proof 8-Front.indd 20 25546.04 9 August 2017 3:58 PM Proof Six 09/08/2017 16:04:20 www.nccgroup.trust Stock Code: NCC Customers buying behaviours and key purchasing criteria (KPCs) Customers made clear that their key buying criteria focus more on quality of technical expertise and advice as opposed to price. While value for money (effectively a ratio or a comparison of quality and cost) is very important, that reflects more on the demand for quality than low cost. This is highlighted in the chart below that shows the relative importance of customers’ Key Purchasing Criteria (i.e the factors that influence their buying decisions). Interestingly, customers did not place as high a value on the ability to source internationally. Even in those customers who did buy in multiple territories. In summary, on the items that matter most to customers in their buying decisions, NCC Group scores well or very well with the exception of customer service, which appears to be an industry-wide issue. UK 9.5% USA 12.1% Estimated CAGR 2016-20 NL 7.4% Rest of World 8.5% The addressable market is clearly very large at $38 bn in total and very fragmented. Management estimate that NCC Group is one of the largest “pure play” cyber security companies focusing on services as opposed to products but yet has relatively low market shares in most segments and geographies. Once we have developed robust and scalable internal structures and processes, this will represent a significant opportunity to grow the business profitably though bolt-on acquisitions. Market research as part of the Strategic Review also confirmed that market growth is likely to continue and that customers’ propensity to pay more for high quality advice and solutions is growing. E C N A T R O P M I G N I S A E R C N I Technical Expertise Consistently noted as having top-tier technical talent, Fox-IT seen as most technically advanced player in NL. Customer Service UK and US customers often feel NCC Group too transactional. Fox- IT customers value their trusted partnership. Value for Money NCC Group and Fox-IT generally perceived as good value. Customers very willing to pay more for quality. Speed of Delivery Seen as “mid-sized”, competing with boutique pure-plays, NCC Group advantages include wider capabilities and flexibility. Brand / Reputation Well known by security professionals in the UK and US. Fox-IT highly regarded in NL (Dutch government work). Low Price Seen to be expensive but price rarely the deciding factor. NCC Group rated highly as good “value for money”. 21 NCC Group plc Annual Report and Accounts for the year ended 31 May 2017 NCC AR2017 - proof 8-Front.indd 21 09/08/2017 16:04:28 25546.04 9 August 2017 3:58 PM Proof Six STRATEGIC REPORT The market opportunity Our competitive position We must continue to drive innovation and thought leadership in our key market segments. The key is to ensure that our thought leadership also leads to practical new solutions to apply to the challenges and issues that our customers face. We must find the right balance of “blue sky” thinking and ideas that can be rapidly commercialised. Innovation and creativity are two key foundations for the Group’s continued development and growth. Our new Target Operating Model is designed to ensure that these remain a core feature of the business. The recent and well publicised cyber attacks on a wide range of public and private enterprises around the world are a reminder of the need to constantly innovate. The graphic below shows the current range and scale of the services and products offered by NCC Group in the cyber security market. Our aim is to shift more of our business to the right and upwards; that is, more repeat business of a highly differentiated nature. During the Strategic Review we assessed the Group’s “Net Promotor Score” (NPS). This metric is widely used across a range of industries where customer satisfaction is a critical performance indicator. What NPS measures, quite simply, is whether or not a customer, on the basis of its experiences with a service provider, would recommend that service provider to another organisation. The measurement scale in NPS is itself a challenge – a positive score is counted if it rates a nine or ten out of ten. Conversely, a negative score is recorded for any outcome ranging from zero to six. What this means is that if a company received 100 scores of its service, with 10 ratings in each category, its NPS score would be negative 40. The results of the NPS survey found NCC Group with a score of “positive 26”. As noted above in the explanation of the methodology, achieving any sort of positive score is difficult and a positive score of 26 means the significant majority of ratings by customers had to be above six out of ten and with a high proportion of those scoring the top two marks. What the survey did show was that NCC Group scored better than many of its direct competitors in the Big Four or in the pure play cyber services companies. The business only rated less strongly compared to large Systems Integrators, defence contractors or product-based cyber companies. It is clear, when combined with direct interview feedback from customers, that NCC Group is well regarded for our technical expertise and its ability to help its customers overcome their cyber security challenges. INCIDENT RESPONSE HIGH ASSURANCE PROCESS & GOVERNANCE Premium products with recurring revenues THREAT INTELLIGENCE MONITORING e e e e e e e e e u u u u u u u u u n n n n n n n n n e e e e e e e e e v v v v v v v v v e e e e e e e e e r r r r r r r r r PRODUCTS Commoditised products with low levels of recurring revenue SECURITY TESTING ESCROW FREQUENCY OF PURCHASE 7 7 7 7 7 7 7 7 7 1 1 1 1 1 1 1 1 1 Y Y Y Y Y Y Y Y Y F F F F F F F F F C C C C C C C C C C C C C C C C C C N N N N N N N N N s s s s s s s s s e e e e e e e e e t t t t t t t t t a a a a a a a a a c c c c c c c c c d d d d d d d d d n n n n n n n n n i i i i i i i i i i i i i i i i i i i i i i i i i i i e e e e e e e e e z z z z z z z z z s s s s s s s s s e e e e e e e e e b b b b b b b b b b b b b b b b b b u u u u u u u u u B B B B B B B B B l l l l l l l l l : : : Y Y Y E E E K K K Ongoing www.nccgroup.trust Stock Code: NCC I I N O T A T N E R E F F D F O L E V E L I d e t a i t n e r e f f i D i d e s d r a d n a t S One-off 22 NCC AR2017 - proof 8-Front.indd 22 25546.04 9 August 2017 3:58 PM Proof Six 09/08/2017 16:04:30 Target Operating Model (TOM) Our current organisational structures and operating model have reached the limits of their design tolerances. In many cases the overlay of our business processes on those organisational design features creates a “spaghetti wiring diagram” that is complex, delivers unclear accountabilities and is undoubtedly inefficient at delivering business processes and services to customers. The recent addition of some relatively large acquisitions has emphasised further the need for a clear and transparent operating model that delivers a number of key objectives, the principal ones being as set out below. TOM OBJECTIVE 1: Align the business to how our customers want to buy The Strategic Review revealed that even our global customers tend to want to buy local services for delivery in country. This is true even for customers who have a central technology input to sourcing decisions. This finding drives the conclusion of a TOM that has a primary dimension of geographical business units and P&L accountability. TOM OBJECTIVE 2: Leverage NCC Group value between business units The business has historically operated within silos. This has been the case even inside individual business units where our structures have not encouraged service or product line leaders to cross sell or provide fully integrated solutions to our customers. Our historical Go- To-Market model was identified by customers as being too transactional in many cases. While initiatives to address this issue began during the year, the old operating model barriers to collaboration were not removed. Our customers value our technical expertise and the wide range of services that we offer. Therefore, in order to leverage value across the geographies and service lines, we concluded that a matrix structure would be appropriate for the TOM. Therefore, the secondary dimension of the TOM is based around key service and product lines with key leadership and accountability roles identified within each to ensure sharing of best practice. To avoid unnecessary cost increases or duplication of roles, there will be some “double-hatting” in smaller businesses as they grow. TOM OBJECTIVE 3: Deliver an integrated Go-To-Market proposition Our customers value our expertise and range of services. They would like to buy more from us. But our current Go-To-Market approach can make this difficult. The challenges flow from disparate accountabilities and targets for different teams within the business units. We are therefore creating aligned sales and delivery teams with single leaders within each geography. Critically, sales leadership for strategic accounts, transactional sales activities, inside sales, bid preparation and management, and supporting marketing activities will report to one person in each territory. This will allow us to join up our offerings at a more strategic purchasing level within customers while also ensuring that our current successful transactional sales generation machine continues to perform. TOM OBJECTIVE 4: Create scalable structures that facilitate profitable growth Our historical ways of working and focus on certain services and products prevent benefits of scale from being realised. Selling more of a particular service would lead to an equal and proportionate increase in our costs and hence no positive operational leverage to drive improving margins. Our staff management and work allocation processes have been less efficient than we would like. This has led to under-selling of key technical skills in that they are used on activities that attract a lower day rate than they should. As well as more accurate matching of our staff skills to the value of the work being performed for customers, we also intend to increase our focus on platform- based sales such as monitoring services and after sales value added services. In particular, these will be driven from our Security Operations Centres in Delft (Fox) and Leeds (MSS) and will include services such as Threat Intelligence, DetACT, Managed Security Services, and our CTMp platform. TOM OBJECTIVE 5: Design and implement effective and efficient business processes that support operating leverage Over the last few years our support costs have been rising steadily, creating a further erosion of operating leverage or in some cases even leading to negative operating leverage. This reflects the fact that in many cases our business processes and systems have not been upgraded to keep pace with the size and complexity of the Group. The Group has been slow in rolling out its preferred core systems and this has caused undue delays, cost increases and inefficiency in how we work. These issues extend from finance and reporting systems to CRM systems to work and staff planning and management processes and beyond. A key part of implementing the TOM is to embed effective and efficient business processes and systems within it. Over the next two years we will therefore be focusing on designing and implementing standardised business processes and making sure that they, and the underpinning systems, are rolled out across all of our business units. These systems and processes will often be designed and monitored centrally to ensure shared disciplines and effective control of the business. Underpinning all of the objectives for the TOM will be a series of direct and specific key performance indicators and other metrics that drive the desired behaviours and outcomes. For example, we will be focusing on realisation for our consultants’ time as opposed to the more simple but less informative utilisation measure. Realisation will focus on a combination of hours worked but also, critically, on the amount of work that is actually billed and the rate at which it is billed. These are currently areas where we believe there is value leakage from the Group and plugging these leaks will help to generate improved margins in future. NCC Group plc Annual Report and Accounts for the year ended 31 May 2017 NCC AR2017 - proof 8-Front.indd 23 25546.04 9 August 2017 3:58 PM Proof Six 23 09/08/2017 16:04:30 N O I T A I T N E R E F F I D F O L E V E L d e t a i t n e r e f f i D d e s i d r a d n a t S INCIDENT RESPONSE HIGH ASSURANCE Premium products with recurring revenues THREAT INTELLIGENCE PROCESS & GOVERNANCE MONITORING PRODUCTS Commoditised products with low levels of recurring revenue SECURITY TESTING ESCROW FREQUENCY OF PURCHASE One-off Ongoing e u n e v e r 7 1 Y F C C N s e t a c i d n i e z i s e l b b u B : Y E K STRATEGIC REPORT Business model HOW WE ADD VALUE DRIVING VALUE AND CAPABILITY • Threat • Risk • Defence • Capability • Technology • Scaling & efficiency STRATEGY, RISK & TECHNOLOGY • Educating • Advising • Assessing • Responding Research & Innovation Professional Services Managed Security Services Products & Cloud Services OUTSOURCED EXPERTISE WITH GLOBAL AWARENESS • Managing • Monitoring • Alerting • Responding STRATEGY, RISK & TECHNOLOGY • Safeguarding • Informing • Defending 24 www.nccgroup.trust Stock Code: NCC NCC AR2017 - proof 8-Front.indd 24 25546.04 9 August 2017 3:58 PM Proof Six 09/08/2017 16:04:31 Research & Innovation Research & Innovation forms a critical cornerstone of NCC Group’s cyber security offering. Our world-class research allows us to continually understand, discover, exploit and mitigate threats in technology, people and processes. Innovation allows us to deliver services and ensures we productise our research and development activities to be at the forefront of premium markets whilst efficiently delivering legacy commoditised services. Professional Services NCC Group’s security experts provide professional services including end-to-end services in all facets of cyber security to our clients. Educating people on topics from GDPR and crisis management to malicious code analysis We educate business leaders in cyber security, executives in compliance issues and technical teams in the lowest level facets of attack and defence. Our Netherlands training facility sees military and civilians from across the globe take part in comprehensive training programmes. Assessing strategy, maturity, people, processes and technology Our consultants work with our clients to assess their end-to- end business needs to identify and quantify risk. Our unique offering sees us work with a full spectrum of clients from cyber security transformation to assessing the technology in autonomous next generation vehicles. Responding to incidents NCC Group is recognised by both the UK and Dutch governments as a trusted partner to respond to incidents of national importance. For our commercial customers, we provide a world-class service in cyber incident response from situation management through to technical analysis and remediation. Products & Cloud Services By virtue of being exposed to a broad spectrum of client needs coupled with a culture of research and innovation, NCC Group continually looks for intellectual property development and commercialisation opportunities to create further value within the Group. This pursuit has seen us develop and acquire a rich portfolio of products and cloud services. Safeguarding: Escrow, DDI Guard Our products help ensure our clients’ data is safe with our escrow cloud service meeting modern day demands for continual deposits. Our DNS, DHCP and IP Address Management (DDI) Guard product help safeguard the network infrastructure of clients ranging from national telecommunications providers to international financial services firms. Informing: InTELL, Domain Intelligence, Cloud Security Scanning, Piranha Phishing Simulation, SOCAlive We have developed a range of managed services to proactively monitor, report and respond to issues in clients’ environments. From threat intelligence such as InTELL and Domain Intelligence through to cloud scanning of network infrastructure, we provide unique insights and cost effective solutions. Our cloud services also enable our clients to measure the performance of their cyber security investment. Examples include our Piranha Phishing Simulation platform and Security Operations Centre solutions. As investment increases with regard to cyber security, senior management are increasingly looking for key performance indicators which can be quantified. Defending: Data Diode, DDoS Protect, CTMp, Signify We have a broad range of defence products and services. Our Data Diode is accredited to levels allowing governments and critical national infrastructure to connect their networks in a safe and secure manner. Our Cyber Threat Management platform (CTMp) is the platform which NCC Group uses for its own Security Operations Centres but is available to customers who also wish to build their own. For clients looking for multi-factor authentication to mitigate weak or compromised passwords, our Signify 2 factor authentication solution provides a cost effective solution. Managed Security Services Our Security Operations Centres (SOCs) Our Security Operations Centres in the UK and the Netherlands process over 1 billion events a year across a range of managed security services. Ranging from highly sophisticated network and endpoint threat detection and response through to security infrastructure management and operations, our reach spans the globe with equipment in six of the world’s seven continents. NCC Group has leveraged its 24/7 SOCs to provide a number of new services this financial year, including providing a cyber support line to over 750,000 small and medium enterprises in the UK and various emergency response lines for cyber insurers. Managed vulnerability scanning services Our managed scanning services cover networks, applications and their source code. We provide cost effective services to our clients and their business as usual requirements, both on demand and as ongoing, annually renewing services. Our offerings scale from SMEs looking for basic accreditation and certification through to large multinationals who wish to outsource their external and internal scanning requirements to a trusted provider. NCC Group plc Annual Report and Accounts for the year ended 31 May 2017 NCC AR2017 - proof 8-Front.indd 25 25546.04 9 August 2017 3:58 PM Proof Six 25 09/08/2017 16:04:32 STRATEGIC REPORT Our strategy STRATEGIC PRIORITIES AND KEY PERFORMANCE INDICATORS Our new Strategic Plan is designed to deliver more sustainable revenue growth at improved margins, increases in shareholder value, and an improved service and product offering to customers. Strategic Priorities Rationale and current status KPIs and our performance in 2017 Focus and goals for 2018 1 Grow At a managed pace and in areas of core strength In attractive and growing markets where NCC Group enjoys strong competitive differentiators, we aim to deliver medium-term growth in excess of market rates. By focusing on higher value added services we will avoid growth for its own sake while simultaneously protecting our margins. Underlying* organic* revenue growth 2017: 3 per cent (2016: 19 per cent) Æ Implement new Go-To-Market strategy and team structures Stripping out the impact of acquisitions and changes in foreign currency exchange Æ Growth may therefore lag behind the market rates, we aim to deliver growth in the short-term broadly in line with market rates. during the year Æ Develop a clearer understanding of our pipeline and ordering processes 2 Implement Our new Target Operating Model The Strategic Review identified that we do not organise ourselves in a way that brings simplicity and efficiency to our service delivery. We will implement a new and clear operating model that delivers better customer service at an improving gross margin. Adjusted* Gross margin to improve 2017: 34.7 per cent (2016: 38.5 per cent) Æ Implement the organisation design concepts in the TOM Measured as a percentage of gross margin to annual revenue. Gross margin Æ Develop role descriptions for named being revenue less direct costs of sales and service delivery. This will be one management posts measure that shows the effectiveness and efficiency of our new TOM. Æ Implement a staff appraisal system 3 Improve Business processes and systems Our existing business processes are inefficient, and in many cases, difficult to scale. They often rely on manual activity and disparate information systems that can lead to a lack of clarity in decision-making. We will design and implement improved business processes with reduced manual interventions to lower our costs to serve. SG&A ratio to improve 2017: 23.4 per cent (2016: 19.0 per cent) Æ Focus will be on implementing new processes and systems roll out Sales and General Administration costs as a percentage of annual revenue. Æ Expect benefit to flow in the following year This KPI reflects the efficiency of our business processes and our “cost to serve”. Æ Operational leverage gains driven by more basic cost control 4 Lead Technical thinking and product development In a rapidly evolving and dynamic market sector 5 Develop Our people to allow them to reach their full potential and contribute fully to NCC Group The market is evolving so quickly that we need to be at the forefront of developing new services and responses to address emerging threats. Our customers’ needs are also changing; not just in response to new threats but also in respect of how and where they carry out their business. We need to respond to those changes in how we position ourselves and our services. Engagement with thought leadership content across all mediums and Æ Continued demonstration that NCC Group has a resulting inbound activity. holistic view of cyber security Æ Understanding of opportunities and risk associated with emerging technologies Æ Brand growth with non-traditional audiences All of our key strategic goals will rely fundamentally on our people and their skills so we need to ensure that we attract and retain high quality staff. We need to ensure they are properly trained, gain the right experience and are also properly incentivised – by recognition and the working environment as much as by reward. Employee turnover 21.8 per cent Employee engagement survey data from June 2017 will be used to develop some additional, appropriate KPIs here. Æ We will develop and implement employee performance appraisal and development systems 26 www.nccgroup.trust Stock Code: NCC NCC AR2017 - proof 8-Front.indd 26 25546.04 9 August 2017 3:58 PM Proof Six 09/08/2017 16:04:32 We are developing a new set of KPIs that align more closely to our strategic priorities. Some of these are still under development as noted below. We will report on each one as we implement our strategy. Strategic Priorities Rationale and current status KPIs and our performance in 2017 Focus and goals for 2018 1 Grow At a managed pace and in areas of core strength In attractive and growing markets where NCC Group enjoys strong competitive differentiators, we aim to deliver medium-term growth in excess of market rates. By focusing on higher value added services we will avoid growth for its own sake while simultaneously protecting our margins. Underlying* organic* revenue growth 2017: 3 per cent (2016: 19 per cent) Æ Implement new Go-To-Market strategy and team structures Stripping out the impact of acquisitions and changes in foreign currency exchange rates, we aim to deliver growth in the short-term broadly in line with market rates. Æ Growth may therefore lag behind the market during the year Æ Develop a clearer understanding of our pipeline and ordering processes 2 Implement Our new Target Operating Model The Strategic Review identified that we do not organise ourselves in a way that brings simplicity and efficiency to our service delivery. We will implement a new and clear operating model that delivers better customer service at an improving gross margin. Adjusted* Gross margin to improve 2017: 34.7 per cent (2016: 38.5 per cent) Measured as a percentage of gross margin to annual revenue. Gross margin being revenue less direct costs of sales and service delivery. This will be one measure that shows the effectiveness and efficiency of our new TOM. Æ Implement the organisation design concepts in the TOM Æ Develop role descriptions for named management posts Æ Implement a staff appraisal system 3 Improve Business processes and systems 4 Lead Technical thinking and product development In a rapidly evolving and dynamic market sector 5 Develop Our people to allow them to reach their full potential and contribute fully to NCC Group Our existing business processes are inefficient, and in many cases, difficult to scale. They often rely on manual activity and disparate information systems that can lead to a lack of SG&A ratio to improve 2017: 23.4 per cent (2016: 19.0 per cent) Æ Focus will be on implementing new processes and systems roll out clarity in decision-making. We will design and implement improved business processes with reduced manual interventions to lower our costs to serve. Sales and General Administration costs as a percentage of annual revenue. This KPI reflects the efficiency of our business processes and our “cost to serve”. Æ Expect benefit to flow in the following year Æ Operational leverage gains driven by more basic cost control The market is evolving so quickly that we need to be at the forefront of developing new services and responses to address emerging threats. Our customers’ needs are also changing; not just in response to new threats but also in respect of how and where they carry out their business. We need to respond to those changes in how we position ourselves and our services. NEW Engagement with thought leadership content across all mediums and resulting inbound activity. Æ Continued demonstration that NCC Group has a holistic view of cyber security Æ Understanding of opportunities and risk associated with emerging technologies Æ Brand growth with non-traditional audiences All of our key strategic goals will rely fundamentally on our people and their skills so we need to ensure that we attract and retain high quality staff. We need to ensure they are properly trained, gain the right experience and are also properly incentivised – by recognition and the working environment as much as by reward. Employee turnover 21.8 per cent NEW Employee engagement survey data from June 2017 will be used to develop some additional, appropriate KPIs here. Æ We will develop and implement employee performance appraisal and development systems * Terms defined in the Glossary KEY: Performance below prior year Performance in line with prior year Performance above prior year NCC Group plc Annual Report and Accounts for the year ended 31 May 2017 27 NCC AR2017 - proof 8-Front.indd 27 09/08/2017 16:04:33 25546.04 9 August 2017 3:58 PM Proof Six STRATEGIC REPORT Q&A WITH CHRIS STONE AND BRIAN TENNER You are both new to the business. What have been your strongest first impressions? Chris: Firstly, I would like to record my own and the Board’s sincere thanks to all of the Group’s employees who have maintained their focus on delivering excellent service to our customers. Meeting the unique and brilliant staff at NCC Group has strongly reinforced my belief in the inherent untapped potential in this business – potential that has been suppressed by a failure to scale business process with our growing capabilities. Our business is not broken – indeed it has some notable strengths, both financial and operational – which I have stressed with all the staff I have met. We have a business with enormous potential. Brian: Our staff are the foundation of the value inherent in the business and I have been endlessly impressed by all those who I have met since joining, their passion and their expertise. We address exciting markets which continue to grow strongly at or around a double-digit rate. What has been clear to me since joining is that our technical expertise and reputation for excellence to address these markets is unparalleled. It’s been a difficult year. What have been the toughest challenges? Brian: The past year has been very challenging, both operationally and financially. Business performance has fallen short of expectations and we have outgrown some of our business processes and controls. The outlook for the business remains very positive in fast growing international markets. Our challenge now is to manage the transition from one business model to another, as the growth in scale and complexity has made our early stage model ineffective. Chris: Substantial acquisitions and overlaying business processes has made our operating model a “spaghetti wiring diagram” that we have needed to unravel for the benefit of ourselves, our shareholders and our clients. One of the key challenges that we face is transforming this operating model and our reporting, to disclose fully and in as transparent a way as possible, the value held within our business and the potential that has been suppressed by inefficient and outdated processes. What are the priorities for the new financial year? Chris: There is a lot of work to do to implement new processes, systems and structures. We have a tremendous opportunity in fast growing international markets, with a range of innovative products and services. The challenge is to execute effectively the planned changes in strategy and operating model. We are confident that the Group can deliver sustainable earnings growth and enhanced shareholder value, once more robust foundations are in place. Brian: Our priority for the new financial year is to efficiently implement the Strategic Plan and new Target Operating Model that was born out of the Strategic Review of the business. We now need to create structures and products that allow us to benefit from our scale and deliver additional value for our customers while never losing sight of our core competencies and strengths, most notably represented in our staff, their energy and their commitment. 28 www.nccgroup.trust Stock Code: NCC NCC AR2017 - proof 8-Front.indd 28 25546.04 9 August 2017 3:58 PM Proof Six 09/08/2017 16:04:38 What are the objectives for the new Target Operating Model (TOM)? Brian: Our TOM has five objectives. z First, align the business to how our customers want to buy. z Second, leverage our value between our business units. z Third, deliver an integrated Go-To-Market proposition. z Fourth, create scalable structures that facilitate profitable growth. z Fifth, design and implement effective and efficient business processes that support operating leverage. Once the TOM is in place, we are confident that we can deliver sustainable earnings growth and enhanced shareholder value. Chris: Innovation and creativity are two key foundations for our continued development and growth. Our new TOM is designed to ensure that these remain a core feature of the business. Our aim is to shift the current range and scale of the services and products offered by the business in the cyber security market to more repeat business of a highly differentiated nature. How will the new TOM work? Chris: A key part of implementing the TOM is to embed effective and efficient business processes and systems within it. Over the next two years we will therefore be focusing on designing and implementing standardised business processes and making sure that they, and the underpinning systems, are rolled out across all of our business units. These systems and processes will often be designed and monitored centrally to ensure shared disciplines and effective control of the business. Brian: Underpinning all of the objectives for the TOM will be a series of direct and specific key performance indicators and other metrics that drive the desired behaviours and outcomes. For example, we will be focusing on realisation for our consultants’ time as opposed to the more simple but less informative utilisation measure. Realisation will focus on a combination of hours worked but also, critically, on the amount of work that is actually billed and the rate at which it is billed. These are currently areas where we believe there is value leakage from the business and plugging these leaks will help to generate improved margins in future. Which business processes and systems need closing? Brian: Our historical ways of working, and focus on certain services and products, prevent benefits of scale from being realised. Selling more of a particular service would lead to an equal and proportionate increase in our costs and hence no positive operational leverage to drive improving margins. As well as more accurate matching of our staff skills to the value of the work being performed for customers, we also intend to increase our focus on platform-based sales such as monitoring services and after sales value added services. Chris: The years ahead present significant upside opportunities. Strong value creation will result if we effectively implement our new strategy and successfully manage the Group through the transitional period in which we now find ourselves. Our business is not broken and we will not be closing but optimising the processes that are in place. Within Assurance, the Web Performance and Software Testing businesses were found to have little cross over with the core consulting business and will be sold over the next year. What are the plans for developing our people in the years ahead? Chris: Our business is entirely reliant on the skills and experience of our staff. We are fortunate to have them choose to build their careers with NCC Group, and I look forward to working with all of them as we take it forward. Brian: Our staff are the foundation for most of the value inherent in the business. In developing and implementing our new Strategic Plan and TOM we will work to ensure that we create a working environment that values the individual and allows each one of us to contribute to our full potential. This will include creating organisational values and clearer structures, roles and responsibilities. The coming financial year will also see a greater focus on personal development and training. NCC Group plc Annual Report and Accounts for the year ended 31 May 2017 NCC AR2017 - proof 8-Front.indd 29 25546.04 9 August 2017 3:58 PM Proof Six 29 09/08/2017 16:04:38 STRATEGIC REPORT Interim Chief Executive’s review OUR PERFORMANCE Group revenue For the financial year ended 31 May 2017, the Group increased reported revenue by 17 per cent to £244.5m (2016: £209.1m). Excluding Domain Services business that was exited during the year, the growth was £37.7m or 18 per cent. The table below shows the proportions of growth that were organic (net sales growth in businesses that were owned for equivalent periods in the current and prior year), acquisitions growth (includes the full year impact of prior year acquisitions), and growth resulting from the impact of FX rates. Growth from changes in FX rates is calculated by restating the prior year revenue figures at current year rates. Growth driver (excluding Domain) Organic Acquisition FX Total growth 2017 £m 6.8 21.1 9.8 37.7 2017 % growth 3 10 5 18 Note: the Group’s current information systems do not report the impact of foreign exchange movements as a matter of course. The figures above are therefore calculated at year end using assumed weighted average exchange rates for each relevant currency for each year in question. This is being addressed in the Group’s new consolidation system which is being implemented in the first quarter of the new financial year. The FX growth above is driven by increases in the weighted average exchange rates of both the US$ and €uro against £GBP, both of which strengthened by around 15 per cent. The geographical breakdown of revenue by the location of the delivering business for the current and past year is as follows (Domain excluded): 2017 2016 £m 147.1 58.4 36.4 % 61 24 15 £m 144.4 39.2 20.6 % 71 19 10 UK US Europe and RoW Total revenue 241.9 100 204.2 100 Note: some businesses sell a modest amount of services in other countries and report that revenue as being within their own geography. The amount of Group revenue earned outside the UK increased by £35.0m and reflects the impact of the Fox- IT acquisition in the Netherlands half way through the last financial year and also strong growth in our US Assurance business. Both of these factors occurred within the Assurance division where the share of Group revenue has now risen to 85 per cent (2016: 83 per cent). Underlying organic revenue growth in the first half of the financial year was 19 per cent but in the second half fell by 5 per cent compared to the prior year periods. The second half of the current year actually saw revenue fall compared to the first half, contrary to the historical trends the business has delivered. Weakness in the second half compared to the prior year and the first half of the current year was particularly focused in MSS third party product sales which were £6.5m down in the second half compared to the first half. 30 www.nccgroup.trust Stock Code: NCC NCC AR2017 - proof 8-Front.indd 30 25546.04 9 August 2017 3:58 PM Proof Six 09/08/2017 16:04:43 Revenue by location 2017 Total Revenue £241.9m UK £147.1m 60.8% US £58.4m 24.1% Europe and RoW £36.4m 15.0% 2016 Total Revenue £204.2m UK £144.4m 70.7% US £39.2m 19.2% Europe and RoW £20.6m 10.1% The table below sets out the reconciliation between reported statutory measures and the non-GAAP measures of Adjusted EBIT and Adjusted EBITDA. Reported operating (loss) / profit Results of Domain Services (exited) Individually significant items (detailed below) Amortisation of acquired intangible assets Share based payments Adjusted EBIT Depreciation Amortisation of software and capitalised development costs Adjusted EBITDA 2017 £m (53.4) (1.0) 71.0 10.3 0.6 27.5 5.2 3.5 36.2 2016 £m 11.4 1.4 18.9 6.8 1.2 39.7 3.7 1.6 45.0 Fox High Assurance product sales were also down £1.2m in the second half. Between them these reductions accounted for 85 per cent of the fall in sales between the first and second halves. A more detailed breakdown of the revenue performance of the Group in each of the operating segments is shown earlier in this announcement in the Assurance and Escrow divisional reports. The Group is currently reviewing the basis on which revenue analysis is further reported. This review will include concepts such as recurring revenues, contracted revenues and repeat business. The Group may need to implement systems changes to accurately capture this analysis across all business units. Some further analysis is set out in the divisional reviews. The Group continued to have minimal reliance on any one customer or sector. Within Assurance the largest customer represents approximately 4 per cent of Assurance revenue. The largest customer in Escrow is just over 1 per cent of total Escrow revenue. Group profitability and margins The Board and Executive management use a number of non-GAAP measures in their day-to-day management of the business. The Group’s primary financial profitability measure will be Adjusted EBIT. Last year the Group used Adjusted EBITDA for this purpose. It is management’s view that Adjusted EBIT is more closely aligned to the underlying performance of the business. The majority of our peers and stakeholders use this metric, and hence it is therefore a more appropriate KPI for use in the business and in our external communications. NCC Group plc Annual Report and Accounts for the year ended 31 May 2017 31 NCC AR2017 - proof 8-Front.indd 31 09/08/2017 16:04:44 25546.04 9 August 2017 3:58 PM Proof Six STRATEGIC REPORT Interim Chief Executive’s review OUR PERFORMANCE During the year, despite delivering growth in most of our business units, each business unit and the Group as a whole have seen a contraction in our margins. The main cause relates to cost increasing both before and at a faster rate than the growth in our revenues in each business unit. Margins contracted due to increases in both direct and indirect costs. Salary related costs represent approximately 70 per cent of the Group’s cost base. Cost increases were largely driven by a significant increase in headcount (16 per cent) combined with average salary increases of 6-7 per cent to give total salary-based cost increases of approximately 23 per cent, or around 16 per cent of sales. This compares with total organic and acquisition-based revenue growth of 15 per cent and led to a consequent reduction in utilisation and realisation from our professional service delivery staff. We also made investments in new sales structures that have not yet born fruit in proportionately increased revenues. Other indirect cost increases reflect £3.4m of additional depreciation and amortisation of tangible and intangible assets linked to a number of systems having entered service, and hence these have started amortising. In addition, there was a £1.3m acquisition impact on these costs. Premises costs increased by £1.4m, partly to accommodate extra staff and also in upgrading facilities. Marketing spend rose £1.3m as the Group sought to raise its profile in a number of areas. As a result, Adjusted EBIT in the year fell from £39.7m to £27.5m despite the benefit of a positive foreign exchange impact of £0.6m. At the same time, our Adjusted EBIT margin fell from 19.4 per cent to11.4 per cent. The following shows the key drivers for the reduction in year-on-year profitability. The Group’s overall EBIT result included £0.2m of losses from the now closed Domain Services operating segment (2016: operating losses of £1.4m). The current year charge was then offset by a £1.2m profit on disposal of Open Registry (also treated as an adjusting item). The Group’s reported pre-tax loss was £55.3m (2016: £9.4m profit). Adjusted EBIT bridge £m 50.0 45.0 40.0 35.0 30.0 25.0 20.0 39.7 0.6 2.5 2.6 7.5 2016 FX Acq’ns Organic GM% G&A D&A 2017 7.7 2.7 27.5 32 www.nccgroup.trust Stock Code: NCC NCC AR2017 - proof 8-Front.indd 32 25546.04 9 August 2017 3:58 PM Proof Six 09/08/2017 16:04:51 How we are part of your daily life ASSURANCE — SAFEGUARDING HEALTHCARE HOW NCC GROUP’S SECURITY OPERATIONS CENTRE RESPONDED TO A GLOBAL RANSOMWARE OUTBREAK. One of the biggest ransomware attacks in recent history started somewhere in Europe on the morning of Friday 12 May 2017. Over the course of the WannaCry attack, our Security Operations Centres carried out the following activities: Unnoticed for several hours, it circulated itself across the globe, infecting computers by exploiting a weakness in Windows operating systems that allows malicious code to be spread through file-sharing structures without a user’s consent. In the UK, the National Health Service (NHS) was the most high-profile victim. Nearly one-third (30 per cent) of all NHS Trusts were affected, with staff being forced to turn patients away and cancel appointments. Victims in other countries include US delivery service FedEx, French car maker Renault and Russia’s Interior Ministry. The malware, called WannaDecrypter, WannaCry or WCry, spread easily due to its ability to self-propagate; an instruction in the malicious code told it to jump to other vulnerable machines if it cannot connect to a specified address. This is reminiscent of the worm outbreaks of the early 2000s. How our business model enables this In these crisis situations, NCC Group’s 24/7 Security Operations Centres and managed services capability demonstrate their worth. Working around the clock, the team consistently delivers value and reassurance to customers across the globe, taking proactive steps to protect our customers and enhance our monitoring as new information and Indicators of Compromise (IoCs) become available. z Provided expert analysis of the threat and offered pragmatic advice to all our SOC customers z Developed and then enhanced advanced SIEM correlation logic to monitor for attacks on customer networks, using IoC information provided from the Threat Intelligence (TI) research by NCC Group analysts z Used NCC Group’s threat sensors to proactively monitor for IoCs z Ensured commercial Intrusion Protection Systems (IPS) signature sets were up-to-date and monitored for the latest threats z Delivered 24/7 security monitoring, proactively watching for attacks and infection z Updated our SOC customers on a regular basis, including direct telephone calls to ensure that they were aware of the attack and to give them reassurance and assurance How we will leverage this moving forward As large-scale cyber attacks continue to occur on an ever-more frequent basis, it is important that your organisation is protected by utilising NCC Group’s 24/7 Security Operations Centres and range of protective monitoring managed services. As a result of these proactive steps and measures, NCC Group’s SOC received the following feedback and praise: “We have indeed received a note from the NCC Group SOC as part of the Network Threat Monitoring service, outlining the details of the attack and what to do to prevent damage – greatly appreciated. As always, we value the services that NCC Group brings to the table and are confident that our layered defense would offer the necessary resilience in this situation.” INTERNATIONAL EDUCATIONAL FOUNDATION, NCC GROUP NTM CLIENT Read more online at www.nccgroup.trust/uk/our-services/security–consulting/ technical–security–consulting NCC Group plc Annual Report and Accounts for the year ended 31 May 2017 NCC AR2017 - proof 8-Front.indd 33 25546.04 9 August 2017 3:58 PM Proof Six 33 09/08/2017 16:04:55 STRATEGIC REPORT Interim Chief Executive’s review OUR PERFORMANCE ASSURANCE DIVISION – BUSINESS PERFORMANCE REVIEW Assurance revenue Assurance now accounts for 85 per cent of Group revenue and the impact of foreign exchange rates contributed £8.0m to the growth in the division. In addition, Assurance benefited from the full year effect of the prior year acquisition of Fox-IT (impact in 2017: £14.0m) and acquisitions in the year just completed (PSC £5.9m and VSR £1.1m). Net organic growth was £6.8m which represented year-on-year growth of 4.0 per cent with the balance due to changes in foreign exchange rates (£8.0m impact). The table below shows the revenue split between Security Consulting and a combined Web Performance and Software Testing. The Assurance division saw very mixed revenue results during the year. While the headline growth rate for the Security Consulting activities is very attractive, some business lines saw better performance than others. The underlying performance of the Security Consulting business lines is much easier to understand by using constant currency and also by splitting performance between organic and acquisition based growth. Assurance revenue is broken down into more detail in the table below in terms of the impact of changes in foreign exchange rate, the impact of acquisitions in both the prior year and the year under review, and the “organic” performance of a number of operating units within Security Consulting: Assurance revenue 31 May 2017 £m 31 May 2016 £m % Change Security Consulting 178.1 138.9 Web Performance and Software Testing Total 26.6 30.0 204.7 168.9 28 (11) 21 Revenues in our Web Performance and Software Testing businesses fell by £0.5m (5 per cent) and £2.9m (14 per cent) respectively. In Web Performance we felt the impact of a slower take up than expected for a new service line and have taken an impairment charge on this business. In Software Testing the loss of a project that was already underway at the start of the year, following a strategic decision to cancel a divestment by the customer, had a negative impact on both revenue and costs as utilisation rates for permanent staff fell. Towards the end of the financial year, both Web Performance and Software Testing businesses saw a pick up in sales pipeline opportunities and also in some longer term contract wins. The table above can act as a guide to the impact on revenue of the proposed disposals of the Web Performance and Software Testing businesses during the course of the new financial year ending 31 May 2018. Neither business is particularly seasonal and therefore any reduction to the Group total turnover following the disposals is likely to be pro rated to the point in the new year when the businesses are sold. Assurance revenue bridge Revenue for the year ended 31 May 2016 Impact of FX changes Full year of owning Fox-IT PSC acquisition this year VSR acquisition this year Net revenue growth from FX and acquisitions UK Consulting organic growth US Consulting organic growth Fox-IT – excluding High Assurance Fox-IT – High Assurance MSS – excluding product sales MSS – product sales Other including Web Performance and Software Testing Net organic growth Total Assurance revenue growth Revenue for the year ended 31 May 2017 Growth £m £m Growth % 8.0 14.0 5.9 1.1 11.0 5.3 1.6 (3.6) 2.8 (7.4) (2.9) 168.9 29.0 6.8 35.8 204.7 17 19 24 17 (53) 17 (48) 5 21 34 www.nccgroup.trust Stock Code: NCC NCC AR2017 - proof 8-Front.indd 34 25546.04 9 August 2017 3:58 PM Proof Six 09/08/2017 16:04:55 We have not pursued these sorts of sales as strongly as in previous years. Instead, where we continue to sell third party products, we will aim to link those purchases to implementation consulting advice and after sales services such as monitoring in our Leeds based Security Operations Centre (SOC). While the revenue would have helped the year’s results, we are not overly concerned as we seek to deliberately rebalance the business away from single transaction reselling of third party products. Similar to Fox, in the areas of the business where we do see longer term value and growth potential, the service lines grew by 17 per cent year-on-year. The summary of the Assurance revenue is: z Good growth was delivered in those areas where we want to place our future focus as this is where scalable margin recovery can be created. z Fox-HA will start to recover in the coming year. z Reselling third party products in MSS in the medium-term will be continued if we can create linkages to our own value added after sales services. z Acquisitions and FX also played a strong supporting role in the revenue growth story. 15% Assurance revenue by service type Professional services 45% Managed Security Services 25% Own product and other 20% Third party product 15% The table on the opposite page highlights the number and variety of moving parts in explaining this year’s revenue performance. The impact of changes in FX rates and acquisitions are clearly shown in the top half of the table. For the purposes of this analysis, given that Fox-IT was acquired at the end of November 2015, the whole of the first half of the current financial year’s revenue has been attributed to the impact of the acquisition. Growth in UK and US consulting revenues was very healthy, representing growth of 19 per cent and 24 per cent respectively on a constant currency basis. This was driven by a combination of market growth and our ability to capture share due to our scale. In addition, we have been bringing new products to market and continuing to expand our focus areas beyond transactional activity. Within Fox-IT we saw two strong opposing forces. As previously announced, a key customer for Fox High Assurance products (Fox-HA) significantly slowed down its purchases from the business following the change in ownership of the company. It is clear that we should have engaged with this customer in a transparent way ahead of the acquisition to allay some of their concerns. However, we have since been working hard and collaboratively to allay the concerns of the customer and we are starting to see some new orders coming in for Fox-HA products from this critical customer. If momentum is maintained we should see some growth in this service line in the new financial year compared to the year ending 31 May 2017. In sharp contrast to Fox-HA, the other Fox service lines saw organic growth of 17 per cent in the second half of the year compared to the same period of ownership in the prior year. In particular, our CTMp platform and Threat Intelligence made promising progress. This is particularly pleasing in that both of these are key service lines that we aim to expand within the Netherlands and then to leverage in other NCC Group locations. The scalability of the CTMp platform will also support margin recovery. It is for this reason and the emerging recovery in Fox-HA, that while the execution challenges for the business are reflected in the impairment of around 30 per cent of the goodwill associated with the acquisition, we remain confident about the prospects for the Fox-IT business and its capability to support a broader platform of scalable high value add services across NCC Group. In MSS we also saw two conflicting but slightly different themes from those in Fox. The negative force there has been in the resale of third party products which fell by £7.4m compared to the prior year, equating to a fall of 48 per cent, and a fall in 2017 second half sales of products of almost 90 per cent to £0.7m. The fall partly reflects the end of an earn-out period that had been put in place when the business was acquired by the previous owners and subsequently extended by NCC Group . In addition, we are trying to change our focus to higher value add activities and the building of long-term relationships with our customers. NCC Group plc Annual Report and Accounts for the year ended 31 May 2017 NCC AR2017 - proof 8-Front.indd 35 25546.04 9 August 2017 3:58 PM Proof Six 35 09/08/2017 16:04:56 STRATEGIC REPORT Interim Chief Executive’s review OUR PERFORMANCE ASSURANCE DIVISION – BUSINESS PERFORMANCE REVIEW The table below is based on an estimated split of our Assurance revenue streams based on currently available information. As noted elsewhere, we will be improving the quality and granularity as well as the relevance of our internal management information systems over the coming years. The data is, however, accurate enough to give a broad indication of the split of revenue streams. Assurance revenue 2017 2016 £m % of total £m % of total Consulting services 156.1 76.2 122.4 72.5 Managed services Product sales Total 24.9 23.8 12.1 11.6 11.8 34.7 7.0 20.5 204.7 100.0 168.9 100.0 While revenue grew in total by £35.8m (21 per cent), the absolute level of operating profit fell year-on-year by £9.1m (35 per cent). The fall in operating profit is all the more stark because it is after the positive impact of foreign exchange gains of £0.4m and the benefit of acquisitions. The acquisition benefits were from a full year of ownership of Fox-IT (£0.5m) and part year ownership of PSC and VSR (£1.7m benefit). The underlying business performance in the Assurance division generated £11.3m less operating profit than last year (down 44 per cent) on £6.8m organic revenue growth. Adjusted EBIT margins fell to 8.2 per cent (2016: 15.3 per cent). The most significant driver for this was the increase in overall salary costs. Our consulting businesses in the UK and US both saw a fall in absolute profitability as a lack of control over the cost base meant that it grew faster than our revenue streams. In particular, this reflected a strategy to build sales and delivery teams ahead of equivalent revenue growth and that led to margins being compressed in both businesses at a gross margin and EBIT margin level. At the same time, the Group was starting to develop its strategic sales capability to allow us to move further up our customers’ internal purchasing decision chains to become less transactional and more strategic in approach. That investment has been slower than anticipated in bearing fruit. The Assurance business will typically see one or two major unplanned contract wins in any particular year. These can be related to the reaction to a major event at a customer or a specific proactive project such as corporate activity. In the year to May 2017, the division did not have a material benefit Revenue ‘type’ Consulting services 76% Managed services 12% Product sales 12% from any such contracts and actually suffered from the loss of some. In one specific case, a large-scale Software Testing project (referenced above) was already underway with staff deployed on the ground. When the customer discontinued the contract the revenue stream stopped very quickly in the first half, whereas it had been expected to run for most of the year. A second large-scale project was cancelled before it began. In the third, which had not become a contracted order but had been a firm prospect as NCC Group was the preferred supplier for that type of work, the customer decided not to proceed with the work. The estimated potential revenue from the three contracts was around £14-17m and £6-7m of gross margin (based on a gross margin assumption of 40 per cent). Approximately £7-10m of this revenue had been included in the Group’s operating plan at the start of the year. The most challenged part of the Assurance division was MSS which saw a fall in revenue of £4.6m (14 per cent). As noted earlier, while much of the revenue fall related to less attractive sales of third party products, the gross margin delivered would still have been a helpful contribution towards the overhead base. Similarly to the consulting businesses, in MSS the Group set about rebalancing the sales efforts and teams towards strategic and higher value added sales of customer solutions, comprising product, professional services and managed services. While we are confident that this is the correct approach in the medium-term, the short term impact was to increase our cost base at a time when revenues were falling. There was also the impact of ongoing integration challenges for the MSS service lines (acquired under the Accumuli plc transaction). 36 www.nccgroup.trust Stock Code: NCC NCC AR2017 - proof 8-Front.indd 36 25546.04 9 August 2017 3:58 PM Proof Six 09/08/2017 16:04:57 How we are part of your daily life ASSURANCE — SECURING SUPPLY CHAINS Consulting services 76% Managed services 12% Product sales 12% HOW SUPPLIER ASSURED SERVICES HELP ENSURE SECURE AND ROBUST SUPPLY CHAINS Supplier Assured Effective information security comprises a number of internal factors that are directly within an organisation’s control – e.g. technologies, governance, processes and people. Other factors can be outside of an organisation’s control such as interactions with suppliers. Third party suppliers can be an attractive way for cyber criminals to gain access to data and networks that would otherwise be beyond their reach. A huge range of external suppliers, from marketing to accountants to legal firms, may all hold intellectual property or sensitive personal information on employees and clients or may provide access into an organisation’s environment. In order to avoid costly damage to customer confidence, reputation and ultimately the share price, organisations must ensure comprehensive security audits of third party suppliers and partners are carried out and that all necessary security measures are being implemented and maintained. The service is made up of four key pillars: 1. Supplier Landscape Assessment: We will conduct a questionnaire based risk assessment on your entire supplier landscape to help you identify your high risk suppliers and quantify how they impact your organisation’s data and technologies. 2. Supplier Audit: Suppliers will be asked to complete a 14 domain control self-assessment to ensure they have appropriate security controls to mitigate key risks. We will review the results of this self-assessment and select suppliers for on-site audits to ensure that risks are captured fully and effectively. 3. Supplier Remediation Management: We can help manage supplier risk remediation programmes by advising on measurable solutions that allow client continued assurance that risks are managed in line with business objectives. Lessons learnt from all remediation activities will be passed throughout the client organisation and its supply chain. 4. Supplier Management Strategy and Remediation: We can help strengthen the effectiveness of your supplier management programmes by providing assistance where you need it. We can help assess and build security controls, policies and procedures, on-boarding security requirements, off-boarding requirements etc. and assist in embedding this in your target operating model. NCC Group understands that organisations are using an increased number of suppliers, and on-site audits for the whole supply chain is not financially or operationally feasible. NCC Group has therefore developed a risk based approach to help organisations gain assurance that information security risks and requirements such as GDPR are managed effectively for their suppliers. NCC Group works with a number of large organisations to successfully deliver this service in a modular fashion. Its Supplier Assured managed service is based on a secure portal platform to pseudo-automate the supplier review process and remove the traditional email and spreadsheet supplier review approach which can quickly become unmanageable for a large number of suppliers. How our business model enables this NCC Group has worked for a number of years auditing and assessing our clients’ supply chains to ensure that they are secure and robust. As such, we have made a significant investment in people, processes and technology associated with this. More recently, we have developed an end-to-end “Supplier Assured” managed service utilising a combination of on-site assessments and a remote questionnaire and evidence based validation to deliver a cost effective solution to our clients’ third party security. For one well known supermarket chain we have recently undertaken a proof of concept exercise prior to a full roll out of the service, enabling the client to gain a clear understanding of the supplier risk landscape and also develop, implement and manage an appropriate remediation approach. Over 2,000 suppliers were ranked and the top 50 were selected for assessment by NCC Group. To ensure new suppliers were included within the tracker, a short-term due diligence process was developed with a strategic plan to fully mature the process. How we will leverage this going forward As the supply chain threat continues to increase, NCC Group will place more emphasis on our Supplier Assured service. Utilising well established processes, procedures and tooling we will be able to onboard more clients into the service, enabling our clients to gain benefit from both cost savings and a well established and experienced team. We will also continue to revise, amend and improve our Supplier Assured framework, utilising the experience we gain from delivering in excess of 1,000 assessments. Read more online at www.nccgroup.trust/uk/our-services/security– consulting/information–risk–management-and- governance/supplier–assured NCC Group plc Annual Report and Accounts for the year ended 31 May 2017 37 NCC AR2017 - proof 8-Front.indd 37 09/08/2017 16:04:59 25546.04 9 August 2017 3:58 PM Proof Six STRATEGIC REPORT How we are part of your daily life ASSURANCE — FINANCIAL NETWORKS HOW THREAT INTELLIGENCE, FRAUD DETECTION, INCIDENT RESPONSE AND RED TEAMING SERVICES INCREASE RESILIENCE OF FINANCIAL SERVICES The financial services sector has dealt with online criminal threats for nearly two decades yet the threats are ever increasing. Various types of criminals, and at times, nation states, have targeted their continuously evolving techniques for financial gain at banks and other financial institutions and their customers across the globe. In addition, espionage is a real and continuous threat for many organisations including financial services and governments. A defining feature of espionage is that it involves stealing of confidential or sensitive information such as intellectual property or PII and that it is designed to go unnoticed. The information may be used for competitive advantage or to support geopolitical goals. The damage resulting from espionage campaigns is often material and the impact can sometimes only be gauged after time. How our business model enables resilient finance NCC Group’s Dutch based subsidiary, Fox-IT, has tracked criminal threat groups ever since the first attacks on online banking, giving us unique insight into criminal organisations, their modus operandi and the tools that they use. We use this insight and our knowledge to provide financial institutions with very specific and real-time information to detect and mitigate attacks along with contextual information about the individuals that may be unwittingly involved in fraud. In 2010, one of the largest banks in the Netherlands approached Fox-IT to help tackle the problem of fraud. Together, Fox-IT and the bank developed an innovative fraud detection platform (DetACT) as a means to directly operationalise our threat intelligence in order to help combat attacks such as Internet banking and credit card fraud. Other banks in the Netherlands joined later in our efforts to reduce damages as a result of Internet banking fraud, which peaked to €33m in 2012. Last year, fraud damages were less than €1m for the first time since 2007 in the Dutch market. Fox-IT is proud to have significantly contributed to this successful reduction in risk to the Dutch banking system. Globally, financial regulators are increasing the scrutiny of their markets with regards to demonstrated cyber resilience with the UK and the Netherlands leading these efforts today. NCC Group, as a Bank of England approved provider under the CBEST scheme, and Fox-IT, with wider NCC Group support as a De Nederlandsche Bank for TIBER scheme, is well placed in the market. These accreditations have resulted in NCC Group performing red team engagements for some of the most prolific financial market infrastructure providers and institutions in the UK, the Netherlands and the wider European market. How we will leverage this going forward Fox-IT continues to track criminal groups in order to understand how they work and predict what they will do next. The more recent blending of criminal and espionage operations shows the importance of following these threats closely. This in turn helps continuously improve Fox-IT’s fraud detection platform and it also feeds its Managed Detection and Response (MDR) platform with threats intelligence in order to provide rapid detection of these threats at earlier stages, when criminals infect systems that they can later use to carry out fraud. Additionally, our fraud detection platform gained traction in other parts of Europe, where we are currently helping banks fight fraud. Incident Response assignments are opportunities to see attackers live at work. They provide valuable information about the attacker’s means, motives and technical indicators of successful attacks. Fox-IT and NCC Group use information gained from such cases in multiple ways. First and foremost, we use it to detect new attacks with our MDR platform that protects all our customers. We also use the information for historic analysis to determine if any of our other customers has been the victim of an attack similar in nature. The insights we obtained during the IR case often lead to innovations in our MDR platform, thus continuously improving the platform. Lastly, any information about the attackers is used by our threat analysts as a starting point for further investigation into that attacker. For red teaming in the financial sector, as Singapore, Hong Kong, the European Central Bank and other regulators implement robust resilience programmes, NCC Group’s experience, global reach, scale and technical investment means we are well placed to capitalise on market opportunities. 38 Read more online at www.nccgroup.trust/uk/our–services/security–consulting/ cyber-defence-operations www.nccgroup.trust Stock Code: NCC NCC AR2017 - proof 8-Front.indd 38 25546.04 9 August 2017 3:58 PM Proof Six 09/08/2017 16:05:03 How we are part of your daily life ASSURANCE — AUTOMOTIVE SPECIALISM HOW NCC GROUP AUTOMOTIVE CYBER SECURITY SERVICES HELP SECURE THE EVOLVING AUTOMOTIVE LANDSCAPE The Metrocab is London’s first zero emission capable taxi, developed by Frazer- Nash Research and Ecotive. The vehicle uses an electric battery and a petrol engine, which extends the range of the battery. NCC Group works as a cyber security and assurance partner to Frazer-Nash Research to independently advise on the security of in-vehicle networks and systems. Automotive cyber security Many people talk about modern connected cars as “computers on wheels”. This analogy is not technically correct – a better one would be “complex networks on wheels”, comprising multiple network technologies and segments, connecting a range of different embedded computers from many different suppliers to sensors, actuators and display interfaces. Many of the embedded computers present within vehicles have been connected to each other for years in closed on-board vehicle networks. However, the big change that has prompted cyber security concerns in recent years has been the connectivity between the on-board vehicle network and the public mobile phone network, connecting vehicles to Telematics Service Providers and to the wider Internet. This change has required much greater scrutiny of the design and implementation of vehicle systems than has previously been deemed necessary, to ensure that remote attacks against connected cars cannot result in data theft or safety concerns. “The knowledge and expertise of NCC Group has provided us with invaluable support to ensure our products and services have an unprecedented level of security for the automotive landscape.” How our business model enables this NCC Group has been providing cyber security advice and guidance to the automotive industry since 2012. Our dedicated Transport Assurance Practice constantly updates assessment methodologies, tools and techniques through a research-led approach to consultancy. By having specialist technical teams, whose cyber security experience is augmented by domain-specific knowledge, we are able to provide world-leading services to the global automotive supply chain. How we will leverage this moving forward We already work as cyber security and assurance partners to many of the world’s leading vehicle manufacturers and their suppliers. With our research-led approach we are able to foresee new challenges facing the automotive industry, from vehicle-based ransomware and security concerns around autonomous vehicles, to the impact of GDPR legislation on car manufacturers. Read more online at www.nccgroup.trust/uk/our-services/security-consulting NCC Group plc Annual Report and Accounts for the year ended 31 May 2017 NCC AR2017 - proof 8-Front.indd 39 25546.04 9 August 2017 3:58 PM Proof Six 39 09/08/2017 16:05:05 STRATEGIC REPORT Interim Chief Executive’s review OUR PERFORMANCE ESCROW DIVISION - BUSINESS PERFORMANCE REVIEW Revenue performance The Escrow division now accounts for 15 per cent of Group revenues (2016: 17 per cent). Escrow revenue for the year grew by £1.8m (5 per cent) to £37.1m (2016: £35.3m). Excluding the impact of FX, at constant currency rates underlying growth was £0.1m (0.3 per cent). Escrow revenue UK USA Europe Total Escrow revenue 31 May 2017 £m 31 May 2016 £m % Change 25.4 7.9 3.9 37.2 25.7 6.2 3.4 35.3 (1) 27 13 5 Escrow UK Escrow UK revenue was £25.4m (2016: £25.7m). During the second half of the year we identified that some invoices had been recognised as revenue ahead of the related service delivery. The correction of this issue reduced reported revenue in the year by £1.0m with an almost equivalent EBIT impact. The issue had built up over three years and no individual year required a material adjustment and hence the full impact was recognised as a one-off, non-recurring, non-cash item in the current year. While there was never any question of not delivering the service, and in many cases payment was received in advance, this revised approach is deemed to be a more appropriate application of the Group’s unchanged policy on revenue recognition. The reported 1 per cent reduction in revenue (2016: 8 per cent growth) would have been growth of 3 per cent if not for the one-off adjustment. Escrow UK recurring revenues increased to £14.1m (2016: £13.7m) and terminations remain at around 11 per cent with nearly 90 per cent of all contracts renewed (2016: 90 per cent). We expect UK growth to remain modest given the relative market maturity and our market share. Escrow USA Escrow USA revenues grew by 27 per cent to £7.9m (2016: £6.2m) with recurring revenues of £4.5m. Approximately half of this related to the impact of changes in FX rates with the balance all being organic growth. In the fourth quarter we restructured our senior management and sales team in Escrow USA to build further on the significant opportunity we have in that country. Escrow Europe Escrow Europe revenues grew by 13 per cent to £3.9m (2016: £3.4m) with recurring revenues of £2.1m. However, all of this and more was the result of changes in FX rates. On an underlying organic basis the business actually shrank by 3 per cent. This reflects significant management change in our European Escrow team that are being addressed in the first half of the new financial year. Escrow Rest of the World The division has recently established an office in Dubai to take advantage of the Group’s reputation and expertise in a region that has good demand potential for escrow services and in which we have a number of existing clients, allowing us to build a larger footprint in anticipation of Expo 2020. Revenue geography UK 65% USA 22% Europe 10% Rest of the World 3% Our short-term goals for the Escrow division as a whole are: z To maintain our market leading position in the UK, delivering modest annual organic growth z To continue to develop evolving solutions for customers in a SaaS and cloud based world z To build on our scalable capability in the US z To stabilise our relatively small footholds in a number of European territories (the Netherlands, Germany, and Switzerland) z To begin to build out from our new positions in our “Rest of the World” offices in Dubai and Singapore Escrow UK now has 111 employees (2016: 107), Escrow Europe has 12 employees (2016: 15) and the North American Escrow businesses have 41 employees (2016: 59). 40 www.nccgroup.trust Stock Code: NCC NCC AR2017 - proof 8-Front.indd 40 25546.04 9 August 2017 3:58 PM Proof Six 09/08/2017 16:05:06 The £1.0m impact on profitability of the revenue recognition issue has been noted above. Because the revised approach was adopted in the second half of the financial year but applied to the year as a whole, it has had a disproportionate impact on the reported results in the second half. Excluding this adjustment, EBIT for Escrow would have been flat year-on-year. The division experienced some of the same increases in the cost base as seen in the Assurance division but to a lesser degree. As a result, EBIT margins in the division fell by 5.6 per cent to 51.3 per cent (2016: 56.9 per cent) with revenue recognition being a one-off 2.6 per cent reduction. The revised operating model that is already in place for the Escrow teams around the world mean that the division should deliver an improvement in margins in the new financial year ending May 2018. Escrow revenues and growth can be further analysed as follows: Escrow contracts Verification testing Other services Total Escrow revenue 2017 £m 26.3 9.6 1.3 37.2 2016 £m % Change 24.6 9.7 1.0 35.3 7 (1) 30 5 Escrow profitability analysis The table below shows the split of EBIT by Escrow region. For reporting purposes, RoW EBIT is included within the UK. EBIT UK USA Europe Share of corporate costs Total Escrow EBIT 31 May 2017 31 May 2016 % Change 17.4 3.7 1.9 (3.9) 19.1 18.3 3.0 2.0 (3.2) 20.1 (5) 23 (5) (22) (5) NCC Group plc Annual Report and Accounts for the year ended 31 May 2017 41 NCC AR2017 - proof 8-Front.indd 41 09/08/2017 16:05:06 25546.04 9 August 2017 3:58 PM Proof Six STRATEGIC REPORT How we are part of your daily life ESCROW — BUSINESS CRITICAL SOFTWARE CONTINUITY HOW NCC GROUP’S ESCROW SERVICES HELP ENSURE CONTINUITY OF BUSINESS CRITICAL SOFTWARE A leading holiday operator decided to introduce a new reservations system to enable all of its high street outlets and businesses to have online access to the same real time price information for holiday packages. As a way of facilitating the real time availability of hotels, flights and car rental information the system was key to the holiday operator’s strategy of improving its service in line with its customers’ expectations and booking behaviour. The holiday operator began the process of replacing its legacy systems with a system that could communicate with the myriad of reservation systems used in the travel market and enable agents to give customers instant availability and reservation details. The system was also designed for use on multiple channels including websites, retail shops and call centres. The holiday operator takes business continuity for its critical reservation infrastructure seriously, so when planning for the new platform it wanted to ensure that provisions were in place to protect itself should an event occur that had the potential to disrupt the ongoing service of the application and affect customer experience. How our business model enables this Following a review of the marketplace and the protection solutions on offer, the holiday operator decided to partner with one of the world’s leading escrow providers, NCC Group. NCC Group’s software escrow solutions are a smart, simple way of managing risk by protecting the huge investment that organisations make in software each year. Under the terms of an escrow agreement, NCC Group holds a copy of the source code behind the business critical application or platform and commits to release the material if a “trigger event” should occur that would render the software supplier incapable of fulfilling its contractual obligations. If such an event occurs, the holiday operator can apply for the material to be released quickly and safely, minimising cost and disruption. This would then enable it to maintain and support the application in-house or appoint a qualified contractor to do so. As part of all its escrow agreements, NCC Group carries out an Integrity Test on the material received to ensure it is virus free, accessible and of the expected type. This process ensures that any obvious mistakes in the deposit are detected and resolved. 42 However, due to the nature of the software in question and the uncertain economic climate, NCC Group recommended that as well as ensuring that the source code is stored and regularly updated, the holiday operator should commission Full Verification testing of the application to ensure that the source code deposited could be built into the working system if needed. NCC Group’s range of verification services are specifically designed to remove any uncertainty of what is held in escrow and test the accessibility and completeness of the material. The verification process gives both end users and suppliers complete peace of mind. Initially, the verification consultant worked with the supplier through a complete build of the source code and then worked with the team at the holiday operator to test that the correct application was created. The entire process was detailed in a comprehensive report, which the holiday operator can then use as a step-by-step manual to build the source code into the working application. When its software supplier unfortunately went into administration, the holiday operator needed to invoke the escrow agreement and requested a source code release from NCC Group. The fact that the holiday operator had taken steps to mitigate risk, and had ownership of the build reports for the reservation system, played a crucial part in the legal negotiations that followed with its supplier’s administrators. Only because the holiday operator had carried out verification of the source code through NCC Group’s Full Verification and Build Assured Verification did it have a full build report for the business critical reservation infrastructure that enabled it to carry on maintaining and supporting the application by appointing an alternative contractor to do so. How we will leverage this going forward Most businesses rely on IT applications to run important and critical functions within their organisation. As the use of IT across organisations continues to grow it is increasingly important to ensure that businesses have a plan in place to mitigate against the risk of software supplier failure. NCC Group will continue to engage with both software providers and our customers to help and form part of an organisation’s business continuity plan. Read more online at www.nccgroup.trust/uk/our-services/software-escrow- and-verification www.nccgroup.trust Stock Code: NCC NCC AR2017 - proof 8-Front.indd 42 25546.04 9 August 2017 3:58 PM Proof Six 09/08/2017 16:05:10 How we are part of your daily life SOFTWARE TESTING — NEW SYSTEMS IMPLEMENTATION HOW SOFTWARE TESTING SERVICES HELP IMPLEMENT NEW SYSTEMS INITIATIVES NCC Group’s client, a major luxury fashion retailer, required a testing partner who could manage the complex implementation of two third party solutions, maintaining the quality standards in parallel development. The main challenge was the integration of the transformed EPOS system and the new loyalty offering, from both a technical and process perspective, into its current business model with minimum disruption. These two projects were of the upmost importance as they will ultimately strengthen the client’s position in the retail industry and help it to maintain customer loyalty while meeting key strategic goals. Software is not the client’s core business and it needed a quality partner to bring a strong approach as well as a complete testing solution. How our business model enables this Given the scale of the EPOS transformation, the client needed absolute clarity about how the validation and testing effort would ensure that both technical and business requirements were delivered as expected to fully support its business strategy and activities. NCC Group put together a joined-up approach to deliver testing across the various transformation areas, ensuring that the solution delivered business value for the client. This included: z Leveraging NCC Group’s Delivery Centre to provide a remote, on-shore capability, with a local test manager to ensure tight communication and accountability. z Testing of the EPOS system and devices from NCC Group’s Delivery Centre, evaluating functionality from front of store to back end systems without taking up space in the client’s offices. z Testing of the loyalty solution across a range of browsers and devices, ensuring consistent customer experience and supporting incentivisation by the client. z With NCC Group’s support at all stages of the process, the client successfully implemented two new key initiatives. The transformed EPOS system is now live in one of the main store locations and being rolled out at other locations. z The new loyalty application is currently being used by its customers and the international website and new marketplace have also successfully gone live. This allows the client to deliver a competitive retail experience to its customers on a global scale. How we will leverage this going forward z The transformation enabled the client to deliver value to customers and NCC Group looks forward to working closely with the client as the company continues to expand and refine its retail offering. z This valued NCC Group client had a number of challenges, including lack of expert test consultant skills, shortage of desk space in prime London territory and expertise in delivering similar sized, business critical projects. The project was both demanding and critical to the continual success of this client both online and in store and failure to deliver was not an option. We partnered at the most critical stage where business requirements were being determined, we introduced testing early into every phase of development, and provided this client with a robust strategy to deliver and go live without fault. Key delivery points and objectives are below: — Previous expertise in sector and project type — Ability to scale with the exact skills at speed — Flexible on-site / off-site model (but all on-shore) — Develop a strategy that would be agreeable by the Board for budget approval and sanction — Ability to manage all test phases and manage stakeholders to Board level z Testing of the international version of the client’s website, validating orders — Drive down costs where appropriate but without affecting test quality across 117 countries into its fulfilment capability. z Testing of the client’s marketplace functionality, allowing customers to order directly through to suppliers through the client’s website and ensuring that the expansion of this marketplace delivered value to customers. — Shared responsibility to meet demanding timescales — Secure, highly confidential off-site facilities Read more online at www.nccgroup.trust/uk/our-services/software-testing NCC Group plc Annual Report and Accounts for the year ended 31 May 2017 NCC AR2017 - proof 8-Front.indd 43 25546.04 9 August 2017 3:58 PM Proof Six 43 09/08/2017 16:05:13 STRATEGIC REPORT Group performance review for 2017 OUR PERFORMANCE 44 www.nccgroup.trust Stock Code: NCC NCC AR2017 - proof 8-Front.indd 44 25546.04 9 August 2017 3:58 PM Proof Six 09/08/2017 16:05:18 FINANCIAL MATTERS Individually significant items The carrying value of all of our goodwill and intangible assets were assessed as part of our normal year end process. As a result, there have been a number of impairments recognised in respect of goodwill and other intangible assets. The Fox and former Accumuli businesses (the latter now known as MSS) have underperformed in the year compared to our original acquisition forecasts. They have also encountered integration challenges that have slowed the pace of commercial leverage of the different new service and product lines across the rest of the Group. In MSS we are also shifting focus away from one part of the business that previously concentrated on simply reselling third party products often without value added after sales services. The net result of these factors is to recognise an impairment of the goodwill that arose on the acquisition of Accumuli plc by £24.3m. This equates to around 50 per cent of the goodwill attributable to what is now known as MSS. It is worth noting that one part of the Accumuli business has been successfully and fully integrated with our UK Security Consulting business and its share of goodwill (£14.3m) is now considered as part of that cash generating unit (CGU). In Fox-IT we have recognised an impairment of £24.3m of goodwill, representing around 30 per cent of the goodwill that arose on acquisition. While we are confident that the Fox-IT business and service lines and the MSS business refocused on value added managed services and advisory services are attractive business in the medium to long-term, there is much to be done to realise this potential. The length of time needed to realise this potential and the execution risks involved over that period mean that it is appropriate to recognise the impairment of these assets. In our Web Performance business we have reviewed the carrying value of both internally generated intangible assets and the goodwill associated with the acquisition of that business. While we do see longer term value in this business, some of the revenue generating intangible assets have been slower than originally anticipated to generate revenues and a retained customer base. The slower ramp up in revenue has therefore led to the recognition of impairments over two assets amounting to £3.0m and over goodwill of £5.7m. In the prior year it was announced that the Group was withdrawing from the Domain Services operating segment. At that time two assets were retained with carrying values of £2.0m and £2.7m in respect of the .trust TLD and a software application for use in Domain and potentially in other retained parts of the Group. Given the inherent uncertainties in realising any value from the .trust TLD it has been decided to write that asset off in full. The Group will seek to maximise any value from the asset. It has now been identified that the retained Domain software system does not have a role in the business going forward and it too has been fully impaired. Other individually significant items in the year are set out in note 3 to the accounts and include: z Adjustments to deferred and contingent consideration due to changes in FX rates of £2.9m; z Holiday pay accrual relating to previous financial periods of £1.8m. This is described in more detail in note 3; z Restructuring costs of £1.3m relate to professional fees for the Strategic Review, the Target Operating Model project, exit payments to the former CEO, and retention bonuses paid to former employees of Accumuli plc; z Double running and exit costs of £1.3m for empty properties; z Impairment of property, plant and equipment (£0.9m) on the planned relocation of the Group’s Manchester Head Office in September 2017; and z Acquisition costs of £0.8m. Prior year individually significant charges are also set out in note 3. Taxation The Group’s adjusted effective tax rate is 29.3 per cent (2016: 22 per cent), which is marginally above the average standard UK rate of 20 per cent (2016: 21 per cent). The higher effective rate reflects the higher tax rates incurred in the overseas businesses. It had been earlier reported that the tax rate for the year would rise to around 31 per cent. This was based on an estimated position at the time of the Interim Results in January 2017 and included certain assumptions about the level and geographical origin of pre-tax profits. The actual results were lower than those estimates and a significant part of the reduction was in higher tax territories. The Group expects to maintain the effective P&L tax rate at around 30 per cent for the next few years, assuming a similar split of profitability compared to the current year. The Group has recently hired a tax and treasury manager whose tasks will include developing a longer term strategy for tax and treasury matters. In both of these areas the Board has a low risk appetite and the new strategies will operate inside that. NCC Group plc Annual Report and Accounts for the year ended 31 May 2017 NCC AR2017 - proof 8-Front.indd 45 25546.04 9 August 2017 3:58 PM Proof Six 45 09/08/2017 16:05:20 STRATEGIC REPORT Group performance review for 2017 OUR PERFORMANCE Earnings per share The adjusted basic earnings per share from operations was 6.7p (2016: 11.8p). The table below reconciles basic EPS to Adjusted EPS on the Group’s definitions of adjusting items including their tax impact. 2017 Pence 2016 Pence Basic EPS as per the income statement Domain exit Amortisation of acquired intangibles (note 11) Individually significant items (note 3) Share based payments (note 22) Unwinding discount on deferred consideration (note 7) Adjusted basic EPS (20.4) (0.6) 2.7 24.8 0.1 0.1 6.7 2.5 0.4 2.1 6.2 0.4 0.2 11.8 The adjusted fully diluted earnings per share from continuing operations was 6.7p (2016: 11.2p) while reported fully diluted loss per share was 20.4p (2016: earnings of 2.5p). Dividends The Board is recommending a final dividend of 3.15p per ordinary share, making a total for the year of 4.65p. This represents a dividend equal to that paid in the prior year. While dividend cover is negative (2016: 2.4 times based on basic adjusted earnings per share from continuing operations) the Board is confident that the Group’s new Strategic Plan will be a source of long-term sustainable growth in earnings, cash flow and shareholder value. An administrative non-compliance issue has been identified with respect to distributable reserves and the payment of previous dividends. We expect to remedy the position by means of shareholder resolutions at the AGM in September. Cash We are aiming to disclose in as transparent a way as possible the key moving parts in our cash flows. We also publish a new definition and calculation of free cash flow and cash Conversion ratio that is more closely aligned to market practice. The table below summarises the Group’s cash flow for the year: Cash inflow before changes in working capital Changes in working capital Interest paid Income taxes paid Net cash from operating activities Net capital expenditure Capitalised development costs Free cash flow Acquisitions Disposals Dividends Share issues Net cash flow before financing Opening net debt Foreign exchange impacts Closing net debt 2017 £m 33.8 (2.1) (1.9) (1.8) 28.0 (10.6) (3.7) 13.7 (26.7) 0.2 (12.8) 0.7 (24.9) (12.7) (6.1) (43.7) 2016 £m 37.3 (14.2) (2.0) (7.3) 13.8 (11.6) (1.9) 0.3 (76.7) – (10.3) 123.7 37.0 (50.6) 0.9 (12.7) The Group generated a net £25.9m of cash from operating activities. This was before deducting £3.7m costs of internally capitalised development costs. Working capital saw a reduction in accrued income as our billing processes became more effective and timely in the fourth quarter. While the natural consequence of this is then an increase in trade debtors, the net impact is to shorten the working capital life cycle and accelerate cash conversion. The net working capital cash outflow was the result of deliberate management action to improve supplier relations by improving the profile of creditor payments compared to prior years. Interest and tax cash costs remained modest and the latter reflects in part the lower profitability of our overseas higher tax rate territories. 46 www.nccgroup.trust Stock Code: NCC NCC AR2017 - proof 8-Front.indd 46 25546.04 9 August 2017 3:58 PM Proof Six 09/08/2017 16:05:20 FINANCIAL MATTERS Net capital expenditure of £11.0m was a mix of discretionary and maintenance capex. No breakdown of discretionary versus maintenance capex is available as yet. However, maintenance spend includes costs of new hardware and software for use in the business. Discretionary spend includes a number of new office locations that have either been acquired or moved into in the year ending 31 May 2017. The largest one-off “discretionary” capex spend in 2017 was the £3.8m cost of Category A and B fit out costs of the Group’s new headquarters building in Manchester that will be occupied in the summer of 2017. The move was occasioned by the end of the existing lease and the need for more space to accommodate current and future business growth. The fit out costs in the year were almost fully funded by a landlord contribution of £3.7m. The estimate to complete the project is £4.0m and the final cash costs will be paid in the 2018 financial year. Given the number of office moves completed or started in the 2017 financial year, we do not expect to incur similar significant capex or costs during the new financial year. Conversely, we expect our annual premises costs which include depreciation, rent, and rates to increase in the new financial year by £1.9m, which will be an annualised £2.2m in the following year. Acquisitions are discussed in more detail in the Assurance Division review. The calculation of the cash conversion ratio for the last two years is set out below and referenced to the various notes in the Annual Report. Net cash generated from operating activities Adjusted EBITDA Cash conversion ratio (A) / (B) 2017 £m 28.0 36.2 77% 2016 £m 13.8 45.0 31% One of the main drivers for the difference between operating cash flow and EBITDA are the capitalised development cash costs in the year of £3.7m which if charged against EBITDA would give a cash conversion ratio of 86 per cent in 2017. Financing facilities In November 2016, the Group increased its banking facilities to £110m (May 2016: £78m) with a new five-year multi-bank facility, comprising an £80m (May 2016: £78m) revolving credit facility and a £30m (May 2016: nil) five-year term loan. The term loan amortises at £2.5m every six months until maturity and at the end of the year the term facility stood at £25.0m. The Group’s primary banking covenants are: z Leverage limit of 2.5 times and this is calculated as Adjusted EBITDA / net debt. For the purposes of the covenant test, net debt includes deferred consideration on acquisitions (but not contingent consideration). As at 31 May 2017, leverage for banking purposes stood at 1.5 times, comfortably below the Group’s maximum 2.5 times covenant limit. Cash conversion ratio 70% 70% 70% 71.5% z Net interest cover which is calculated as Adjusted EBITDA / net interest payments and has a limit of 3.5 times. z As at 31 May 2017, net interest cover was 25.9 times, again comfortably above the minimum level. 31.0% 2013 2014 2015 2016 2017 At the year end, outstanding contingent payments relate to PSC of £2.8m and VSR of £1.3m. The payments to the former owners are due in two equal instalments and are measured on December 2017 and December 2018 by reference to profit targets set at the time of the acquisitions. Also outstanding is non-contingent deferred consideration in respect of the acquisition of Fox-IT comprising €10m in cash and €2.5m shares due to be paid in November 2017. The Group has the option to make the share based payment in cash instead. NCC Group plc Annual Report and Accounts for the year ended 31 May 2017 47 NCC AR2017 - proof 8-Front.indd 47 09/08/2017 16:05:21 25546.04 9 August 2017 3:58 PM Proof Six STRATEGIC REPORT Principal risks and uncertainties RISK MANAGEMENT As the business grows in scale and complexity, it is important that we evolve our risk management processes. During the last year we implemented some new and enhanced processes and controls around our risk management activities. Governance Overall responsibility for the risk framework and definition of risk appetite rests with the Board, who through regular review of risks, ensure that risk exposure is matched with an ability to achieve the Group’s strategic objectives. Risks are identified primarily by the management team and by using a structured risk framework, with non-executive review being carried out by the Board. Risk management processes and controls The Board, with input from the Audit Committee, monitors the ongoing process by which critical risks to the business are identified, evaluated and managed. On a biannual basis, the Board reviews the detailed risk register that has been prepared and updated within the business by the Operations Board which has responsibility for day-to-day risk management within the business. In addition, during 2016, the Board formed a specialist Cyber Security Committee to evaluate the specific risks associated with its cyber risk environment. We expect to evolve our risk management processes and controls further in the new financial year in order to embed further risk management processes within the business. This will include the development of online risk and action tracking systems. We plan to carry this out in parallel with the creation of a new Internal Audit and Assurance function, reflecting the growing complexity of our business. Evaluation of risk The design and ongoing effectiveness of the key controls over the Group’s principal risks are documented using an “assurance map”. This includes an assessment of the net impact of each risk and the likelihood of its occurrence once mitigating controls are taken into account. The key controls over the Group’s identified principal risks are reviewed twice a year by management, the Audit Committee and the Board. However, the Group’s risk management programme can only provide reasonable, not absolute, assurance that principal risks are managed to an acceptable level. Ranking of the Group’s risks is conducted by combining the economic, operational or environmental impact of risks and the likelihood that they may occur. Those risks that are considered to pose the greatest threat to the Group and score the highest are identified as “principal risks”. The operations of the Group, and the implementation of its objectives and strategy, are subject to a number of principal risks and uncertainties. Where more than one of the risks to occur together, the overall impact on the Group would be greater. Risk register The Group maintains a risk register, which: The CEO chairs the Operations Board and the other members include senior business unit and functional heads. The business has put in place: z Sets out the Group’s risk appetite; z Identifies the key risks faced by the Group and assesses their likelihood and impact; and z Ongoing procedures to identify, evaluate and manage z Identifies the processes and controls in place to mitigate principal risks; these risks. z Procedures to monitor the control systems in place to reduce these risks to an acceptable level; z A biannual detailed Group-wide risk review; and z A process to consider progress made against significant business risks at monthly operational Board meetings. The Group Risk Register is the primary reporting vehicle used by the Operations Board in performing its risk management duties. It is reviewed in depth by the Operations Board on a biannual basis. The Risk Register is then reviewed by the Board. Day-to-day risks faced by the Group are mitigated by management processes and procedures embedded in the Group’s Quality System. 48 www.nccgroup.trust Stock Code: NCC NCC AR2017 - proof 8-Front.indd 48 25546.04 9 August 2017 3:58 PM Proof Six 09/08/2017 16:05:22 T C A P M I 5 9 6 3 8 4 1 2 7 10 PROBABILITY Principal risks and uncertainties The Group operates in a particularly dynamic and evolving market-place. As new events occur or the business transitions into new activities or phases of its development, the risk register is updated accordingly. For example, reflecting the changing nature of the business, during 2016-17, we had to complete the integration of two new and sizeable acquisitions into our risk management processes. As a result of these acquisitions, the Group now has a larger proportion of its revenue coming from hardware or other product sales and also from key strategic customers, with the consequence of there being less predictable sales cycles and, in some cases, larger but less frequent sales. During the year, we saw a slowing in purchase activity by a key strategic customer in the Netherlands. We also incurred customer losses while professionalising the contracts management activities in one of the businesses we recently acquired, as well as having to bear increased costs. Furthermore, as a result of these recent large acquisitions, the scale and complexity of the Group increased and enhanced controls and processes needed to be put in place. In order to address this, the Board authorised the creation of the roles of Director of Risk and Assurance, and a Group Tax and Treasury Manager. The former is in the process of being recruited while the latter post has been very recently filled. The Directors have carried out a robust assessment of the principal risks facing the Group including those that would threaten its business model, future performance, solvency or liquidity. Detailed descriptions of the current principal risks and uncertainties faced by the Group, their potential impact and mitigating processes and controls are set out below. The tables also highlight whether the risk is assessed as increasing or decreasing with a similar assessment for the position last year. This includes identifying new principal risks and uncertainties. Risk heat map T C A P M I 5 9 6 3 8 4 1 2 7 10 PROBABILITY NCC Group plc Annual Report and Accounts for the year ended 31 May 2017 NCC AR2017 - proof 8-Front.indd 49 25546.04 9 August 2017 3:58 PM Proof Six 49 09/08/2017 16:05:22 STRATEGIC REPORT Principal risks and uncertainties RISK MANAGEMENT Risk Areas Potential Impact Mitigation 1 Strategy As the Group and its operating environment change, so too must its strategy if it is to continue to succeed and generate increasing shareholder value. The Group is in the process of changing and developing a new strategy that will need to take root. A poor strategy or ineffective execution of a strategy would have a material negative impact on the Group’s financial performance and value. It would potentially weaken the Group compared to its competitors and risk the Group’s established position in the marketplace. 2 Management of change As the Group adapts and changes its strategy there are a number of complex projects and initiatives that not only need to be delivered but also require understanding and support from all staff. Poor change management could lead to ineffective implementation of projects that then cost more to deliver, take longer to deliver, and result in fewer benefits being realised (or all three). 3 Information Technology The Group is heavily reliant on continued and uninterrupted access to its IT systems. The Group is a natural target for individuals who may seek to disrupt the Group’s commercial activities. If the Group’s systems failed, this could affect the Group’s ability to provide services to our customers. If a system failure was the result of a successful external cyber attack, this could result in the loss of sensitive data and compromise the Group’s reputation as a leader in the field of cyber security. Failing to successfully implement new IT systems could similarly cause business disruption. 2017 NEW 2016 Members of the Board have significant experience in evolving business strategies. This experience has been complemented by the use of external consultants who have participated in the recent Strategic Review. 2017 NEW 2016 The Board has been enhanced during the last six months by the appointment of an Executive Chairman and Interim CEO, both of whom have extensive experience of implementing change on organisations. Through regular engagement with all levels of staff the Group will ensure that the Group’s vision and strategy is shared with and understood by all staff. 2017 2016 The Group has made significant investment in its IT infrastructure to ensure it continues to support the growth of the organisation. The Group has appropriate controls in place in order to mitigate the risk of systems failure and data loss, including systems back-up procedures and disaster recovery plans. The Group also deploys appropriate malware protection, network security controls and encryption of mobile devices. The Group is currently reviewing high priority systems changes to ensure that projects are well managed and deliver the required targeted benefits in an appropriate timeframe. TREND EFFECT TREND DIRECTION High Impact Medium Impact Low Impact Increasing Unchanged Decreasing 50 www.nccgroup.trust Stock Code: NCC NCC AR2017 - proof 8-Front.indd 50 25546.04 9 August 2017 3:58 PM Proof Six 09/08/2017 16:05:23 Risk Areas Potential Impact Mitigation 4 Recruitment and retention of key personnel The Group would be adversely impacted if it were unable to attract and retain the right calibre of skilled staff. Some roles within the Group operate in highly technical and extremely specialised areas in which there are shortages of skilled people. Loss of key managers could result in a lack of necessary expertise or continuity to execute the Group’s strategy. An inability to attract and retain sufficient high-calibre employees could become a barrier to the continued success and growth of NCC Group. 5 Conduct and reputational risk Damage can result to our reputation or business by a combination of unanticipated events or by the acts of a single employee. Conduct risk can arise from a number of areas such as failing to meet customer expectations on project delivery, testing assignments or source code handling or from employees who could maliciously disrupt the business and steal customer information. All such instances could result in damage to reputation, loss of repeat business and potentially lead to litigation and/or claims against NCC Group. 6 Cyber risk This is the risk that is faced by many of our customers, that external agents will successfully access and harm NCC Group data and operating systems, inspired by either the pursuit of financial gain or malice. As a provider of security services, the Group is a high profile target and could therefore be targeted by attacks specifically designed to disrupt the Group’s business and harm the Group’s reputation. If such an attack was successful, it could adversely affect the market’s perception of the Group as well as causing business disruption. 2017 2016 Key personnel are tied in through rewarding career structures and attractive salary packages, which can include participation in share schemes. Succession plans are being finalised for key members of the management team where they are not already in place. The Group is reviewing our assessment and development processes to ensure that our employees can enjoy opportunities for further career training and development. 2017 2016 NCC Group operates a system of policies and procedures which are regularly audited as part of the Quality System. These, combined with management oversight, the risk management process, project reviews and customer feedback, mitigate the risk to successful service and project delivery. All staff are trained regularly and backups are taken wherever possible before testing assignments begin. Employees are vetted before joining and robust controls and processes are in place to manage employees such as accounting controls, IT monitoring large downloads of data and controls on client site operations. 2017 2016 The Board has constituted a Cyber Security Committee chaired by the Senior Non- Executive Director. Security testing is regularly carried out on the Group’s infrastructure and there are extensive measures in place to assist in identifying and dealing with security incidents. The Group has a dedicated Information Security Management Forum which meets regularly to discuss security risks to the Group. Employees also receive regular security training and updates. NCC Group plc Annual Report and Accounts for the year ended 31 May 2017 51 NCC AR2017 - proof 8-Front.indd 51 09/08/2017 16:05:23 25546.04 9 August 2017 3:58 PM Proof Six STRATEGIC REPORT Principal risks and uncertainties RISK MANAGEMENT Risk Areas Potential Impact Mitigation 7 Acquisitions and disposals Acquisitions and disposals can be costly to complete and complex to deliver the targeted benefits. Risks range from deal execution (including price negotiations, due diligence, and contracting) to transition and integration into (or separation from) NCC Group. Well-executed acquisitions and disposals with an appropriate purchase price can create significant value. Poorly executed acquisitions and disposals or those with excessive purchase prices can destroy shareholder value. 8 Competition and failure to respond to market trends Barriers to market entry are relatively low in some of our lower value service offerings. Equally, in such a dynamic and fast evolving technology space, products or services can be rendered obsolete by new technologies or platforms. A major change in the technology landscape could lead to a decline in an individual service line’s revenue stream. One example of a recent change that needs a response is the move to more cloud-based applications and data storage. 9 Failure to protect intellectual property A number of the Group’s service offerings depend on intellectual property rights that need to be registered, maintained and protected in various jurisdictions. Examples include trademarks, patents and valuable know-how. If such rights are not sufficiently protected, the Group could potentially no longer be able to offer a particular service in some or all countries. 2017 2016 As part of its medium-term strategy, the Board remains committed to making value- enhancing acquisitions. The need to establish a robust and scalable Target Operating Model for the Group, including integrated ways of working, processes and systems, means that the Group is less likely to make any material acquisitions for the next year or two while that TOM is put in place. Furthermore, the significant write down in the carrying values of goodwill following the acquisition of Accumuli and Fox-IT has led the Board to commence a review of our acquisition process and disciplines to identify areas for improvement and ways in which to reduce the risk of future impairments on any new acquisitions. This includes developing a more robust post- acquisition integration process to deliver targeted benefits. 2017 2016 The Group employs a number of industry leading experts and thought leaders in our marketplace. This puts us at the forefront of change and allows us early insight into emerging trends. This in turn allows us to anticipate or pre-empt a number of potential risks. Group-wide technology and technical forums are used to disseminate and share market intelligence and trends, as well as to formulate responses, on a regular basis. 2017 2016 Patents are applied for where appropriate and intellectual property is only disclosed under a licence agreement or confidentiality agreement. The Group also takes steps to differentiate its IP as far as possible to lower the risk of any potential infringement claims. TREND EFFECT TREND DIRECTION High Impact Medium Impact Low Impact Increasing Unchanged Decreasing 52 www.nccgroup.trust Stock Code: NCC NCC AR2017 - proof 8-Front.indd 52 25546.04 9 August 2017 3:58 PM Proof Six 09/08/2017 16:05:24 Risk Areas Potential Impact Mitigation 10 Liquidity, foreign exchange and banking facilities The Group requires access to adequate banking facilities to fund its daily operations, capital investments and potential acquisitions. Furthermore, as the Group’s international footprint expands, there is an inherent risk of adverse foreign exchange movements affecting profitability. Inability to refinance the Group’s core banking facilities could call into doubt the Group’s longer term viability. Equally, if those facilities lacked the appropriate flexibility and structure, this could inhibit delivery of the Group’s strategy. The absence of any currency hedging in 2016-17 resulted in an exchange loss of £3.7m. 2017 2016 The Group’s current banking facilities cover all of its expected needs of the Group for the period of such facilities and are sufficiently flexible to allow the Group to function effectively. The Group has recently appointed a Tax and Treasury Manager for the first time. Part of their role is to support the CFO in developing a Treasury strategy and overseeing its implementation. The Board is currently reviewing a new Foreign Exchange hedging strategy that is primarily based on net cash flow hedging. Impact of Brexit on the Group The Group currently has relatively little inter-territorial trade from the UK into Europe and vice versa. While Brexit has already had an impact on exchange rates which the Group has leveraged, there is inevitably some uncertainty around the likely impact of Brexit on businesses. The Group does not believe that Brexit will have a significant impact on its operations as currently structured. UK cyber regulation is likely to stay closely attuned to evolving regulation in Europe, such as GDPR where implementation will proceed in both Europe and the UK as envisaged. Viability Statement In accordance with the requirements of the 2014 revisions to the UK Corporate Governance Code, the Directors assessed the longer term prospects of the Group. The assessment took into account the Group’s current competitive and financial position as well as the potential impact of the principal risks documented above on pages 48 to 53 of the Annual Report. The assessment emphasised those risks that could theoretically threaten the Group’s ability to operate or to continue in existence. As a result, the Directors determined that a three-year period to 31 May 2020 was an appropriate time frame for the viability assessment based on the historic performance of the Group. The rapid changes occurring in our marketplaces mean that a longer period would not have an acceptable level of forecasting accuracy. The Directors note that even a three- year period in a rapidly evolving marketplace can present challenges for forecasting accuracy. The three-year time frame also takes account of the Group’s core banking facilities which have an expiry date in November 2020 and that are likely to be renewed ahead of that date, in line with market practice. In making their assessment, the Directors have considered the Group’s current financial position and cash flow generation and undertaken a sensitivity analysis over the key trading assumptions combined with the potential impact of one or more of the principal risks on the business materialising within the three-year period. The Directors used the principal risks noted above to develop a set of plausible scenarios that could have a potentially high impact on the longer term viability of the business. These were then used as sensitivity analysis against the baseline projections above. The key risks included: z Product obsolescence; z Loss of key people; z Significant loss of business systems (whether through malignant design or misadventure); z Conduct risk; and z Failure to comply with all appropriate laws and regulations. The probability and potential impact of these risks crystallising was used to assess their possible impact on the Group’s financial resources and liquidity. At the same time, consideration was given to mitigating actions in response to these risks and the ability of the Group’s financing arrangements to absorb any such impacts. In addition, comfort was taken from the distributed nature of many of the Group’s operations as well as diverse income generating product lines. Based on the results of the analysis outlined above, the Directors confirm that they have a reasonable expectation that the Group will remain viable and be able to continue in operation and meet its liabilities as they fall due over the three- year period of their assessment. Furthermore, the Directors have no reason to doubt that the Group will continue in existence beyond the three-year period under assessment. NCC Group plc Annual Report and Accounts for the year ended 31 May 2017 NCC AR2017 - proof 8-Front.indd 53 25546.04 9 August 2017 3:58 PM Proof Six 53 09/08/2017 16:05:24 STRATEGIC REPORT Corporate social responsibility NCC Group takes its corporate social responsibilities very seriously and recognises the important contributions to the business made by the wider community of stakeholders, in particular investors, employees, clients, suppliers and local communities. It recognises that by acting responsibly it can deliver a sustainable business, while contributing to the community and preserving the environment. The Board takes into account social, environmental, human rights and ethical issues in its discussions and decision- making, as well as the health and safety of employees. Stakeholders Investors The investors in the Group need to trust that their capital is being responsibly used to provide them with sustainable returns. The Group communicates regularly with its investors in meetings and roadshows to keep them up-to-date with both the opportunities and challenges faced by the Company. During this year, the Directors maintained engagement with investors through various meetings and telephone calls, details of which can be found on page 71 of the Governance Report. Employees People are fundamental to the Group’s business, and the support and involvement of the talented individuals who form its team is vital to the continued success of the Group overall. The Head of HR reports directly to the Chief Executive Officer to ensure high level visibility and control of all employment related issues. The Group endeavours to attract and retain the brightest and best people in its industry and to make sure they are given the opportunity to develop their talents. The Group is committed to providing a productive working environment and recognises the importance of training and career development. Each employee has a training record and is positively encouraged to up-skill. All roles where an additional professional qualification can be achieved are actively supported and rewarded. The Group employs a training manager who ensures all relevant staff have the necessary training plans in place. 54 On a daily basis, the Group provides relevant technical, administrative and sales training and each employee is required to dedicate a certain amount of time each month to research and development. The majority of the training is provided in-house (through on the job side-by-side coaching, internal workshops or as part of a research team) although external courses and trainers are used where it is appropriate to do so. It is not possible to directly quantify the total amount spent on training within the Group, as this is part of the normal working week. The Group has a policy of keeping employees informed of, and engaged in, its business strategy through the Intranet, regular employee briefings and divisional meetings. Information is cascaded from the Board downward to ensure that relevant Group targets are communicated, as well as ensuring that cultural values are aligned. Comments and suggestions from employees on the Group’s performance and management are actively encouraged. Direct access to the senior management team is actively promoted and encouraged and the Group maintains an Open Door Policy. Every employee and contractor has access to an external whistle-blowing helpline pursuant to the Group’s Whistle- blowing Policy. Modern slavery The Group recognises that modern slavery is a crime and a violation of fundamental human rights. The term modern slavery includes not only slavery but also servitude, forced and compulsory labour and human trafficking, all of which have in common the deprivation of a person’s liberty by another in order to exploit them for personal or commercial gain. The Company has a zero tolerance approach to “modern slavery” and is committed to acting ethically and with integrity in all of its business dealings and relationships, and to implementing and enforcing effective systems and controls to ensure modern slavery is not taking place anywhere in its business or in any of its supply chains. The Company communicates its zero tolerance approach to all its suppliers, contractors and business partners and this message is reiterated in its “Anti-Slavery and Human Trafficking Statement”on the Group’s website. It expects high standards from all of its contractors, suppliers and other business partners, and also expects that its suppliers will hold their own suppliers to the same standards. Equality and diversity The Group is committed to equality and diversity and offers equal opportunities to all and maintains an Equality and Diversity Policy which aims to create a working environment free from unlawful discrimination, victimisation and harassment in which all employees are treated with dignity and respect. www.nccgroup.trust Stock Code: NCC NCC AR2017 - proof 8-Front.indd 54 25546.04 9 August 2017 3:58 PM Proof Six 09/08/2017 16:05:24 As part of this we work to ensure that all employees, whatever their personal circumstances, receive the same opportunities for training, career development and promotion. The Board recognises the need to positively support gender diversity in a technology business, which has traditionally and historically attracted more men due to, in our view, the teaching of IT and Technology in our schools and colleges where the subject has historically been viewed as a primarily male preserve. The Group is endeavouring to engage with local schools, colleges and universities to help educate and instil the benefits and opportunities of careers in IT and cyber security for all genders. NCC Group supports GCHQ’s CyberFirst Girls Competition in a bid to encourage young women to consider cyber security as a career. The competition, aimed at 14 and 15 year-old girls, is part of the National Cyber Security Programme and is designed to inspire a new generation of females. A team of female security consultants from the Group have been working on the initiative, producing videos with tips on how to avoid becoming a victim of a cyber attack and also speaking at roadshows in universities up and down the country. Approximately 80 per cent of our employees are male and 20 per cent female. In our team of senior managers, approximately 92 per cent of the team are male and 8 per cent female while on our plc Board, 83 per cent are male and 17 per cent female. A “senior manager” is defined in the legislation as an employee who has responsibility for planning, directing or controlling the activities of the Company or a strategically significant part of the Company. The Group is committed to its employees and actively attempts to improve their health, well-being and morale by encouraging fitness-based activities and taking part in charitable events. The Group has its own football, cricket and netball teams that play regularly, and organises cycling events encouraging mass employee and business participation. Health and safety The Group takes health and safety in the workplace seriously and complies with all relevant legislation and best practice. There have been no workplace fatalities in the Group’s history and no reported workplace accidents in the year. Clients NCC Group values each and every client and is proud of the long-standing nature of its client relationships. Continuing client satisfaction is central to its ongoing success and is regularly measured and monitored through the ISO 9001 certified quality programme. This includes written and telephone satisfaction surveys each month. Rare instances of negative feedback are treated with the utmost seriousness and dealt with swiftly by management through to resolution. Each Operational Director takes direct responsibility for customer satisfaction, with the CEO investigating directly if a division’s performance fails to meet the 75 per cent threshold. No investigations were required in the year reported on. The Group recognises and understands that its relationships with those with whom it deals are the key to its success and, as such, takes its obligations and commitments to those people and organisations very seriously. The Group’s independence, reputation as a supplier of quality services and the trust of its clients are all key assets that it aims to protect at all times. It aims to engender in its employees principles of honesty and integrity and the desire to work to the best of their ability. To ensure best service for the Group’s clients all employees are required both to comply with the Company’s Code of Ethics and to undergo annual anti-bribery and equality and diversity refresher training. The community NCC Group believes in supporting good causes and encourages its staff to get involved too, with considerable success to date. The Group has donated £65,000 to good causes this year, with its main charity being Macmillan Cancer Support, and with a number of local and national charities also benefiting. Additionally, the Group provided security consulting services on a pro bono basis to Comic Relief and has supported a number of employee related smaller charity initiatives. A similar policy has been introduced in North America. The Group believes in community and encourages its staff to do the same. Again this year the Group has continued to sponsor local junior football teams by buying their football kit and trophies to encourage children to take an interest in sport and keeping fit. The Group has also co-sponsored the cycle team Torelli, an elite female team from the North West. Every year NCC Group staff members participate in and organise football tournaments, silent auctions, raffles, bake days, sport days and many more fundraising activities. NCC Group has signed up to become a platinum sponsor of Cyber Security Challenge UK as it looks to bring more talent into the industry. The Challenge features a series of national competitions, learning programmes and networking initiatives designed to identify, inspire and enable more people to work in the cyber security industry. NCC Group’s cyber security experts will be closely involved in a number of competitions and events in the coming year. NCC Group has also committed to offering student bursaries as part of the government-backed CyberFirst initiative in a bid to encourage more youngsters to take up careers in cyber security. The CyberFirst programme, which was set up by NCC Group plc Annual Report and Accounts for the year ended 31 May 2017 NCC AR2017 - proof 8-Front.indd 55 25546.04 9 August 2017 3:58 PM Proof Six 55 09/08/2017 16:05:25 STRATEGIC REPORT Corporate social responsibility GCHQ’s National Cyber Security Centre (NCSC), aims to provide secondary school-aged students with the tools and knowledge to live and work securely online while highlighting the wide range of career options available to them. The Group is apolitical and does not support any political party in any jurisdiction nor has it ever made a political donation. Human rights The Board has an overall responsibility for ensuring the Group upholds and promotes respect for human rights and supports, through the Group’s Human Rights Policy, the UN Declaration of Human Rights which underpins its policies and actions. Suppliers The Group’s policy is to pay suppliers in accordance with the agreed terms and conditions. Although the Group does not follow any code or standard on payment policy, where terms have not been specifically agreed, invoices dated in one calendar month are paid close to the end of the following month. At 31 May 2017, the Group had an average of 34.82 days purchases outstanding in trade creditors (2016: 42 days). Environment and sustainability As a service provider with no manufacturing facilities, the impact of the Group’s operations on the environment is limited compared with other industries, however it recognises its responsibility to respect and limit damage to the environment in every way it can. The Group has in the past sought third party advice for initiatives that could be implemented and followed as well as for staff education to ensure that they are thinking about the environment both in work and at home. During the year the Group made available the selection of hybrid or electric vehicles though its company car scheme. Presently, due to the size of the Group, an external environmental audit is not practical but this will be reassessed if the Group grows to such a size where an external audit would have merit. The Group’s Environmental Policy aims to reduce the energy our business uses by: z Conserving energy and other natural resources and improving efficient use of those resources; z Improving the efficiency of materials used; z Reducing waste and increasing reuse and recycling wherever possible; z Reducing the need for travel and encouraging the use of alternative means of transport, for example, via the Cycle to Work scheme and car sharing; and z Providing all staff with relevant environmental training and guidance. Initiatives that the Group has put in place to reflect the above: z Energy efficient lighting in refurbished areas of the office and lighting which switches off automatically; z Use of recycling in all offices – there are paper recycling bins throughout the offices and bottles, cans and plastics recycling bins in the kitchens; z On-demand boiling water and cold water taps to reduce wastage of water and power; z Cycle to Work scheme; z Recycling of printer cartridges in all offices; z Printer replacements featuring double-sided printing as standard; z Recycling of redundant IT equipment; z Addition of low emission car options into the company car scheme; z Video conferencing facilities available in main offices. This reduces the need for travelling so helping the environment and improving productivity; z Teleconferencing facilities available for all staff; z Printer review to enable more double-sided printing; and z Increase staff awareness of environmental issues. NCC Group’s new HQ – XYZ Building, Manchester The Group’s new Manchester headquarters at the XYZ Building has been successful in addressing broader aspects of sustainability and has achieved a strong BREEAM 2011 NC “Excellent” certification. Key sustainability factors include: z Primary energy consumption reduced by 28 per cent through the utilisation and careful specification of a combination of high-efficiency, low NOx CHP and commercial boiler units with high-efficiency chiller and distribution units. z Low energy lighting is installed throughout, which is particularly important for reducing energy consumption within an office building. z All materials specified for the building had a reduced life cycle impact in terms of their CO2 emissions and environmental degradation potential. z All major materials were responsibly sourced with supporting certification evidence. z Full FSC certification achieved for all timber products used, both in the constructed asset and site works. z Careful specification of water consuming components resulted in a 42.13 per cent improvement in water consumption compared to the BRE baseline, supported by installation of flow control devices and water leak detection which tie in with the goals of the UK Government’s “Future Water” Strategy for England. 56 www.nccgroup.trust Stock Code: NCC NCC AR2017 - proof 8-Front.indd 56 25546.04 9 August 2017 3:58 PM Proof Six 09/08/2017 16:05:25 Total tCO2e by emission type Electricity, heat and cooling purchased for own use Combustion of fuel Greenhouse gas emissions This section includes our mandatory reporting of greenhouse gas emissions pursuant to the Companies Act 2006 (Strategic Report and Directors’ Report) Regulations 2014 (“The Regulations”). The greenhouse gas report period is aligned with our financial reporting year and so runs from 1 June to 31 May for each reported year. The method we have used to calculate GHG emissions is the GHG Protocol Corporate Accounting and Reporting Standard (revised edition), together with the latest emission factors from recognised public sources including, but not limited to, Defra, the International Energy Agency, the US Energy Information Administration, the US Environmental Protection Agency and the Intergovernmental Panel on Climate Change. Our emissions cover scope 1 and scope 2 and we have used revenue as the intensity ratio as it best reflects the size and scale of the business. Our aim is to reduce the overall carbon intensity for the Group by at least 10 per cent over the next three years. Absolute carbon emissions (tCO2e) Group revenue (£m) Carbon intensity for whole Group Year-on-year carbon intensity change Year-on-year carbon intensity change (as a %) 2017 2016 2015 1550 2264 1449 233.3 209.1 129.8 6.6 10.8 11.2 (4.2) (0.4) 0.4 (38.8) (3.57) 3.7 On behalf of the Board Brian Tenner INTERIM CHIEF EXECUTIVE 18 July 2017 NCC Group plc Annual Report and Accounts for the year ended 31 May 2017 57 NCC AR2017 - proof 8-Front.indd 57 09/08/2017 16:05:25 25546.04 9 August 2017 3:58 PM Proof Six GOVERNANCE Contents Chairman’s letter Governance framework Board of Directors Operations board Board composition and division of responsibilities Shareholder relations Audit committee report Nomination committee report Cyber security committee report Directors’ remuneration report: Annual statement Director’s remuneration policy Annual report on remuneration Directors’ report Directors’ responsibilities statement Glossary of terms Company information 59 61 62 64 65 71 74 82 84 86 86 87 96 108 112 170 172 The UK Corporate Governance Code embodies core principles of accountability, transparency, probity and a focus on long-term success. The Board firmly believes that a business that is governed in accordance with these principles will be a successful and well-managed business 58 www.nccgroup.trust Stock Code: NCC NCC AR2017 proof 8- Back.indd 58 25546.04 9 August 2017 3:59 PM Proof Six 09/08/2017 16:00:03 Chairman’s letter The Board is committed to creating and maintaining a culture where strong levels of governance thrive throughout the organisation, specifically ensuring that we send out consistent messages on the core values of the Company and acceptable behaviours from our people, our suppliers and our advisers. We have made good progress in moving towards best practice and we will regularly review the context, progress and maintenance of these standards, for the benefit of all of our stakeholders. 2017 Review Governance Standards During the latter part of the year, shareholder and employee feedback led the Board to carry out a comprehensive, independent review of all aspects of its governance. This review was led by the Senior Independent Director, who was supported by independent external advisers. The review included a comprehensive analysis of the Company’s governance systems and procedures. The review highlighted that there were weaknesses in the Company’s governance systems and procedures particularly in the application of many of the Company’s policies including, but not exclusively, expenses and social media, the process for the instigation and authorisation of legal claims, where conflicts of interest existed, the perceived independence of advisers and the perceived lack of an open and transparent leadership culture. We have made good progress in moving towards best practice in governance It resulted in the creation of a Governance Committee, chaired by the Senior Independent Director, which has overseen a number of changes to the governance processes adopted throughout the business. Actions have included: z changes to the composition of the Board, including the recruitment of an independent Chairman and an additional Non-Executive Director and the decision to commence an external search for a new Chief Executive Officer; z a review of, and in some cases change to, external advisers and other suppliers; z the initiation of a review of a number of internal policies, including expenses, reporting of legal cases, use of social media and handling of conflicts of interest. The actions noted above will be completed by December 2017. The Committee also agreed a strengthening of the senior management team and, in consultation with the Chairman of the Audit Committee, it was agreed that now was the appropriate time to move forward with the creation of an Internal Audit and Risk Management function. The Governance Committee has completed its role and has now handed over the oversight of actions to the full Board. Board Changes The year ended May 2017 has been a significant year of change for the Board. Atul Patel, Chief Finance Officer, resigned in August 2016 and left the business in February 2017. In January 2017, Paul Mitchell, Chairman, announced his intention to resign from the Board as Chairman of the Company and to step down from the Board in May 2017. Rob Cotton, Chief Executive Officer, left the business in March 2017. An external search to appoint his replacement has commenced. There followed a number of new Executive and Non-Executive Director appointments. Brian Tenner was appointed as Chief Financial Officer in February 2017, bringing substantial listed company experience. He stepped up to interim Chief Executive Officer, when Rob Cotton left the business. Chris Stone became Chairman of the Board in April 2017, initially taking on the mantle of Executive Chairman, until a new Chief NCC Group plc Annual Report and Accounts for the year ended 31 May 2017 59 NCC AR2017 proof 8- Back.indd 59 25546.04 9 August 2017 3:59 PM Proof Six 09/08/2017 16:00:08 GOVERNANCE Chairman’s letter Executive Officer is appointed. Chris brings substantial experience of listed and private equity owned technology businesses. Jonathan Brooks was appointed as Non-Executive Director in March 2017. He has added substantial non-executive experience in a listed environment, as well as tech industry experience. Strategic Review Alongside these changes to the Board and in light of the deterioration in trading in the Assurance Division during the financial year, the Board initiated a comprehensive Strategic Review of NCC Group’s markets, capabilities, opportunities and operating model. This included a review of how the assets and resources of the Group can be more efficiently deployed and utilised. The review was led by the Board and supported by externally appointed consultants. The results of the Strategic Review and resulting actions plans are set out in more detail in the Strategic Report on pages 18 to 27. Statement of compliance with the UK Corporate Governance Code The Company measures itself against the requirements of the UK Corporate Governance Code 2014 (“Code”), which is available on the Financial Reporting Council website (www.frc.org.uk). As noted in last year’s Directors’ report, from June 2016 to March 2017, the Company complied with the Code except for: z Provision B.2.1. The Company did not comply with the requirement that the Nomination Committee had a majority of members who were independent Non-Executive Directors. During this time, the Senior Independent Non- Executive Director did, however, have a casting vote. From April 2017 until 31 May 2017, the Company complied with all of the principles set out in the Code. The exceptions noted above were addressed with the appointment of Chris Stone as Chairman (although he will initially take on the role of Executive Chair until a new CEO is appointed) and the appointment of Debbie Hewitt, Senior Independent Director, to Chair the Nomination Committee, which will continue whilst Chris Stone continues as Executive Chair. Chris Stone EXECUTIVE CHAIRMAN 18 July 2017 60 www.nccgroup.trust Stock Code: NCC NCC AR2017 proof 8- Back.indd 60 25546.04 9 August 2017 3:59 PM Proof Six 09/08/2017 16:00:09 Governance framework The different parts of the Company’s governance framework are shown in the diagram below, with a description of how they operate and the linkages between them. Board The Board provides leadership and is responsible for the overall management of NCC Group, its strategy, long-term objectives and risk management. It ensures the right Company structure is in place to deliver long-term value to shareholders and other stakeholders. For further detail of the role of the Board see page 62-70. Board Committees Support the Board in its work with specific areas of review and oversight objectives and risk management. It ensures the right company structure is in place to delivery long-term value to shareholders and other stakeholders. Audit Committee Primary function is to assist the Board in fulfilling its financial and risk responsibilities. It also reviews financial reporting and the internal controls in place and the external audit process. Nomination Committee Responsible for considering the Board’s structure, size, composition and succession planning. Remuneration Committee Responsible for determining the overall remuneration of the Executive Directors and the remuneration of senior manager, within the broader institutional context of remuneration practice. Cyber Security Committee Responsible for overseeing and advising on cyber risk exposure of the Group and its future cyber risk strategy, the Group’s cyber security breach response and crisis management plan and the review of reports on any cyber security incidents. For further information see pages 74-75 For further information see pages 82-83 For further information see pages 86-88 For further information see pages 84-85 Chief Executive Has responsibility for managing the business and overseeing the implementation of the strategy agreed by the Board. Operations Board The Operations Board currently comprises the Group’s most senior business and operational executives. It is responsible for assisting the Chief Executive in the performance of its duties including: • developing the annual operating plan • monitoring the performance of the different divisions of the Company against the plan • carrying out a formal risk review process • reviewing the Company’s policies and procedures • prioritisation and allocation of resources • overseeing the day-to-day running of the Company NCC Group plc Annual Report and Accounts for the year ended 31 May 2017 61 NCC AR2017 proof 8- Back.indd 61 25546.04 9 August 2017 3:59 PM Proof Six 09/08/2017 16:00:09 GOVERNANCE Board of Directors Chris Stone Executive Chairman Brian Tenner Interim Chief Executive Officer Chris joined the Board as Executive Chairman on 6 April 2017. Chris is the Chairman of AIM listed CityFibre plc, a national alternative provider of wholesale fibre network infrastructure. Chris has also held various non-executive director and chief executive roles of listed and private equity-backed technology companies, including being a non-executive director of CSR plc from 2012 until its acquisition by Qualcomm in 2015. From 2013 to 2016, he was CEO of Radius Worldwide. Prior to this, Chris was CEO of Northgate Information Solutions plc, a UK listed company, from 1999 to 2011. It is intended that Chris will become Non- Executive Chairman once a Chief Executive Officer has been appointed (currently anticipated to occur in September 2017). Brian joined the Board as Chief Financial Officer on 1 February 2017 and was appointed as interim Chief Executive Officer on 1 March 2017 following the departure of the previous Chief Executive Officer Rob Cotton. Prior to joining NCC Group Brian held a number of senior finance positions with both publicly listed and private multinational companies. Brian was previously Group Finance Director at Renold plc from 2010 to 2016, Scapa plc from 2007 to 2010 and British Nuclear Group from 2003 to 2007. Brian also held a number of senior finance roles at National Grid from 2002 to 2003. Brian qualified as a Chartered Accountant with PwC in 1994. It is intended that Brian will become Chief Financial Officer once a Chief Executive Officer has been appointed (currently anticipated to occur in September 2017). Debbie Hewitt MBE Senior Independent Non-Executive Director R N C A Debbie joined NCC Group in September 2008 as a Non-Executive Director. She has an MBA, is a Fellow of the Chartered Institute of Personnel Development and was awarded an MBE for services to Business and the Public Sector in 2011. She is Non- Executive Chairman of Moss Bros plc and The Restaurant Group plc and is also a Non-Executive Director of Redrow plc and Visa Europe Limited, a subsidiary of Visa Inc. She also holds a Non-Executive Director role in private companies White Stuff Ltd, BGL Group Limited and Domestic and General Group Ltd. She was previously the managing Director of RAC plc. KEY: R Member of Remuneration Committee N Member of Nomination Committee C Member of Cyber Security Committee A Member of Audit Committee Chairman of Committee 62 www.nccgroup.trust Stock Code: NCC NCC AR2017 proof 8- Back.indd 62 25546.04 9 August 2017 3:59 PM Proof Six 09/08/2017 16:00:30 The Board sets the tone of the Company’s values and ethical standards and manages the business to best meet its obligations to shareholders and other stakeholders. The NCC Group plc Board comprises the following Directors. Thomas Chambers Non-Executive Director Christopher Batterham Non-Executive Director Jonathan Brooks Non-Executive Director A R N A R N C R C A Thomas joined NCC Group in September 2012. Thomas was CFO of smartphone operating systems developer Symbian Limited from 2001 until its sale to Nokia Oyj in 2009. Prior to that he was CFO of First Telecom. He is a chartered accountant and has held roles with Kleinwort Benson, the European Bank for Reconstruction and Development and Price Waterhouse. He is also Chairman of residential energy provider Impello Plc (trading as First Utility) and recruitment company Propel London Ltd and a non- executive director of Kings Arms Yard Plc and The Universities and Colleges Admissions Service. Chris is a qualified chartered accountant and was Finance Director of Unipalm plc, before becoming CFO of Searchspace Limited until 2005. He is currently Chairman of Eckoh plc and a non-executive director of Blue Prism Group plc and Frontier Smart Technologies Group Ltd. Jonathan joined the Board on 16 March 2017. Jonathan was Chief Financial Officer of ARM Holdings plc from 1995 until 2002 and has been a non-executive director of IP Group plc since August 2011. He has also held a number of senior finance and non- executive director positions with other listed and private multinational companies including directorships with Aveva Group plc and FDM Group (Holdings) plc. The Directors who held office during FY 2017 were as follows: Director Role Details Chris Stone Executive Chairman Appointed April 2017. Will revert to Non-Executive Chairman when a new CEO is appointed. Brian Tenner Chief Financial Officer Appointed February 2017. Became Interim Chief Executive Officer on 1 March 2017 and will revert to CFO when a new CEO is appointed. Debbie Hewitt Senior Independent Director Appointed September 2008 Chairman of Remuneration Committee Chairman of Nominations Committee Chairman of Cyber Security Committee The Board notes that she will have completed nine years of service in September 2017 and in line with best practice, she will step down from the Board when a replacement has been recruited and a handover completed. The Board will update the market on the timing of this in due course. Thomas Chambers Non-Executive Director Appointed September 2012 Chairman of Audit Committee Chris Batterham Non-Executive Director Appointed May 2015 Jonathan Brooks Non-Executive Director Appointed March 2017 Atul Patel Chief Financial Officer Resigned August 2016 and left the Company February 2017 Paul Mitchell Chairman Resigned January 2017 and left the Board May 2017 Rob Cotton Chief Executive Officer Resigned from the Board March 2017 and will leave the Company on 31 October 2017. NCC Group plc Annual Report and Accounts for the year ended 31 May 2017 63 NCC AR2017 proof 8- Back.indd 63 25546.04 9 August 2017 3:59 PM Proof Six 09/08/2017 16:00:51 GOVERNANCE Operations board ASSURANCE This senior management team is part of an Operations board, which typically meets monthly. Senior members of the executive team are invited to make presentations on specific topics or to discuss particular operational issues. The meetings are chaired by the Chief Executive and attended by the Chairman. Senior management The senior management team detailed right is responsible for the operation of the Group’s divisions. The members of the senior management team include: Roger Rawlinson Group Managing Director, Assurance. Rob Horton European Managing Director, Assurance. Roger is responsible for the operational management of the Group’s Assurance Division. He has worked for NCC Group for over 20 years in a variety of testing and consultancy roles and was appointed a Director in 2004. Rob is the Managing Director of NCC Group’s European Security Consulting division. He joined the Group in 2008 and has managed and grown Security Consulting services in the Assurance Division, as well as overseeing the integration of a number of the acquired security consulting companies in to the Group. Rob was a director of NGS Software, a security consulting company he co-founded from its formation in 2001 through to its acquisition by and successful integration into the Group. ESCROW COMPANY SECRETARY Daniel Liptrott Group Managing Director, Escrow. Helen Nisbet Company Secretary Helen Nisbet – Group Company Secretary. Helen is a qualified solicitor and was appointed as Company Secretary in 2015. Daniel is responsible for the management and strategic development of the Escrow Division globally. Daniel joined the Group in November 2013 from private practice where he had been a corporate partner at a number of international law firms. From 2006 until 2013 he had been the Group’s outside counsel at Eversheds LLP and advised on a range of issues including its move to the Main Market of the London Stock Exchange in 2007 and each of the Group’s subsequent acquisitions until 2013. 64 www.nccgroup.trust Stock Code: NCC NCC AR2017 proof 8- Back.indd 64 25546.04 9 August 2017 3:59 PM Proof Six 09/08/2017 16:01:14 Board composition and division of responsibilities Role profiles are in place for the Chairman and Chief Executive Officer, which clearly set out the duties of each role. Role Responsibilities The Chairman of the Board (Chris Stone) Is responsible for the running of the Board and promoting a culture of openness and debate. This role is currently filled by the Executive Chair, who will become Non-Executive Chair on the appointment of a new Chief Executive Officer. The Chairman, in conjunction with the Chief Executive and other Board members, plans the agendas, which are issued with the supporting Board papers in advance of the Board meetings. These supporting papers provide appropriate information to enable the Board to discharge its duties which include monitoring, assessing and challenging the executive management of the Group. The Chief Executive Officer (Brian Tenner – Interim) Together with the senior management team, is responsible for the day-to-day running of the Group and regularly provides performance reports to the Board. This role is currently filled by a combination of the Executive Chair and interim Chief Executive, with the former focusing on external relationships and the Strategic Review and the latter on the operational management of the business with the support of the Operations Board. The Company has initiated an external search to recruit a new Chief Executive Officer. The Chief Financial Officer (Brian Tenner) Works closely with the CEO with specific responsibility for all financial matters including Group accounting policies, financial control, tax and treasury management, risk management and financial probity. The CFO is responsible for the Group’s Information Systems and Property portfolio. The CFO is also accountable for the transparency and appropriateness of management information and key performance indicators, internally and externally. The Senior Independent Director (Debbie Hewitt) The Senior Independent Director provides a sounding board for the Chairman and serves as an intermediary for other Directors, employees and shareholders when necessary. The main responsibility is to be available to the shareholders should they have concerns that they have been unable to resolve through normal channels or when such channels would be inappropriate. The other Non- Executive Directors (Thomas Chambers, Chris Batterham and Jonathan Brooks) Company Secretary (Helen Nisbet) Maintain an ongoing dialogue with the Executive Directors which includes constructive challenge of performance and the Group’s strategy. The role of the Company Secretary is to ensure good information flows within the Board and its Committees and between senior management and Non-Executive Directors. The Company Secretary is responsible for facilitating the induction of new Directors and assisting with their professional development as required. All Directors have access to the advice and services of the Company Secretary to enable them to discharge their duties as Directors. The Company Secretary is responsible for ensuring that Board procedures are complied with and for advising the Board through the Chairman on governance matters. The appointment and removal of the Company Secretary is a matter for the Board as a whole. NCC Group plc Annual Report and Accounts for the year ended 31 May 2017 65 NCC AR2017 proof 8- Back.indd 65 25546.04 9 August 2017 3:59 PM Proof Six 09/08/2017 16:01:14 GOVERNANCE Board composition and division of responsibilities Experience of the Board The members of the Board bring a wide range of skills and experience to the Group. This diverse skill set allows the Board to appropriately challenge and lead the Group’s strategy. As noted previously, the Board consciously chose a new Non- Executive Director with specific digital market experience in order to meet an identified gap. The chart below summarises their key areas of significant experience. Strategy development Sales and marketing Human resources Corporate governance Financial management M&A Professional services Chris Stone Brian Tenner Debbie Hewitt Thomas Chambers Chris Batterham Jonathan Brooks Meetings and attendance The Board considers that each Director is able to allocate sufficient time to the Company to discharge their responsibilities effectively. The Non-Executive Directors are contracted to spend a minimum of 24 days per annum on NCC Group affairs and on average spent 40 days on Company business during the year. Over and above this, a number of additional days were committed by the Senior Independent Director during the year and specifically from the period from October 2016 to May 2017, when she led the Company’s consultation with key shareholders, chaired the newly created Governance Committee, which comprehensively reviewed the standards of Corporate Governance across all aspects of the business, chaired the Nominations Committee, as well as overseeing the initiation of the Strategic Review. During this period, she also led the recruitment of the new Chairman and an additional Non-Executive Director. 66 www.nccgroup.trust Stock Code: NCC NCC AR2017 proof 8- Back.indd 66 25546.04 9 August 2017 3:59 PM Proof Six 09/08/2017 16:01:16 A summary of each current Director’s attendance at meetings that they were eligible to attend of the Board and its Committees during 2017 is shown below. Unless otherwise indicated, all Directors held office throughout the year: Board # Attended Unattended Chris Stone1 Brian Tenner2 Debbie Hewitt Thomas Chambers Chris Batterham Jonathan Brooks4 Paul Mitchell5 Rob Cotton6 Atul Patel7 Audit Remuneration Nomination Cyber Governance3 # n/a n/a n/a n/a n/a n/a n/a n/a n/a n/a n/a n/a # # * * n/a n/a n/a n/a n/a * n/a n/a n/a # # n/a n/a n/a * By Invitation. # Committee Chair. 1 2 3 Appointed Executive Chair 6 April 2017. He will revert to Non-Executive Chair on the appointment of the new CEO. Appointed Chief Financial Officer 1 February 2017 and interim CEO 1 March 2017 until the appointment of the new CEO. Governance Committee created to oversee the governance review. Following the assessment of a final report and agreement of the resulting action plan, the Committee handed responsibility for monitoring the implementation of the action plan to the main Board in April 2017, on the appointment of an Independent Chairman. Appointed 16 March 2017. 4 5 Chairman until 5 April 2017. Chair of Remuneration Committee until 18 January 2017. 6 CEO until 1 March 2017. 7 CFO until 1 February 2017. Stepped down from Board following resignation on 10 August 2016. Independent advice All Directors have access to the advice and services of the Company Secretary and Directors are entitled to take independent professional advice if necessary, at the expense of the Company. Conflicts of Interest The Companies Act 2006 requires Directors to avoid situations where they have, or could have, a direct or indirect interest that conflicts or potentially conflicts with the interests of the Company. The Company’s Articles of Association require any Director with a conflict or potential conflict to declare this to the Board. That Director will not then be involved in the discussions relating to the proposal, transaction, contract or arrangement in which they have an interest, unless agreed otherwise by the Directors of the Company in the limited circumstance specified in the Articles of Association, nor will they be counted in the quorum or be permitted to vote on any issue in which they have an interest. During the year, the Audit Committee approved corporate finance fees payable to Rickitt Mitchell & Partners Ltd of £0.3m (2016: £0.8m) in relation to disposal of the OpenRegistry Group of companies and other M&A activity. Paul Mitchell, who was Chairman of NCC Group plc until April 2017 and who is the Non-Executive Chairman of Rickitt Mitchell, was excluded from all discussions on the approvals of fees. Directors’ and Officers’ liability (D&O) insurance The Company maintains D&O insurance to cover the cost of defending civil proceedings brought against them in their capacity as a Director or Officer of the Company (including those who served as Directors or Officers during 2016). Board independence As required by the Code, at least 50% of the Board, excluding the Chairman, are independent Non-Executive Directors; the Board comprises two Executive Directors, four independent Non-Executive Directors and the Non-Executive Chairman (currently an Executive Chairman and one of the Executive Directors referred to above). Paul Mitchell, the Chairman from June 2016 to April 2016, did not comply with the assessment of independence as he had served as Chairman for 17 years and did not meet the requirements for the Chairman to be independent. The Board considered this and put safeguards in place where this could impact his role. For areas where independence was deemed to be key to any decision making, the Senior Independent Non-Executive Director was able to assume that position of responsibility where necessary and had the casting vote in the event of a split decision. NCC Group plc Annual Report and Accounts for the year ended 31 May 2017 67 NCC AR2017 proof 8- Back.indd 67 25546.04 9 August 2017 3:59 PM Proof Six 09/08/2017 16:01:16 GOVERNANCE Board composition and division of responsibilities Chris Stone was recruited as independent Non-Executive Chairman in April 2017, and has temporarily taken up the role of Executive Chairman, whilst the Company recruits a new Chief Executive. The Board is satisfied that on appointment Chris Stone was independent as he met the criteria specified below. The Board has debated and considers that all of the other current Non-Executive Directors are independent, and in so doing considered the profile of all of the individuals, concluding that none of them: z has ever been an employee of the Group; z has ever had a material business relationship with the Group or receives any remuneration other than their salary or fees; z has close family ties with advisers, other Directors or senior management of the Group that could reasonably be expected to cause a conflict; z holds cross-directorships or has significant links with other Directors through involvement with other companies or bodies; z represents a significant shareholder; or z has at the point of this report, served on the NCC Group Board for more than nine years from the date of their first election. The Board notes that Debbie Hewitt, Senior Independent Director will have completed nine years on the Board in September 2017. The Board considers Debbie to remain fully independent in her character, judgement and approach. It is the Board’s intention that she will remain in role to provide continuity whilst any changes that come from the strategy review are implemented, which is currently anticipated as some time during 2018. In the meantime, the Company will continue to search for an additional Non-Executive Director to provide for her succession. The Non-Executive Directors provide a strong independent element on the Board and are well placed to constructively challenge and help develop proposals on strategy and succession planning. Between them they bring an extensive and broad range experience to the Group. Details of the Directors’ respective experience is set out in their biographical profiles on pages 62 to 63. The terms and conditions of appointment of Non-Executive Directors are available for inspection at the Company’s registered office during normal business hours. Diversity The principle of Board diversity is strongly supported by the Board. It is the Board’s policy that appointments to the Board will always be based on merit so that the Board has the right balance of individuals in place. The Board recognises that diversity of thought, approach and experience is an important consideration and is therefore one of the selection criteria used to assess candidates prior to any Board appointments. The Company’s policy is to find, develop and maintain a diverse workforce at all levels and it is committed to developing a culture where women can achieve and retain senior positions. The table below sets out the current position of the Company on a gender basis: Main Board Operations Board Male 83% Female 17% Male 92% Female 8% Direct Reports to Operations Board NCC Employees at 31 May 2017 Male 78% Female 22% Male 80% Female 20% Given the relatively small size of the Board, it would not seem appropriate to impose specific formulaic gender or diversity targets but it is the Company’s intention to increase the gender and ethnic diversity of the Board and senior management team as opportunities arise. Annual re-election In accordance with the Code, the Directors appointed in the financial year ended 31 May 2017 are subject to election by shareholders at the AGM in September 2017 and, in line with best practice, all others are subject to re-election annually. Director induction, training and development Brian Tenner, Jonathan Brooks and Chris Stone joined the Board during the year and were provided with an induction on www.nccgroup.trust Stock Code: NCC 68 NCC AR2017 proof 8- Back.indd 68 25546.04 9 August 2017 3:59 PM Proof Six 09/08/2017 16:01:17 appointment, which included visits to the Group’s operations and meetings with operational and executive management. Each Director’s induction is tailored to their experience and background with the aim of enhancing their understanding of the Group’s business, the operating divisions, employees, customers, suppliers and advisers and the role of the Board in setting the tone of our culture and governance standards. The Company acknowledges the importance of developing the skills of the Directors to run an effective Board. To assist in this, Directors are given the opportunity to attend relevant courses and seminars to acquire additional skills and experience to enhance their contribution to the ongoing progress of the Group. All of the Directors attend sessions which are aimed at updating the Board on trends and developments in corporate governance. Board and Committee effectiveness review The performance of the Board and its committees are appraised annually and in 2017, it was scheduled for an independent review of the Board to be completed. However, due to the number of Director changes in the year, it was agreed that an independent committee evaluation would be deferred until the Board has had time to form and establish performance and behavioural norms. An internal effectiveness review was completed instead for the year ending 2017. The evaluation identified changes which would improve the working of the Board, including: z Board succession and the need to manage NED succession over the coming year, including the enhancement of the Board with two additional Non- Executives: — one with Audit Committee experience; — one with Remuneration Committee experience; and — ideally one of these also to have specific ‘digital’ industry experience. z The appointment of Jonathan Brooks in March 2017 met the objectives in respect of Audit Committee experience and digital industry experience. Director being appraised Appraiser z Strengthening of the Senior Management team, to reflect the outputs of the Governance Committee. The specific actions, including the appointment of an HR Director to the Operations Board, will be developed and implemented on the appointment of a Chief Executive Officer. z Enhancement to the Board Management Information pack, to more closely align with the strategy, customer and operational metrics of the business. — This new structure will be developed in line with the new Target Operating Model set out on pages 19 to 23 of the Strategic Report. It will include aligned KPIs that map to our short and medium-term strategic goals and objectives. During the year, each of the Audit Committee, Remuneration Committee, Nomination Committee and Cyber Security Committee carried out an internal self-evaluation on their effectiveness. A number of recommendations were made, including the creation of an internal Audit function by the Audit Committee, the initiation of a process to provide for the Remuneration Committee Chair succession by the Remuneration Committee. The Nomination Committee recommended that the Board should undertake a broader review of management talent and succession planning across the business in 2017/18 and the Cyber Security Committee concluded that the committee should be renamed the Risk Committee and that its terms of reference should embrace all aspects of risk, not just cyber risk, as operational elements of risk are inextricably linked to cyber. As such, this Committee will be renamed the Risk Committee going forward. Individual Director appraisals process During the year, the Senior Independent Non-Executive Director evaluated the performance of the Chairman and the Chairman evaluated the performance of each Director. In addition, the Non-Executive Directors met independently from the Executive Directors to discuss with the Chairman the overall functioning of the Board and his contribution in making it effective. Going forward, appraisals have been or will be carried out by the following individuals: Chairman Reviewed by the Non-Executive Directors, excluding the Chairman, and feedback facilitated by the Senior Independent Non-Executive Director. Chief Executive Officer Reviewed by all of the Non-Executive Directors and CFO and feedback facilitated by the Chairman. Chief Financial Officer Non-Executive Directors Reviewed by all of the Non-Executive Directors and feedback facilitated by the Chief Executive Officer and Chairman. Reviewed by the Executive Directors and by their Non-Executive Director peers and feedback collated and given by the Chairman. NCC Group plc Annual Report and Accounts for the year ended 31 May 2017 69 NCC AR2017 proof 8- Back.indd 69 25546.04 9 August 2017 3:59 PM Proof Six 09/08/2017 16:01:18 GOVERNANCE Board composition and division of responsibilities Operation of Governance Framework Role of the Board The Board is responsible for reviewing, challenging and approving the strategic direction of the Group, whilst providing strong values based leadership of the Company, within a framework of prudent and effective controls, which enable risk to be assessed and appropriately managed. The Board reviews the Group’s business model and strategic objectives to ensure that the necessary financial and human resources are in place to achieve these objectives, to sustain them over the long-term and to review management performance in their delivery. Risk Management The Board has ultimate responsibility for ensuring the business risks are effectively managed. The Board has delegated regular review of the risk management procedures to the Audit Committee and collectively reviews the overall risk environment on an annual basis. The day-to-day management of business risks is the responsibility of the senior management team through the Operations Board. For a more detailed review of risk management processes, the principal risks faced by the Group and their mitigation, as well as a risk ‘heat map’ see pages 48 to 53. Internal control The Group has a system of internal controls which aim to support the delivery of the Group’s strategy by managing the risk of failing to achieve business objectives and to protect the stewardship of the Group’s assets. As such the Group can only provide reasonable and not absolute assurance. In addition, the Group insures against various risks, but certain risks remain difficult to insure, due to the breadth and cost of cover. In some cases, external insurance is not available at all, or not at an economical price. The Group regularly reviews both the type and amount of external insurance that it buys and in 2017 retendered the Group’s insurance policies. Executive Remuneration During the year, we continued to operate within the Remuneration Policy that was put to a binding shareholder vote at the 2014 AGM. This policy was adopted for three years. As this period is coming to an end, the Committee has now reviewed the policy to assess its appropriateness and alignment to the business strategy and has consulted with shareholders and shareholder advisory groups on its proposed changes. These proposed changes are summarised in the Remuneration Committee report on pages 88 to 91. The Board sets the tone of the Company’s values and ethical standards and manages the business in a manner to meet its obligations to shareholders and other stakeholders. It receives information on at least a monthly basis to enable it to review trading performance, forecasts and strategy and it has a schedule of matters specifically reserved for its decision. The most significant of these are: z approval of strategic plans, annual operating plans and any material changes to them; z oversight of the Group’s operations ensuring competent and prudent management, sound planning, an adequate system of internal control and governance; z through the Audit Committee, oversight of financial reporting systems and information and adherence to appropriate accounting policies; z changes to the structure, size and composition of the Board and Operating Board, oversight of the Company culture and ethical standards of the leadership and the independence of Non-Executive Directors, taking into consideration prudent succession planning; z approval of the acquisition or disposal of subsidiaries and major investments and capital projects; z approval of the dividend, treasury and banking policies, including the Group’s capital structure; z through the Remuneration Committee, the delivery of an effective Executive Remuneration Policy; z receiving reports on the views of the Company’s shareholders and approval of all documents put to shareholders at a general meeting or circulated to shareholders; and appointment of key advisers. The Board has reviewed this schedule during the year and added specific matters where they feel it is critical to the ongoing success of the business. As noted above, the operational management of the Group is delegated to the Operations Board of NCC Group. The Board also delegates other matters to Board committees and management as appropriate. 70 www.nccgroup.trust Stock Code: NCC NCC AR2017 proof 8- Back.indd 70 25546.04 9 August 2017 3:59 PM Proof Six 09/08/2017 16:01:18 Shareholder relations Share capital structure The Company’s issued share capital at 1 June 2017 consisted of 276,510,137 ordinary shares of one pence each. There are no special control rights or restrictions on share transfer or special rights pertaining to any of the shares in issue and the Company does not have preference shares. During the year 452,589 new shares were issued under the Company’s all employee Save As You Earn scheme. As far as is reasonably known to management, the Company is not directly or indirectly owned or controlled by another Company or by any government. Board engagement with shareholders Communications with shareholders are given high priority. There is a regular dialogue with institutional investors including presentations after the Company’s year-end and half year results announcements. A programme of meetings take place throughout the year with major institutional shareholders and private shareholders have the opportunity to meet the Board face-to-face and ask questions at the Annual General Meeting. During the financial year the Directors held the following meetings with shareholders: In addition to the Board’s regular engagement with shareholders in 2017, the Senior Independent Director consulted with major shareholders on the Board structure, the performance of key executives and the decision to implement a full strategic review. The Senior Independent Director held 18 one-on-one meetings and 26 phone calls with investors on such matters during the year. The Remuneration Committee consulted with 15 institutional shareholders and three shareholder advisory groups during April and May 2017 to discuss the future Remuneration Policy and subsequently advised shareholders in writing of the proposed changes. Board shareholder updates Feedback from major institutional shareholders is provided to the Board on a regular basis and, where appropriate, the Board takes steps to address their concerns and recommendations. Substantial shareholdings As at 17 July 2017, the Company had been notified of the following interests of 3% or more in the issued share capital of the Company under the UK Disclosure and Transparency Rules: Investor meetings (FY2016/17 results roadshows) One-to-one meetings 81 Conference calls 13 Group meetings 3 Number of meetings per institutional investor 1-2 meetings 42 3+ meetings 21 150+ investor meetings and calls during FY2016/17 NCC Group plc Annual Report and Accounts for the year ended 31 May 2017 71 NCC AR2017 proof 8- Back.indd 71 25546.04 14 August 2017 10:13 AM Proof Eight 14/08/2017 10:21:28 GOVERNANCE Shareholder relations Shareholder Montanaro Asset Management Neptune Investment Management Number of ordinary shares 2017 % of NCC’s total share capital 2017 % of NCC’s total share capital 2016 2016 21,745,000 21,060,760 17,632,559 – Legal And General Investment Management 15,207,286 12,221,443 RWC Partners Schroder Investment Management Baillie Gifford & Co Artemis Investment Management Aberforth Partners Fidelity Management & Research Fidelity Management & Research Total above 13,784,443 5,413,992 11,508,326 2,175,000 11,389,759 7,046,188 10,439,726 971,009 10,118,502 9,735,500 9,065,956 120,891,557 – – – – 7.86 6.38 5.50 4.99 4.16 4.12 3.78 3.66 3.52 3.28 7.64 – 4.43 1.96 0.79 2.55 0.35 – – – 40.45 17.72 There have been no notifications under DTR 5 between the date of the information in this table and 18 July 2017 when the Annual Report and Accounts were signed. As at 1 June 2017 Location of investors Type of investor UK North America Europe (ex UK) 8.53% 4.75% Unidentified 0.31% Unanalysed -5.83% Rest of World 0.0% 80.92% 92.94% Domestic Institutions Foreign Institutions Private Stakeholders /Investors Hedge Funds Domestic Brokers Employees etc. Foreign Brokers 13.07% 5.60% 5.97% 2.95% 0.42% 0.17% Unanalysed -9.42% Unidentified 0.31% 72 www.nccgroup.trust Stock Code: NCC NCC AR2017 proof 8- Back.indd 72 25546.04 9 August 2017 3:59 PM Proof Six 09/08/2017 16:01:18 Directors’ shareholdings For details of Directors’ shareholdings, remuneration and interests in the Company’s shares and options, together with information on service contracts see pages 86 to 107 of the Directors’ remuneration report. Annual General Meeting The Annual General Meeting (AGM) is an opportunity for shareholders to vote on certain aspects of Group business and provides a useful forum for one-to-one communication with private shareholders. At the AGM shareholders receive presentations on the Company’s performance and may ask questions of the Board. The Chairman seeks to ensure that the Chairmen of the Audit, Remuneration and Nomination Committees are available at the meeting to answer questions and for all Directors to attend. The table below shows the different resolutions proposed at the 2016 AGM, the proportions of possible votes that were cast and the proportions in favour and against each resolution (resolutions 1 to 11 and resolution 16 were passed as ordinary resolutions and resolutions 13 to 15 were passed as special resolutions). 1. To receive the report and accounts 212,807,417 99.14 1,842,830 2. To approve the Directors’ remuneration 212,330,807 98.92 2,312,857 Votes for % Votes against % 0.86 1.08 Total votes cast 214,650,247 214,643,664 report (other than the Directors’ remuneration policy) 3. To declare a final dividend of 3.15p 212,869,790 99.16 1,792,830 0.84 214,662,620 per share 4. To reappoint the auditors 5. To authorise the Audit Committee to determine the auditors’ remuneration 214,662,235 100.00 214,662,235 100.00 0 0 0.00 0.00 214,662,235 214,662,235 6. To re-elect Rob Cotton as a Director 213,897,646 99.64 764,589 0.36 214,662,235 % of issued share capital voted 77.77 77.76 77.77 77.77 77.77 77.77 Votes withheld 12,373 18,955 0 385 385 385 7. To re-elect Paul Mitchell as a Director 206,311,727 98.99 2,094,840 1.01 208,406,567 75.51 6,256,052 8. To re-elect Debbie Hewitt as a Director 204,777,479 99.34 1,355,128 0.66 206,132,607 74.68 8,530,013 9. To re-elect Thomas Chambers a Director 214,607,951 99.99 25,410 0.01 214,633,361 77.76 29,259 10. To elect Chris Batterham as a Director 202,718,418 96.97 6,329,999 11. To authorise the Directors to allot shares 196,451,231 91.52 18,211,004 13. To authorise the Directors to disapply 209,195,089 97.45 5,467,146 3.03 8.48 2.55 209,048,417 214,662,235 214,662,235 75.74 5,614,203 77.77 77.77 385 385 pre-emption rights up to 5% of the issue share capital 14. To authorise the Directors to disapply 187,846,573 87.51 26,800,482 12.49 214,647,055 77.77 15,565 pre-emption rights for an additional 5% in relation to an acquisition or capital investment 15. To authorise the purchase of own shares pursuant to s.701 of the Companies Act 2006 211,548,597 98.55 3,114,023 1.45 214,662,620 77.77 16. To reduce the notice period required for 209,001,515 97.36 5,661,104 2.64 214,662,619 77.77 General Meetings 17. To approve the adoption of the NCC Group 0 0 International Sharesave Plan 214,653,473 100.00 2,162 0.00 214,655,635 77.77 6,985 The 2017 AGM will be held at 9.00 am on Thursday 21 September 2017 at the offices of DLA Piper UK LLP, 1 London Wall, London, EC2Y 5EA. The notice convening this meeting has been sent to shareholders at the same time as publication of this Annual Report and Accounts and is available at www.nccgroup.trust/uk/about-us/investor-relations/. By order of the Board Chris Stone EXECUTIVE CHAIRMAN 18 July 2017 NCC Group plc Annual Report and Accounts for the year ended 31 May 2017 73 NCC AR2017 proof 8- Back.indd 73 25546.04 9 August 2017 3:59 PM Proof Six 09/08/2017 16:01:18 GOVERNANCE Audit committee report The Audit Committee has had a busy year helping the business and new management team get to grips with the complexities of the Group The Audit Committee’s Key Objectives The purpose of the Audit Committee is to assist the Board in the discharge of its fiduciary duties of stewardship of the Group’s assets. The Committee particularly focuses on systems and processes of management control, the reporting of internal management information, and externally reported financial information. The Committee also provides a forum for reporting by the external auditors. an audit, the accounting and audit judgements made, the level of any errors identified during the audit and the effectiveness of the audit process itself; z Reviewing the effectiveness of the Group’s internal control systems; z Reviewing the nature and extent of significant financial risks and how they can be mitigated; z Making recommendations to the Board in relation to the appointment of the external auditors, approving their remuneration and terms of engagement; z Overseeing the relationship with the external auditors including, but not limited to, assessing their independence, objectivity and effectiveness; and z Reporting to the Board on the procedures for responding to whistle-blowing, fraud or potential breaches of anti-bribery legislation. A full copy of the Committee’s Terms of Reference can be found in the Investor Relations section of the Group’s website at www.nccgroup.trust/uk/about-us/investor-relations. The Audit Committee’s Responsibilities The Committee’s main responsibilities include: Activities during the Year This year, the Committee: z Monitoring the integrity of the financial statements and any formal announcements relating to the Group’s financial performance and their compliance with the provisions of IFRS, the UK Corporate Governance Code, Disclosure and Transparency Rules and other regulations; z Reviewing material information and significant accounting judgements contained in it; z Advising the Board on the continuing appropriateness of the Group’s existing accounting policies and the application of any new or modified accounting and reporting standards; z Advising the Board on the effectiveness of the processes undertaken to ensure that the Annual Report and Accounts, when taken as a whole, is fair, balanced and understandable; z Reviewing the audit findings with the external auditors including discussing any major issues that arise during z Reviewed and challenged a number of additional trading statements; z Supported new Board members in their onboarding process as well as assisting employees carrying on additional interim duties; z Sponsored additional review and detailed testing of financial components identified as of concern to stakeholders (such as revenue recognition and accrued income); z Supported management in the overhaul and upgrade of our Annual Report and Accounts and financial disclosures generally. 74 www.nccgroup.trust Stock Code: NCC NCC AR2017 proof 8- Back.indd 74 25546.04 9 August 2017 3:59 PM Proof Six 09/08/2017 16:01:25 Composition The Audit Committee is chaired by me, a Chartered Accountant of 30 years’ standing. I have previously served as the Chief Financial Officer of two companies operating in the telecommunications sector including Symbian Limited (developer of operating systems for Smartphones). I also have experience as a Director of publicly listed entities. My earlier career included roles with Kleinwort Benson corporate finance and accountants Price Waterhouse. The Board considers that I have the recent and relevant experience required by the UK Corporate Governance Code 2014. The other members of the Committee who served throughout the year are the senior independent Non-Executive Director, Debbie Hewitt, who has a wide range of relevant business experience in a number of publicly listed entities and Chris Batterham, a Chartered Accountant who has served as a Chief Financial Officer in a number of companies, including some in the digital world. In addition, Jonathan Brooks, who joined the Board in March 2107, was appointed to the Committee at the end of June 2017. All members of the Committee are considered to be independent. Summary biographies of each member of the Committee are included on pages 62 to 63. Meeting Frequency and Attendance The Terms of Reference for the Committee require at least three meetings per year. During this financial year the Committee met 3 times. As well as the members of the Committee, the meetings are usually attended by the Chairman, the other Non-Executive Directors, the Chief Executive and the Chief Financial Officer. The external auditors also attend each meeting. During the year the Committee met, on a number of occasions, with the external auditors without the Executive Directors being present. The attendance of individual Committee members at Audit Committee meetings is shown in the table below: Attended Unattended Meetings attended Significant issues considered during the year in relation to the Financial Statements During the year, the Committee reviewed and considered the following areas in respect of financial reporting and the preparation of the interim and annual financial statements: z the appropriateness of the accounting policies used; z significant areas of management judgement or estimation; z compliance with external and internal financial reporting standards and policies; z disclosure and presentation of GAAP and non-GAAP information; z the requirement for a formal internal audit function; and z whether the Annual Report and Accounts taken as a whole is fair, balanced and understandable and provides the information necessary to assess the Group’s financial position, performance, business model and strategy. In carrying out this review the Committee considered the advice of the Group’s finance team and the external auditors’ reports setting out their views on the accounting treatments and judgements included in the financial statements. Significant accounting areas and areas of significant management judgement The table below summarises some of the significant accounting issues and judgements that the Committee considered during the year in relation to the Financial Statements. These are identified as recurring items that the Committee regularly reviews and items of current year focus. The table also sets out the financial context and potential impact of each item as well as the impacted KPIs. Finally, the table shows the degree of judgement that the Committee feels has to be applied for each item. Items with a significant impact but with a “low” judgement level will typically have extensive independent third party evidence of the bases for any judgement. Areas assessed as requiring a “high” level of judgement tend to rely more heavily on management estimates and historical trends than extensive independent third party evidence. Thomas Chambers Debbie Hewitt Chris Batterham Jonathan Brooks NCC Group plc Annual Report and Accounts for the year ended 31 May 2017 75 NCC AR2017 proof 8- Back.indd 75 25546.04 9 August 2017 4:01 PM Proof Six 09/08/2017 16:01:25 GOVERNANCE Audit committee report Review items Goodwill carrying values (recurring) Relevance to the Financial Statements Group net assets £212.1m Goodwill value £198.7m Related KPIs Net assets Intangible asset carrying values (recurring) Group net assets £212.1m Intangible assets value £267.6m Net assets EBIT margin, Adjusted results Accounting for business combinations (recurring) Acquisition consideration £20m Fair value adjustments £0.5m Exceptional charges Asset valuations Revenue recognition and accrued income (current year focus) Revenue £244.5m EBIT (£53.4m) Accrued income £17.7m Individually significant items (recurring) Net charges (£71.0m) EBIT loss (£53.4m) Recoverability of working capital (current year focus) Total working capital £2.5m Net assets £221.1m Taxation (current year focus) Tax charge £1.3m Loss after tax (£56.6m) Holiday pay provision (current year focus) EBIT (£53.4m) Holiday pay provision £3.3m Net assets £212.4m Revenue and growth rates EBIT and EBIT margin Adjusted results EBIT and EBIT margin Net working capital ratio Free cash flow Profit after tax Earnings per share Effective tax rate EBIT and EBIT margin Net Assets Judgement required High High Medium Low Medium Low Low Low A more detailed explanation of each item is included in the paragraphs below. Goodwill carrying value (recurring item: see note 11 to the financial statements) The Group has made a number of acquisitions in recent years, including two in 2016-17 and one more of significant scale in each of the previous two years. At the start of the current financial year, the Group had Goodwill of £224.3m. In accordance with IAS 36, management has determined appropriate cash generating units (CGUs) on which to base the annual impairment review for goodwill and indefinite-lived intangible assets by comparing the recoverable amount to the carrying value. Impairment reviews are based on discounted future cash flow models that can contain a significant degree of management judgement in terms of the basis of the CGUs, the associated forecast cash flows, the appropriate growth rates to apply to revenues and margins, and the discount rates to be used. The Committee has reviewed the rationale used to determine the cash generating units and assumptions used in future cash flows that underpin the valuation of goodwill. The CGUs used in the review of Goodwill changed during the year. This reflects the outcome of the Strategic Review that led to an updated management view of the lowest appropriate level of asset groupings that generate separately identifiable cash inflows. This is set out in more detail in note 11 to the Accounts. The Committee is satisfied that the revised CGU categorisation is an accurate reflection of both the independently generated cash inflows and the way that the businesses are now managed and reported within the Group. The Committee is also satisfied that the cash flows and discount rates used in the valuations are neither overly optimistic nor overly conservative and represent management’s best estimate of the recoverable value of the goodwill in the relevant CGUs. The conclusion of this year’s review was to impair the goodwill relating to the Accumuli acquisition by £24.3m (of the acquisition total of £51.6m) and in respect of the acquisition of Fox-IT by £24.3m (of the acquisition total of £70.9m). Historical goodwill of £7.9m in respect of the acquisition of our Web Performance business was also impaired by £5.7m. More details on the background to the performance and prospects of the Fox-IT and Accumuli acquisitions can be found in the Strategic Report on page 44 and in note 11 to the financial statements. Intangible assets carrying value (Including acquired intangibles, software and capitalised development costs) (recurring item: see Note 11 to the financial statements). The total value of acquired intangible assets at the start of the year was £49.7m. The movements in this balance during the year are set out in note 11 to the financial statements. While certain amounts were written off the carrying value of goodwill www.nccgroup.trust Stock Code: NCC 76 NCC AR2017 proof 8- Back.indd 76 25546.04 9 August 2017 4:01 PM Proof Six 09/08/2017 16:01:26 in the Web Performance, Accumuli and Fox-IT businesses, no impairments were needed in respect of the acquired intangible assets in these businesses or in any other CGU. The Group continues to incur external and internal costs on the Group’s own information systems including a Group-wide finance system. These are referred to as ‘Software intangibles’. Total costs of £3.7m have been capitalised in the year offset by amortisation charges of £1.7m and a reclassification of £6.6m to produce a net book carrying value, including software licences, at the end of the financial year of £9.0m (2016: £17.7m). The Group is also undertaking a number of development projects aimed at producing new products and services. These activities are collectively referred to as ‘Development’ costs and where IFRS recognition criteria are met, costs incurred are capitalised. Total costs of £3.7m have been capitalised in the year plus a reclassification of £6.6m offset by amortisation charges of £1.7m and impairment charges of £7.8m (see below for more detail) to give a closing net book value of £10.2m. A key part of the investment in the current year has been the continued development of the Fox-IT and NCC Group technologies to expand the High Assurance range of products and to operate the Threat Intelligence and Managed Services Platforms. These products and platforms are in use in the business today and generate returns that support their carrying values. The Web Performance business has a number of capitalised development projects driven by income generating services sold in the market. In two of these, revenue growth has been slower than anticipated and therefore impairments have been recognised totalling £3.2m. In one case, due to the expected time to reach a break-even cash flow, the entire asset has been impaired and in future no further costs in relation to the project will be capitalised. Instead they will be charged in full to the P&L. The estimated impact on EBIT in the new financial year will be an additional operating charge of £0.6m. In the prior year, £6.9m of capitalised developments costs, infrastructure and know-how were written off in respect of the discontinued Domain Services division. At the time of the disposal of the Open Registry businesses in January 2017 and the associated exit from Domain Services, certain specific assets were retained within the Group. The total value of retained assets as at 31 May 2016 was £4.2m of which £2.3m related directly to the ownership of the TLD .trust with the balance relating to a software tool (‘CMS’) that was originally intended for use in Domain Services. Following the cessation of Domain Services, the carrying value of TLD .trust is in question. Given uncertainty as to any recoverable value, the decision has therefore been take to write the asset value down to zero. At the same time, it is not felt that CMS tool will be used in the business in future and has similarly been written off in full. Accounting for business combinations (recurring item: see note 16 to the financial statements) The Group is required to identify the fair value of all assets and liabilities at the time of acquisition including assets and liabilities that were not necessarily included on the acquired business’s balance sheet. The process of assessing fair value involves estimates and judgements based on expected future cash flows. These estimates are therefore inherently uncertain to a greater or lesser extent. In the current year the Group acquired PSC in September 2016 and VSR in November 2016. Management completed the exercises to determine the fair value of intangible assets and other net assets acquired in both of these acquisitions in accordance with IFRS 3. The Committee has reviewed a summary of the key assumptions adopted and compared these to other recent acquisitions. We have also discussed with our external auditors, KPMG, the accounting for acquisitions and the related disclosures to ensure that they are complete, accurate, understandable and compliant with IFRS 3. The Committee is satisfied that the values and disclosures around the acquisitions are appropriate. Revenue recognition and accrued income (current year focus item: see note 1 to the financial statements) During the year, reflecting the upcoming change in revenue recognition rules in 2019 (FRS 15) the reliance on manual processes and controls within the business, and the inherent risks around revenue recognition more generally, the Committee decided to review the basis and methodologies used to recognise revenue in the Group. The Committee commissioned a detailed data analytics exercise by an independent firm of chartered accountants to review the underlying transactions for revenue recognition and the movements in and out of accrued and deferred income. Revenue transactions were also traced through to cash receipts. The broad conclusion of this exercise was that despite the over-reliance on manual systems and processes, no material systematic issues or errors were identified with the substance of reported revenue in the major business units in the current and previous years. However, it was noted that on occasional instances in the Escrow Division, where invoices had already been issued and paid by the customer, that revenues had been incorrectly recognised in advance of the provision of the service. The impact of these instances on the financial statements was not considered material and more robust procedures have since been established. NCC Group plc Annual Report and Accounts for the year ended 31 May 2017 77 NCC AR2017 proof 8- Back.indd 77 25546.04 9 August 2017 4:01 PM Proof Six 09/08/2017 16:01:26 GOVERNANCE Audit committee report Individually significant items (current year focus item: see note 3 to the financial statements) Taxation (current year focus item: see note 8 to the financial statements) Exceptional items by their nature and scale could have a significant impact on the reporting of ‘adjusted’ items such as Adjusted EBITDA, Adjusted EBIT and Adjusted EPS. It is critical that these are properly categorised in order to allow a user of the financial statements to form an accurate picture of the underlying performance of the business. The Committee challenged management to provide the rationale for the treatment of certain costs as exceptional. The Committee has also challenged management on the use of ‘Adjusted’ or non-GAAP reporting metrics. All ‘Adjusted’ metrics are fully disclosed and reconciled to GAAP measurements in the Financial Statements. Following this review and challenge to management, the Committee concluded that the items that have been designated as exceptional and hence excluded from ‘Adjusted’ measures of performance, were sufficiently material and unrelated to the underlying business to be properly classified in this way. Recoverability of working capital (current year focus item: see note 21 to the financial statements) During the year, the Committee decided to perform some additional reviews of the Group’s working capital balances. In part, this reflected external stakeholder concerns over a perceived deterioration in cash flows relating to working capital, including accrued and deferred income. The Committee’s review therefore considered two different questions: firstly, were the working capital balances expected to be fully recoverable and, secondly, was the management of working capital as effective as it might be for a Group of this size. On the first question, the Committee concluded that the Group’s working capital balances were fully recoverable at their stated amounts. On the second, measures were identified to improve the effective management of working capital and these are discussed further in the Strategic Report. As part of the publication of the Interim Results in January 2017, a significant rise was projected for the Group’s full year Adjusted Effective Tax Rate, from the prior year rate of 22% to a new level of 31%. The actual Adjusted Effective Tax Rate for the year ended 31 May 2017 was 29.3% (2016: 22%). The projected and actual rates differ in part due to reported performance in different tax jurisdictions varying against expectations at the time of the Interim Results. However, in addition, it has been identified that the scale and complexity of the Group requires an improvement in the management and control of the Group’s tax affairs. Executive management have now appointed a Group Tax and Treasury Manager to look after the Group’s international tax affairs. The role will continue to be supported by the incumbent tax advisory firms, to target two objectives: z firstly, to ensure that the Group’s more complex and growing international footprint is fully compliant with all local legislation and transfer pricing regulations; and z secondly, that the Group’s tax affairs are managed in as effective a way as possible while adhering to a low risk appetite for tax planning activities. Holiday pay provision (current year focus item: see note 3 to the financial statements) During the year, the Committee was made aware that there was an inconsistency in the application of the requirements of IAS 19R Employee Benefits across the Group. A number of major business units were not making provision for earned but not taken holiday entitlement for employees at the balance sheet date. This inconsistency had been previously highlighted by the auditors, though at that time the additional provisions required were considered not to be material to the Group and so were not adjusted for. After due consideration, the Committee recommended the consistent application of IAS 19R across the Group henceforth. This had the effect of creating an opening IAS 19R provision of £1.8m. This has been disclosed as an exceptional item since it does not relate to the underlying business performance in the current year. When added to the £0.7m normal operating charge in the current year and the amount already accrued, the total closing balance sheet provision as at 31 May 2017 is £3.3m. 78 www.nccgroup.trust Stock Code: NCC NCC AR2017 proof 8- Back.indd 78 25546.04 9 August 2017 4:01 PM Proof Six 09/08/2017 16:01:26  z regular internal audits of key processes and procedures under the Group’s ISO 9001 and ISO 27001 accredited quality assurance process; z monitoring of any whistle-blowing or fraud reports. The external auditors provide independent advice on those areas of internal control which they assess during the course of their work for the Group and whose findings are regularly reported to the Board and the Audit Committee. The Group’s non cyber security risks are monitored by the Board which sets aside time for an in-depth discussion of notable or changing risks to the business. A detailed description of the Group’s Risk Management processes and controls is set out in the Strategic Report on pages 48 to 53. Whistle-blowing and confidential reporting procedures The Group operates a confidential reporting and whistle- blowing procedure (known as our ‘Open Door Policy’). The policy aims to support the stewardship of the Group’s assets and the integrity of the financial statements as well as protecting staff welfare. The procedure is reviewed annually by the Committee to ensure that it remains fit for purpose. During the current year review, the Committee has decided to enhance the procedure by appointing an independent third party reporting agent to be the first point of contact for those who do not wish to use normal internal line management channels for reporting their concerns. This will be advertised internally via staff notice boards and our intranet. The Committee reviews any whistle-blowing or confidential reporting of concerns raised during the year with respect to their nature, scale and any associated or consequential risks. During the year, the Committee reviewed the results of an independent review of whistle-blowing matters carried out under the direction of the Senior Independent Director. The Committee discussed the outcome of that review and was satisfied that the Company’s response in each case was appropriate. The Committee was also satisfied that there were no implications for the integrity of the Group’s Financial Statements and that no other changes were needed to the policy and procedure besides the adoption of a third party reporting mechanism. Internal Audit Historically, whilst the Group did not consider it necessary to have its own internal audit function, this position was being reviewed annually. In consultation with executive management, it has been decided that the scale and complexity of the Group’s operations means that now is an appropriate time to create an internal audit function. The Group has appointed a Director of Risk and Assurance, who joins us in the new financial year and will be responsible for internal audit, the assurance of other quality systems and processes, and further embedding risk management processes throughout our operations. In the short term, the role will also focus on advising management in the design of appropriate internal controls that support the implementation of our new business processes and systems. During the financial year, the main item of internal audit type work undertaken was in respect of revenue recognition as discussed earlier in this report. Internal controls and Risk Management The Board is responsible for establishing, maintaining and monitoring the Group’s system of internal control and reviewing its effectiveness. Internal control systems are designed to meet the particular needs of the Group and the risks to which it is exposed. By their nature, however, internal control systems are designed to manage rather than eliminate the risk of failure to achieve business objectives and can provide only reasonable but not absolute assurance against material misstatement or loss. Key elements of the internal control system are described below. These have all been in place throughout the year and up to the date of this report and are reviewed regularly by the Committee and Board: z defined management structure and delegation of authority to Committees of the Board, subsidiary boards and associated business units; z recruitment standards and career development and training to ensure the integrity and competence of staff; z anti-bribery, security and compliance training; z information provided to management covering financial performance and key performance indicators, including non-financial measures; z a detailed budgeting process where business units prepare plans for the coming year; z procedures for the approval of capital expenditure and investments and acquisitions; z monthly operational reviews to monitor and re-forecast results as required against the annual operating plan, with major variances followed up and management action taken where appropriate; z clearly documented internal procedures set out in the Group’s ISO 9001:2008 accredited quality manual; NCC Group plc Annual Report and Accounts for the year ended 31 May 2017 79 NCC AR2017 proof 8- Back.indd 79 25546.04 9 August 2017 4:01 PM Proof Six 09/08/2017 16:01:26 GOVERNANCE Audit committee report Review of the Audit Committee’s effectiveness The Committee has reviewed and considered the effectiveness of its performance during the year. The review included the views of members of the Committee and of regular attendees at the various meetings (including the Executive Directors). I am satisfied that the degree of rigour and challenge applied in performing the Committee’s responsibilities is appropriate, effective and continues to improve. External auditors effectiveness and appointment The Committee reviews and makes recommendations regarding the reappointment of the external auditors following a formal review of the auditors’ performance following the June Audit Committee meeting. In making these recommendations the Committee considers: z the experience, industry knowledge and expertise of the auditors; z the scope and planning of the audit and any variations from the plan; z the quality of the processes adopted; z the fees charged; z their attitude to and handling of key audit judgments; z their ability to challenge and communicate effectively with management; and z the quality of the final report. During the financial year, I attended regular meetings with KPMG’s engagement partner without management being present. This provided the opportunity for open dialogue. The engagement partner demonstrated their understanding of the Group’s business risks and the consequential impact on the financial statements. Feedback on the conduct of the audit from the engagement partner’s perspective is used to determine if any challenges in the prior year audit would be sufficiently addressed in the next audit cycle. The Group’s current auditors, KPMG LLP, have been in place since 1 November 2013 with a competitive audit tender process having last been undertaken in November 2011. The UK Competition and Markets Authority’s (CMA) Statutory Audit Services Order (Order) states, amongst other matters, that FTSE 350 listed companies should put their external audit contract out to public tender at least every ten years. In the prior year it was proposed that the external audit contract again be subject to a formal tender exercise during 2017 with a view to appointing the successful audit firm with effect from 1 June 2018. Given the number of recent changes in the membership of the Board and ongoing changes in the structure of the Group as the new Strategic Plan is implemented, it has been decided that a change in external auditors may not be of benefit to the Group at this time. The Group will therefore review this position during the new financial year. The Group does fully intend to remain in compliance with the requirement to carry out a formal tender every ten years and the position and timing of such a tender will remain under review. Therefore, having fully considered the performance, independence and objectivity of the external auditors and the reports they have produced in the current financial year, the Committee has concluded that it is appropriate to recommend to the Board the reappointment of KPMG LLP as the Group’s external auditors for the next financial year. Auditors’ independence and objectivity The Committee received a formal statement of independence from the external auditors. The Company also operates a rigorous policy designed to ensure that the auditors’ independence is not compromised by their undertaking inappropriate non-audit work. The Audit Committee’s approval is therefore required for any fees for non-audit work paid to the auditors in excess of £10,000 (ten thousand pounds) in any financial year. However, the Company recognises that it can receive particular benefit from certain non-audit services provided by the external auditors due to their technical skills and detailed understanding of the Company’s business. A copy of the full policy on the payment of fees to the external auditors for non-audit services can be found on the company website at www.nccgroup.trust During this financial year £17,500 (2016: £10,000) non-audit fees were paid to the external auditors for the half year review. All significant pieces of non-audit work are put to informal tender to suitable parties that, if appropriate, can include the external auditors. Upon review as to suitability and price, the work will then be placed with the service provider recommended. If this is the external auditors then Audit Committee approval is required in accordance with the policy noted above. 80 www.nccgroup.trust Stock Code: NCC NCC AR2017 proof 8- Back.indd 80 25546.04 9 August 2017 4:01 PM Proof Six 09/08/2017 16:01:26 Fair, balanced and understandable process FINANCIAL INFORMATION NARRATIVE DISCLOSURES INDEPENDENT REVIEWERS AUDIT COMMITTEE CHAIR • Senior members of the Operations Board • Those who have not been major contributors • Review of detailed verification documents • Review of findings and observations from independent reviewers The independent reviewers noted above were not major contributors to the Annual Report and Accounts but at the same time, as members of the Operations Board, are deemed to be sufficiently well informed on the Group’s activities to be able to give appropriate feedback on the FBU criteria. Taking all of the inputs and subsequent amendments into account, the Committee was satisfied that taken as a whole the Report and Accounts are fair, balanced and understandable. Thomas Chambers CHAIRMAN, AUDIT COMMITTEE 18 July 2017 • Prepared by individual buisiness units Group finance team • Consolidated by • Reviewed by Group Financial Controller and CFO Group Finance team • Prepared by • Various reports prepared by Committee Chairs, CEO and CFO Related Party Transactions and other fees approved by the Committee The former Non-Executive Chairman, Paul Mitchell, was also the Non-Executive Chairman of Rickitt Mitchell. During the year the Audit Committee approved corporate finance fees payable to Rickitt Mitchell & Partners Ltd of £0.3m (2016: £0.8m) in relation to the completed acquisitions PSC and VSR and the disposal of the Open Registry businesses. The fees in the prior year related to the acquisition of Fox-IT and the equity fundraising that accompanied it. The Non-Executive Chairman was excluded from all discussions on the approval of fees payable to Rickitt Mitchell & Partners Ltd. Fair, balanced and understandable At the request of the Board, the Committee considered whether the 2017 Annual Report and Accounts, when taken as a whole, was fair, balanced and understandable (‘FBU’) and whether it provided the necessary information for shareholders to assess NCC Group’s position and performance, business model and strategy. NCC Group plc Annual Report and Accounts for the year ended 31 May 2017 81 NCC AR2017 proof 8- Back.indd 81 25546.04 9 August 2017 4:01 PM Proof Six 09/08/2017 16:01:27 GOVERNANCE Nomination committee report The Committee has had a busy year with a significant number of Executive and Non-Executive changes to the Board Paul Mitchell was Chairman of the Nomination Committee until January 2017 when he announced his intention to resign as Chairman of the Board. He remained a member of the Committee until he left the Board on 31 May 2017. Debbie Hewitt, Senior Independent Director, became Chairman of the Nominations Committee in January 2017. Other members of the Committee are the three independent Non- Executive Directors, Thomas Chambers, Chris Batterham and Jonathan Brooks, the latter of whom joined the Committee when he joined the Board in March 2017. The Nomination Committee’s objectives and responsibilities. The Nominations Committee is responsible for reviewing the size, structure, balance, composition and progressive refreshing of the Board and its committees and as such its duties include: z reviewing the structure of the Board; z evaluating the balance of skills, knowledge, experience and diversity on the Board; z making recommendations for further recruitment to the Board or proposing changes to the existing structure of the Board, or individual Directors; z reviewing the leadership needs of the Company, both Executive and Non-Executive; z succession planning for Directors and other senior Executives within the business; z recruiting, appointing and exiting of Directors; z overseeing membership of, and succession to, the various Board committees and; z reviewing the time commitment required from the Non- Executive Directors on NCC business. The Chairman of the Board leads the process for the appointment of new Non-Executive Directors to the Board and for the appointment of the Chief Executive Officer. The Chief Executive, in conjunction with the Chairman, leads the process for the Chief Finance Officer. The Senior Independent Director leads the process for a new Chairman of the Board. In relation to an appointment to the Board, the Committee draws up a specification and assesses the capabilities and experience required for such a role, including an assessment of the time commitment required. Candidates are sought by third party advisers and where appropriate through assessment of internal candidates and are then formally considered by the Nomination Committee. Extensive external referencing is completed. All appointments are made on merit and against objective criteria with due regard for the benefits of diversity on the Board, including gender and race. 82 www.nccgroup.trust Stock Code: NCC NCC AR2017 proof 8- Back.indd 82 25546.04 9 August 2017 4:01 PM Proof Six 09/08/2017 16:01:31 The Company and the Committee value the aims and objectives of the Davies report on women on boards and support and apply the Group’s diversity policy set out on pages 54-55. No formal measurable objectives for female and ethnic representation at Board level have currently been set as the Committee is committed, while having regard to the diversity policy, to recommend only the most appropriate candidates for appointment to the Board. Currently 17 per cent of the Directors and officers on the Board are women and there is no ethnic representation. When a new Director is appointed they receive a full, formal and tailored induction into the Company and discuss with the Chairman any immediate training requirements. During the new financial year 2018, the Board will recruit a new Chief Executive Officer and will provide for its succession requirements by the appointment of a new Non-Executive Director. The Committee’s terms of reference can be found in the Group’s Investors’ section of the Company’s website: www.nccgroup.trust/uk/about-us/investor-relations The terms of reference are reviewed annually and updated when necessary. Committee Meetings The Committee is required, in accordance with its terms of reference, to meet at least twice per year. During this financial year, the Committee met nine times. The attendance of individual Committee members at Nomination Committee meetings is shown in the table below. Unless otherwise indicated, all Directors held office throughout the year. Attended Unattended Meetings attended Debbie Hewitt (Chair) Thomas Chambers (member) Chris Batterham (member) Paul Mitchell3 (member) Rob Cotton1 (by invitation) Jonathan Brooks2 (by invitation) 1 2 Left the Board in March 2017. Appointed Non-Executive Director and member of the Audit and Remuneration Committees in March 2017. 3 Left the Board in May 2017. Committee Effectiveness During the year, the Nomination Committee carried out an internal self-evaluation on its effectiveness. A small number of recommendations were made, including the Board undertaking a broader review of management talent and succession planning across the business in 2017/18. External search consultancies In accordance with B.2.4 of the Code, during the year the Committee engaged Independent Search in the recruitment of Chris Stone (Executive Chairman), Stark Brooks in relation to Brian Tenner (Chief Financial Officer) and Norman Broadbent in relation to the recruitment of Jonathan Brooks (Non- Executive Director). None of the above companies have any connection with the Company. Debbie Hewitt CHAIRMAN, NOMINATION COMMITTEE 18 July 2017 NCC Group plc Annual Report and Accounts for the year ended 31 May 2017 83 NCC AR2017 proof 8- Back.indd 83 25546.04 9 August 2017 4:01 PM Proof Six 09/08/2017 16:01:32 GOVERNANCE Cyber security committee report The Group increased its capability to detect and react to potential incidents to ensure it keeps up with the ever evolving cyber threat landscape The Cyber Security Committee was formed as a new committee of the Board in November 2016 to assess the Group’s internal cyber security policy and defences. Debbie Hewitt, Senior Independent Director, was appointed as Chairman of the Cyber Security Committee on inception. Non- executive Directors Chris Batterham and Jonathan Brooks are also members of the Committee, with Chris joining the Committee on formation and Jonathan joining the Committee in May 2017. The Group’s Chief Cyber Risk Officer (“CCRO”) and the Group’s Information Security Officer are standing invitees of the Committee. The Executive Directors are invited to attend Committee meetings when the Committee considers it to be appropriate. 84 The Cyber Security Committee’s objectives and responsibilities The Cyber Security Committee is responsible for assessing the performance of the Group’s internal security and defences and as such its duties are to: 1.1 1.2 1.3 oversee and advise the Board on the current cyber risk exposure of the Group and future cyber risk strategy; review at least annually the Group’s cyber security breach response and crisis management plan; review reports on any cyber security incidents and the adequacy of proposed action; 1.4 receive and consider the regular reports from the CCRO; 1.5 1.6 1.7 1.8 ensure the CCRO is given the right of direct access to the Committee; consider and recommend actions in respect of all cyber risk issues escalated by the CCRO, head of IT and the compliance function; keep under review the effectiveness of the Company’s controls, services and products to analyse potential vulnerabilities that could be exploited; regularly assess what are the Group’s most valuable intangible assets and the most sensitive Group and customer information and assess whether the controls in place sufficiently protect those assets and information; 1.9 review the Group’s ability to identify and manage new cyber risks; 1.10 assess the adequacy of resources and funding for cyber security activities; 1.11 regularly review the cyber risk posed by third parties including outsourced IT and other partners; 1.12 oversee cyber security due diligence undertaken as part of an acquisition and advise the Board of the risk exposure; and 1.13 annually assess the adequacy of the Group’s cyber insurance cover. www.nccgroup.trust Stock Code: NCC NCC AR2017 proof 8- Back.indd 84 25546.04 9 August 2017 4:01 PM Proof Six 09/08/2017 16:01:36 The Board leads the process for the appointment of new members to the Committee on the recommendation of the Nomination Committee and in consultation with the Chairman of the Committee. Committee Meetings The Committee is required, in accordance with its terms of reference, to meet at least three times per year. During this financial year, the Committee met three times. The Committee’s terms of reference can be found in the Group’s Investors’ section of the Company’s website, www. nccgroup.trust/uk/about-us/investor-relations. The terms of reference are reviewed annually and updated when necessary. Committee activities during the year During the financial year the Committee assessed the Group’s short-term tactical requirements, including the introduction of a new Cyber Security Breach Response and Crisis Management Plan, while simultaneously addressing longer term strategic goals around ensuring the Group’s resilience to potential cyber attacks of all levels. The Group increased its capability to detect and react to potential incidents with the additional of new, or enhanced, security controls and its intention is to continue to invest in the Group’s infrastructure to ensure that the Group keeps up with the ever evolving cyber threat landscape. The Committee also reviewed the Company’s cyber risk insurance and initiated an external benchmarking exercise to understand the robustness of its performance and risk processes relative to other external organisations. The output of this will set the priorities for the Committee to review in 2018. The attendance of individual Committee members at the Cyber Security Committee meetings is shown in the table below. Unless otherwise indicated, all Directors held office throughout the year. Attended Unattended Meetings attended Debbie Hewitt (Chair) Chris Batterham (member) Rob Cotton1 (by invitation) Jonathan Brooks2 (member) 1 Left the Board in March 2017. 2 Appointed Non-Executive Director and member of the Cyber Security Committee in May 2017. Committee Effectiveness During the year, the Cyber Security Committee carried out an internal self-evaluation on its effectiveness, noting that the Committee is still in its formative stages. As an output of this evaluation, the Committee, along with the Board, resolved in May 2017 to extend the scope of the Cyber Security Committee to include assessment of wider risk matters across the Group. During the next financial year the Cyber Security Committee will be renamed as the ‘Cyber Security and Risk Committee’ and its terms of reference will be extended to include overall responsibility for risk management, policy and internal control systems across the Group (except for those areas that are within the scope of the Audit Committee, as summarised on pages 74 to 75). Debbie Hewitt CHAIRMAN, CYBER SECURITY COMMITTEE 18 July 2017 NCC Group plc Annual Report and Accounts for the year ended 31 May 2017 85 NCC AR2017 proof 8- Back.indd 85 25546.04 9 August 2017 4:01 PM Proof Six 09/08/2017 16:01:37 GOVERNANCE Remuneration committee report ANNUAL STATEMENT The committee has reviewed the Group’s remuneration policy to assess its appropriateness and alignment with business strategy I present the Directors’ Remuneration Report for the year ended 31 May 2017. The Report is split into three sections, namely, this Annual Statement, the Directors’ Remuneration Policy and the Annual Report on Remuneration. During the year, we continued to operate within the Remuneration Policy that was put to a binding shareholder vote at the 2014 AGM. This policy was adopted for three years. As this period is coming to an end, the Committee has now reviewed the policy to assess its appropriateness and alignment to the business strategy and has consulted with shareholders and shareholder advisory groups on its proposed changes. The proposed changes are summarised at the end of this statement. 2016/7 has been a very challenging year for the Group. Although sales continued to grow, EBITDA fell back by 20 per cent to £36.2m. This disappointing performance has been reflected in the performance-related elements of Executive remuneration and as such, no payment was made to any departing or current Executive for the annual bonus for the year ended 31 May 2017. In addition, the target set for adjusted EPS over the last three years was missed and the Long Term Incentive Plan (LTIP) awarded in the year ended 31 May 2014 lapsed, for both of the Chief Executive and Finance Director. There was considerable change in the composition of the Board. The Chief Executive Officer, Chief Finance Officer and Chairman all stepped down from the Board this year. Their exit terms are set out in detail on pages 100-101 of the Annual Remuneration Report. We appointed a new CFO, Chairman and an additional Non- Executive Director. Brian Tenner, Chief Finance Officer, joined the business on 1 February 2017. He was awarded a base salary of £250k and benefits and incentives in line with policy, the detail of which is included in the Annual Report on Remuneration on page 101. He was appointed to the position of interim Chief Executive on 1 March 2017 and was awarded a base salary of £350k for this role, which he retains whilst holding this interim position. His base salary will revert to £250k when he relinquishes his responsibility as interim CEO. No other terms and conditions were changed. He was awarded a nil per cent salary review from 1 June 2017 (as he joined the Company in February 2017). The general salary review awarded to all other employees was 2.5 per cent (for supporting functions) and 4.5 per cent (for frontline staff). There were, however, market related adjustments to a number of roles across the business and increases for promotions. Chris Stone joined the business on 6 April 2017 as Executive Chairman. His fees for this role are £350k. Once a permanent Chief Executive Officer has been appointed Chris Stone will become Non-Executive Chairman and his fee will reduce to £135k. Non-Executive Director fees are due for review every three years and these were reviewed with effect from 1 June 2017. Details of these increases are given in the Annual Report on Remuneration on page 96. The Board (with the exception of the Non-Executives), is proposing to change the Policy on Non-Executive Director fees to move to an annual review. This reflects the approach for other staff and prevents Non- Executive fees getting significantly out of line with market, which could be a limiting factor to the attraction of new Non- Executive Director candidates and could also result in large, albeit irregular, adjustments. 86 www.nccgroup.trust Stock Code: NCC NCC AR2017 proof 8- Back.indd 86 25546.04 9 August 2017 4:01 PM Proof Six 09/08/2017 16:01:42 In line with best practice, we are also proposing to increase our Executive shareholding guideline from 100 per cent of base salary to 200 per cent, with the individuals required to hold on to all vested shares until the guideline has been achieved, except shares sold to meet any tax liability arising from vesting shares. The Committee will be asking for the Policy to be approved for a further three years, though recognises that there may be a need to bring further changes next year, once the output of the strategy review is clear. The Committee will of course consult with shareholders if that is the case. At the Annual General Meeting in September 2016, 98.92 per cent of shareholders voted in favour of the adoption of the Annual Report on Remuneration. The Remuneration Committee appreciated the support for our approach. The 2017 Annual Statement and Annual Report on Remuneration will be put to an advisory vote at the Annual General Meeting in September 2017, providing shareholders with the opportunity to voice their opinions on how the Committee has implemented the Remuneration Policy this year. The new three year Policy will also be put to the vote. We look forward to receiving your support on our approach to Remuneration at the Annual General Meeting. Debbie Hewitt CHAIR OF THE REMUNERATION COMMITTEE 18 July 2017 The Board has undertaken a comprehensive review of the business strategy, a summary of the output is contained on pages 17 to 23. The Committee has reviewed the Executive Remuneration Policy in this context. It has consulted on its proposals with major shareholders and shareholder advisory groups and has decided that no changes are proposed to the structure of remuneration or the quantum of incentives but that it will make some changes to ensure we reflect most recent best practice. This includes adding a holding period to the long- term incentive and increasing the shareholding guidelines for Executive Directors from 100 per cent of salary to 200 per cent of salary. Looking forward, the Committee intends to keep the same annual bonus structure in 2017/18, but will add strategic performance objectives alongside profit targets, which is allowed within the current Remuneration Policy. These objectives will include measures coming from the key priorities identified from the strategy review. The strategic targets will account for 25 per cent of the bonus entitlement. As in prior years, the bonus will continue to be self-funding and as such, no bonus will be payable, even for strategic targets, unless the minimum profit target is met. The profit target will be based on actual rather than adjusted PBT. Thirty-five per cent of any bonus earned will be deferred into nominal cost share options and once vested after two years shares must be retained until the shareholding guideline is achieved. Clawback and malus provisions are in place for the annual bonus. The Committee recognises that annual bonus target disclosure is a key issue for shareholders. Our Policy going forward will be to disclose annual bonus targets in the year in which payment is made. For example, financial year 2017/18 targets will be disclosed in the 2017/18 Remuneration Report, subject to the Committee being comfortable that the targets are no longer commercially sensitive. We intend to adopt this approach with immediate effect so the targets for 2014/15, 2015/16 and 2016/17 are all disclosed in this report. In relation to the LTIP for 2017–20, the Committee intends to make awards of up to 100 per cent of base salary and these will vest after three years if a demanding EPS performance target is satisfied. We will also add a measure of Total Shareholder Return (TSR) and a cash metric, for the first time this coming year, to further align Executive incentives with outcomes for shareholders. Up to 60 per cent of the potential will relate to EPS, 30 per cent to the cash metric and 10 per cent to TSR. Clawback and malus provisions are in place for the LTIP. A holding period has been added to the long-term incentive requiring Executives to retain any vested shares (net of tax) for a period of two years or until their shareholding guideline has been met (whichever is the later) to further align Executives with shareholders. NCC Group plc Annual Report and Accounts for the year ended 31 May 2017 87 NCC AR2017 proof 8- Back.indd 87 25546.04 9 August 2017 4:01 PM Proof Six 09/08/2017 16:01:42 GOVERNANCE Remuneration committee report DIRECTORS’ REMUNERATION POLICY The Remuneration Committee determines the Company’s policy on the remuneration of the Executive Directors and other senior Executives. The principles which underpin the remuneration policy for the Company are to: z ensure Executive Directors’ rewards and incentives are directly aligned with the interests of the shareholders in order to reinforce the strategic priorities of the Group, optimise the performance of the Group and create sustained growth in shareholder value, without encouragement to take excessive undue risk; z provide the level of remuneration required to attract, retain and motivate Executive Directors and senior Executives of an appropriate calibre; z ensure a proper balance of fixed and variable performance related components, linked to short and longer-term objectives; and z reflect market competitiveness, taking account of the total value of all the benefit elements. Our Remuneration Strategy has been designed to reflect the needs of a large multinational organisation, which is growing both organically through the innovation of products and services and with value enhancing acquisitions, which enable us to leverage our access to new capabilities and products. The annual bonus incentivises sustainable growth across all areas of the business and the Long Term Incentive Plan (LTIP) reflects our longer-term growth ambitions, particularly in new markets and new products. Remuneration for the Executive Directors is structured so that the variable pay elements (annual bonus and long-term incentives) form a significant proportion of the overall package. This provides a strong link between the remuneration paid to Executive Directors and the performance of the Company. This also provides a strong alignment of interest between the Executive Directors and shareholders, particularly as 35 per cent of the annual bonus and all of the long-term incentive is payable in the form of shares. For the purposes of section 226D(6)(b) of the Companies Act 2006, this policy will take effect from the date of the 2017 AGM, which is scheduled to be held on 21 September 2017. Future Policy Table for Executive Directors Purpose and link to short and long-term strategic objectives Operation (including framework to assess performance) Maximum opportunity Change to position under current remuneration policy SALARY Attract, retain and reward high calibre Executive Directors. The Remuneration Committee reviews salaries for Executive Directors annually unless responsibilities change. Details of current salaries are set out in the Annual Report on Remuneration (page 101). No change Salary increases are normally in line with those for other employees but also take account of other factors such as changes to responsibility and the complexity of the role. Pay reviews take into account Group and personal performance and externally benchmarked market data for companies operating in IT services, management consulting and relevant high-tech sectors, which although not directly comparable, provides an indicative range. In setting appropriate salary levels the Committee takes into account pay and employment conditions of employees elsewhere in the Group, alongside the impact of any increase to base salaries on the total remuneration package Any changes are effective from 1 June each year. 88 www.nccgroup.trust Stock Code: NCC NCC AR2017 proof 8- Back.indd 88 25546.04 9 August 2017 4:01 PM Proof Six 09/08/2017 16:01:42 Purpose and link to short and long-term strategic objectives Operation (including framework to assess performance) Maximum opportunity Change to position under current remuneration policy BENEFITS Attract, retain and reward high calibre Executive Directors. PENSION To provide a competitive benefit, which attracts high calibre Executives and which allows flexible retirement planning to suit individual needs. ANNUAL BONUS Drive and reward sustainable business performance. Benefits in kind include the provision of a car or car allowance, payment of private fuel, car insurance, private medical insurance, life assurance and permanent health insurance. Executive Directors may be invited to participate in the Sharesave Scheme approved by HMRC. Market competitive benefits. No change SAYE Sharesave Scheme subject to HMRC approved limits. Executive Directors are entitled to a company pension contribution, which is paid into the Group defined contribution personal pension scheme. They can also opt to have the same level of contribution made as a per cent of base salary. 10 per cent of basic salary into the Group Scheme, providing they make a contribution of not less than 5 per cent of basic salary, or a basic salary supplement of 10 per cent of base salary. No change Chief Executive Officer 100 per cent of base salary. Chief Finance Officer 100 per cent of base salary. Based on a range of stretching targets measured over one year. This might include, but not exclusively, profit measures and other strategic objectives such as cash management, brand development, customer satisfaction and retention, business unit sales growth and employee engagement. Performance below the minimum performance target results in no bonus. No more than 20 per cent of the maximum opportunity is paid for achievement of the threshold performance targets. Payments rise from the threshold payment to 100 per cent of the maximum opportunity for levels of performance between the threshold and maximum targets. The rate of the rise and the various payment targets are determined annually by the Committee. The Committee has discretion to reduce the formulaic bonus outcome if individual performance is determined to be unsatisfactory or if the individual is the subject of disciplinary action. 35 per cent of any bonus payment is invested in nominal cost share options and deferred for a two year period. Dividend equivalents are paid on vesting share options. Malus and claw back provisions are in place for both cash and deferred elements. Introduction of strategic targets, which account for up to 25 per cent of the annual bonus potential. This will ensure focus on delivery of the KPIs underpinning the strategy. Strategic targets will have a gateway of the minimum profit hurdle before they can be payable. No more than 20 per cent of the maximum opportunity is paid for achievement of the threshold performance target – this has been reduced from 25 per cent under the previous policy. Disclosure of annual bonus targets will be made in the year in which payment is made, subject to the Committee being comfortable that the targets are no longer commercially sensitive. Executives will be required to retain all deferred bonus shares (except any tax payment related to their vesting) until they have attained the minimum shareholding guideline. NCC Group plc Annual Report and Accounts for the year ended 31 May 2017 89 NCC AR2017 proof 8- Back.indd 89 25546.04 9 August 2017 4:01 PM Proof Six 09/08/2017 16:01:42 GOVERNANCE Remuneration committee report DIRECTORS’ REMUNERATION POLICY Purpose and link to short and long-term strategic objectives Operation (including framework to assess performance) Maximum opportunity Change to position under current remuneration policy LONG TERM INCENTIVE PLAN To drive long-term performance in line with Group strategy and incentivise through share ownership. Expand the performance metrics to include a measure of EPS, a cash flow metric and relative TSR to provide a more balanced assessment of Company performance. Shares will in future be required to be held for a further minimum period of two years after vesting. Awards have a performance period of three years. Award over shares with a face value at grant of: 100 per cent of salary p.a. for the Chief Executive Officer. 100 per cent of salary p.a. for the Chief Finance Officer. The level of vesting is determined by measures appropriate to the strategic priorities of the business. At least half of any award will be subject to financial performance measures. Measures might include, but not exclusively, EPS, cash flow and relative TSR metrics. Initially, the targets will represent maximum 60 per cent of potential for EPS, 30 per cent for cash flow and 10 per cent for relative TSR. The Remuneration Committee has the discretion to determine the number of measures to be used. Performance below the threshold target results in no vesting. For performance between the threshold target and maximum performance target, vesting starts at 20 per cent and rises to 100 per cent of the shares vesting. Any awards granted under this policy to Executive Directors which vest and are exercised after the completion of the three year performance period must be held for a further two years after vesting, even if the Director has met the 200 per cent shareholding guideline. Should a change in control of the Group occur, crystallisation of any LTIP awards is within the discretion of the Remuneration Committee. Malus and clawback provisions are in place. 90 www.nccgroup.trust Stock Code: NCC NCC AR2017 proof 8- Back.indd 90 25546.04 9 August 2017 4:01 PM Proof Six 09/08/2017 16:01:42 Purpose and link to short and long-term strategic objectives Operation (including framework to assess performance) Maximum opportunity Change to position under current remuneration policy EXECUTIVE DIRECTOR SHAREHOLDING GUIDELINE To align the interests of Executive Directors with the interests of all of the Company’s shareholders. The Executive Directors are expected to build and retain a shareholding in the Group at least equivalent to 200 per cent of base salary. Executives will be required to retain all vested deferred bonus shares and LTIP shares released from the holding period until they have attained the minimum shareholding guideline and even then they may only sell when they have held vested LTIP shares for a minimum period of two years. For the avoidance of doubt, Executive Directors are permitted to sell sufficient shares in order to meet any tax obligation arising from vesting shares. Further align shareholder and Executive interests by increasing the Executive shareholding guideline from 100 per cent of base salary to 200 per cent. Executives will be required to retain all vested LTIP shares (except to meet the tax obligation relating to their vesting) until they have attained the minimum shareholding guideline and even then, only when they have held vested LTIP shares for a minimum period of two years. Choice of performance measures and target setting For both the annual bonus and LTIPs, our policy is to choose performance measures which help drive and reward the achievement of our strategy and which also provide alignment between Executives and shareholders. The Committee reviews metrics annually to ensure they remain appropriate and reflect the future strategic direction of the Group. Targets for each performance measure are set by the Committee with reference to internal plans and external expectations. Performance is generally measured on a ‘sliding scale’ so that incentive payouts increase pro rata for levels of performance in between the threshold and maximum performance targets. With regard to the annual bonus, the Remuneration Committee believes that a simple and transparent scheme with sufficiently stretching targets and an element of bonus deferral prevents short-term decisions being made and ensures that the Executive is entirely focused on the delivery of sustainable business performance, which significantly enhances shareholder value. With regard to the LTIP, the Committee believes in setting demanding objectives, which reward steady, progressive growth, in order to incentivise and encourage long-term growth and enhance shareholder value. It is the Committee’s view that inappropriately high targets can encourage inappropriate risk taking and in a Group where innovation and research is key to Group Strategy, it could result in these areas being dispensed with, thereby jeopardising the long-term aims of the Group. Performance measures and targets are disclosed in the Annual Report on Remuneration. In cases where targets are commercially sensitive, for example annual profit targets for the annual bonus, they will be disclosed retrospectively in the year in which the bonus is paid. Differences in pay policy for employees and Executive Directors The remuneration policy for Executive Directors is replicated throughout the Group and aims to attract and retain the best staff and to focus their remuneration on the delivery of long- term sustainable growth by using a mix of salary, benefits, bonus and longer-term incentives. As a result, no element of Executive Director remuneration policy is operated exclusively for Executive Directors: z The annual performance related pay scheme for Executive Directors is largely the same as that of the Operational Directors and Senior Managers within the business and all are aligned with similar business objectives; z Participation in the LTIP is extended to other Senior Executives ensuring consistency in policy; and z The pension scheme is operated for all permanent employees. The main difference between pay for Executive Directors and employees is that Executive Director pay is structured so that the variable pay element forms a significant proportion of the overall package and the total remuneration opportunity is higher to reflect the increased responsibility of the role. NCC Group plc Annual Report and Accounts for the year ended 31 May 2017 91 NCC AR2017 proof 8- Back.indd 91 25546.04 9 August 2017 4:01 PM Proof Six 09/08/2017 16:01:43 GOVERNANCE Remuneration committee report DIRECTORS’ REMUNERATION POLICY Executive shareholding guidelines The Committee considers that each Executive Director of the Company should retain a personal holding of shares in the Company, the rationale being that this will expose those Directors to the same risks and rewards enjoyed by the Company’s shareholders and as such align the interests of Executive Directors with the interests of the Company’s shareholders. In any event, 35 per cent of the value awarded as part of the annual bonus scheme will be awarded as nominal cost deferred share options, to be held for a period of no less than two years and share options vesting under the LTIP scheme, if exercised, are to be held for a minimum of two years after the vesting date. Non-Executive Director policy table Furthermore, Executive Directors are required to build and retain a shareholding in the Group at least equivalent to 200 per cent of base salary. Executives will be required to retain all vested deferred bonus shares and LTIP shares released from the holding period until they have attained the minimum shareholding guideline and even then they may only sell when they have held vested LTIP shares for a minimum period of two years (subject to the below paragraph). For the avoidance of doubt, Executive Directors are permitted to sell sufficient shares in order to the meet any tax obligation arising from vesting shares, notwithstanding that the Executive Director has not attained their minimum shareholding. Purpose and link to strategy Operation Maximum opportunity FEES Attract, reward and retain experienced Non-Executive Directors. Fees for the Non-Executive Directors are determined by the Board within the limits set by the Articles of Association and are based on information on fees paid in similar companies taking into account the experience of the individuals and the relative time commitments involved. There will be separate disclosure of fees paid for Chairing the Audit and Remuneration Committees and for acting as Senior Independent Director. Fees for the Non-Executive Directors are reviewed annually. Any reasonable business related expenses (including tax thereon) can be reimbursed if determined to be a taxable benefit. Current fee levels are set out in the Annual Report on Remuneration on page 96. Overall fee limit will be within the current £300,000 limit set out in the Company’s Articles of Association, approved on 21 September 2010, which is subject to increase on 21 September each year by the same percentage increase as the percentage increase in the General Index of Retail Prices for all items (or such other comparable index as may be substituted for it from time to time before such anniversary) in the 12 months immediately preceding such date. Approach to recruitment The principles applied in the recruitment of a new Executive Director is for the remuneration package to be set in accordance with the terms of the approved remuneration policy for existing Executive Directors in force at the time of appointment. Further detail of this policy for each element of remuneration is set out below: Salary. Salaries for new hires, including internal promotions, will be set to reflect their skills and experience, the Company’s intended pay positioning and the market rate for the applicable role. Where it is appropriate to offer a below median salary initially, the Committee will have the discretion to allow phased salary increases over a period of time for newly appointed Directors, even though this may involve increases in excess of the rate for the wider workforce and inflation. Benefits. Benefits will be provided in line with those offered to other Executive Directors, taking account of local market practice, with relocation expenses or arrangements provided if necessary. Tax equalisation may also be considered if an Executive is adversely affected by taxation due to their employment with the Company. The Company may also pay legal fees and other costs incurred by the individual. These would all be disclosed. Incentive opportunity. The aggregate ongoing incentive opportunity offered to new recruits will be no higher than that offered under the annual bonus plan and the LTIP to the existing Executive Directors. Different performance measures and targets may be set initially for the annual bonus plan, taking into account the responsibilities of the individual and the point in the financial year at which they join. 92 www.nccgroup.trust Stock Code: NCC NCC AR2017 proof 8- Back.indd 92 25546.04 9 August 2017 4:01 PM Proof Six 09/08/2017 16:01:43 ‘Buyout’ awards. Sign-on bonuses are not generally offered by NCC Group but at Board level, the Committee may offer additional cash and/or share based ‘buyout’ awards when it considers these to be in the best interests of the Company and, therefore, shareholders, including awards made under Listing Rule 9.4.2 R. Any such ‘buyout’ payments would be based solely on remuneration lost when leaving the former employer and would reflect the delivery mechanism such as cash, shares, options, time horizons and performance requirements attaching to that remuneration. The Committee also has the discretion to determine whether any nominal cost deferred share options from previous annual bonus payments will vest at the normal vesting date or earlier on leaving or whether they lapse. If the Committee exercises this discretion, they can also determine if the vesting should be prorated to reflect time served since the beginning of the deferral date. The same discretionary principle would apply to the payment of dividends on any shares that have been deferred, but not yet vested. This too would be prorated to reflect tenure. Long Term Incentive Plan. Under the LTIP, unvested awards will normally lapse upon cessation of employment. However, in line with the plan rules, the Committee has discretion to allow awards to vest at the normal vesting date, or earlier. If the Committee exercises this discretion, awards are normally prorated to reflect time served since the date of grant and based on the achievement of the performance criteria. The holding period detailed above will apply to such incentives. All Employee Share Schemes. The Executive Directors, where eligible for participation in all employee share schemes, participate on the same basis as for other employees. Approach to service contracts and letters of appointment. The Committee’s policy is to offer service contracts for Executive Directors with notice periods of between six and twelve months exercisable by either party. In addition, the Executive Directors are subject to a non-compete clause from the date of termination, where enforceable. All Non-Executive Directors’ appointments are terminable on at least three months’ notice on either side. The Executive Directors and Non-Executive Directors offer themselves for re-election every year. Transitional arrangements for internal appointments to the Board. In the case of an internal appointment, any variable pay element awarded in respect of the prior role may be allowed to pay out according to its terms on grant, adjusted as relevant to take into account the appointment. In addition, any other ongoing remuneration obligations existing prior to appointment may continue, provided that they are put to shareholders for approval at the first AGM following their appointment. Policy on payment for loss of office. Payments on termination for Executive Directors are restricted to the value of salary and contractual benefits for the duration of the notice period. It is the policy of the Remuneration Committee to seek to mitigate termination payments and pay what is due and fair. There are no predetermined special provisions for Executive Directors with regard to compensation in the event of loss of office. The Company may also pay an amount considered to be reasonable by the Committee where loss of office is due to redundancy or in respect of fees for legal advice for the outgoing Director. Elements of variable remuneration would be treated as follows: Annual bonus. The treatment of annual bonus payments upon cessation of employment is determined on a case by case basis. When the Committee determines that the payment of an annual bonus is appropriate, the annual bonus payment is typically: z prorated for the period of time served from the start of the financial year to the date of termination and not for any period in lieu of notice or garden leave; and z subject to the normal bonus targets, tested at the end of the year, and would take into account performance over the notice period; and z subject to deferral of 35 per cent of the value. NCC Group plc Annual Report and Accounts for the year ended 31 May 2017 93 NCC AR2017 proof 8- Back.indd 93 25546.04 9 August 2017 4:01 PM Proof Six 09/08/2017 16:01:43 GOVERNANCE Remuneration committee report DIRECTORS’ REMUNERATION POLICY Illustration of remuneration scenarios The chart below details the hypothetical composition of the Chief Finance Officer’s remuneration package and how it could vary at different levels of performance under the policy set out above. The chart only shows the scenarios for the Chief Finance Officer as the Group is currently in the process of recruiting a new Chief Executive. 800 700 600 500 400 300 200 100 0 £797,500 31.5% 31.5% £397,500 12.5% 12.5% £297,500 100% 75% 37% Fixed Target CHIEF FINANCE OFFICER Maximum Total Fixed Annual Bonus Long-term incentives Amounts shown in the chart are in £000 Note that the charts are indicative, as share price movement has been excluded. Assumptions made for each scenario are as follows. z Minimum. Fixed remuneration only salary, benefits and pension. Salary based on 2017/18 salary and benefits based on 2016/17 disclosed benefit amounts. z Target. Fixed remuneration plus minimum annual bonus opportunity of £50,000 for the Chief Finance Officer, which is equivalent to 20 per cent of salary for the Chief Finance Officer, plus 20 per cent vesting of the maximum award under the Long Term Incentive Plan. z Maximum. Fixed remuneration plus maximum annual bonus opportunity, £250,000 for the Chief Finance Officer, which is equivalent to 100 per cent of salary for the Chief Finance Officer plus 100 per cent vesting of the maximum award under the Long Term Incentive Plan which is 100 per cent of salary for the Chief Finance Officer. Statement of consideration of employment conditions elsewhere in the Group The Remuneration Committee does not consult directly with employees when determining Remuneration Policy for Executive Directors. However, as stated above, the annual bonus and LTIP are operated for other employees to ensure alignment of objectives across the Group and the terms of the pension scheme (save for the contribution entitlements) are the same for all permanent employees. In addition, the Committee compares information on general pay levels and policies across the Group when setting Executive Director pay levels. How shareholder views are taken into account The Remuneration Committee considers shareholder feedback received on the Directors’ Remuneration Report each year and guidance from shareholder representative bodies more generally. Shareholders’ views are key inputs when shaping remuneration policy. When any material changes are proposed to the remuneration policy, the Remuneration Committee Chairman will inform major shareholders in advance and will generally offer a meeting to discuss these. There has been significant consultation on the proposed changes to the Remuneration Policy this year. Key areas of discretion in the remuneration policy The Committee operates the Group’s variable incentive plans according to their respective rules and in accordance with HMRC rules where relevant. To ensure the efficient administration of these plans, the Committee will apply certain operational discretions. These discretions are implicit in the policy stated above, but we have listed them for clarity. These include, but are not limited to: z Whether annual bonus is paid to Executives once notice has been served. z Discretion in exceptional circumstances to amend previously set incentive targets or to adjust the proposed payout to ensure a fair and appropriate outcome. z Certain decisions relating to the LTIP awards for which the Committee has discretion as set out in the rules of the relevant share plans which have been approved by shareholders. z The decisions on exercise of clawback rights. 94 www.nccgroup.trust Stock Code: NCC NCC AR2017 proof 8- Back.indd 94 25546.04 9 August 2017 4:01 PM Proof Six 09/08/2017 16:01:43 Legacy arrangements For the avoidance of doubt, in approving this Policy Report, authority is given to the Company to honour any commitments entered into with current or former Directors before the current legislation on remuneration policies came into force or before an individual became a Director, such as the payment of outstanding incentive awards, even where it is not consistent with the policy prevailing at the time such commitment is fulfilled. The Chief Finance Officer is currently standing in as Interim Chief Executive Officer and receives a temporary salary supplement of £100k, making a total salary of £350k, which will revert to £250k when the new Chief Executive Officer is appointed. The Executive Chairman will revert to becoming Non-Executive Chairman when a new Chief Executive Officer is appointed and his fees will revert to £135k. Details of any payments to former Directors will be set out in the Annual Report on Remuneration as they arise. External Directorships for Executive Directors Executive Directors may accept one external Non-Executive Directorship with the prior agreement of the Board, provided it does not conflict with the Group’s interests and the time commitment does not impact upon the Executive Director’s ability to perform their primary duty. The Executive Directors may retain the fee from external directorships. During the financial year, Chris Stone held more than one external Non-Executive Directorship with the consent of the Board on the basis that such external Non-Executive Directorships did not conflict with or impact on his ability to perform his role as Executive Chairman and as Chris’s role will revert to becoming Non-Executive Chairman when a new Chief Executive Officer is appointed. This part of the report has been prepared in accordance with Part 3 of The Large and Medium-sized Companies and Groups (Accounts and Reports) (Amendment) Regulations 2013 and 9.8.8R of the Listing Rules. The following report will be subject to an advisory shareholder vote at the 2017 AGM, which is scheduled to be held 21 September 2017. The information on pages 97 to 105 has been audited where indicated. How will the remuneration policy be implemented in the year ended 31 May 2018? Executive Directors’ Base Salaries. As the Chief Finance Officer was appointed in February 2017 and the Executive Chairman in April 2017, the Committee has decided not to award any salary increases with effect from 1 June 2017. With regard to all other employees, the general increase has been 2.5 per cent (for support staff) and 4.5 per cent (for frontline staff), except those who have been promoted or where market adjustments were made to employees who were out of line with the general market, where larger increases have been made. This compares to the awards made last year to the previous Chief Executive Officer, Rob Cotton, of 6.02 per cent to £528k and to the previous Chief Finance Officer, Atul Patel, of 6.03 per cent to £246k. Base salary at 31 May 2017 Base salary/fee following the appointment of a new CEO % Increase £350k £135k N/A £350k £250k N/A £000 Executive Chairman1 Chief Finance Officer2 1 2 Executive Chair fees will reduce to £135k when a new Chief Executive Officer is appointed and Chirs Stone becomes Non-Executive Chairman. Chief Finance Officer is currently paid a supplement to be Interim Chief Executive and will revert to £250k when a new Chief Executive Officer is appointed and the role reverts to Chief Finance Officer. Pension and Benefits. There will be no changes to pension or benefits provision. Annual Bonus. The annual bonus maximum for the Chief Executive Officer and the Chief Finance Officer in 2017/18 will be 100 per cent of salary. Any bonus due to the Chief Executive Officer will be prorated to reflect full months worked in the year. The bonus due to the Chief Finance Officer will be based on his average salary for the year, including the supplement paid for his additional responsibilities as interim Chief Executive Officer. Measures will be based 75 per cent on the achievement of actual operating profit (EBIT) targets and 25 per cent on the achievement of strategic objectives. To ensure that the bonus is self-funding, no bonus, including any due for achievement of strategic targets, will be payable if the minimum EBIT target is not met. The profit target will be based on delivery of the Group’s own internal plans, which are comprehensively set, scrutinised and agreed by the Main Board, overlaid on to the financial forecasts and expectations in the investor community. In addition, to ensure that this bonus opportunity also results in shareholder alignment and provides greater retention value, 35 per cent of any bonus payment will be deferred in shares for two years. The bonus, deferred share options and associated dividends are also subject to malus and clawback provisions. The performance measures, together with the level of performance against each objective, will be disclosed in the 2017/18 Annual Report on Remuneration. NCC Group plc Annual Report and Accounts for the year ended 31 May 2017 95 NCC AR2017 proof 8- Back.indd 95 25546.04 9 August 2017 4:01 PM Proof Six 09/08/2017 16:01:43 GOVERNANCE Remuneration committee report ANNUAL REPORT ON REMUNERATION The targets relating to the 2016/17 bonus payments (of which there were none) are shown below and as this is a transition year to our new policy on disclosure, we are also disclosing 2015/16 and 2014/15 bonus targets and achievement against those targets. Long Term Incentive Plan (LTIP). It is expected that awards of 100 per cent of base salary will be made under the LTIP in September 2017, following the completion of the Strategic Review and the Company’s 2017 AGM at which the new remuneration policy will be tabled for approval on the same terms as set out in the policy table. These will be subject to a two-year post vesting holding period for Executive Directors. As well as the holding period, the Executives have to achieve a shareholding guideline of 200 per cent of salary (post shares sold to cover any tax) before they can sell any shares that vest. The awards are also subject to malus and clawback provisions. The vesting of LTIP awards will be based on performance of Earnings Per Share (60 per cent), a Cash flow metric (30 per cent) and a relative Total Shareholder Return metric (10 per cent). The Committee believes that these three measures are transparent, easy to understand, easy to track and communicate, cost-effective to measure and fundamentally aligned to the strategic ambitions that have been communicated to the market. The performance conditions will be set once the Strategic Review and Target Operating Model have been completed. Non-Executive Directors’ Remuneration In line with the current Policy, Non-Executive Director fees are due for review every three years and these were last reviewed in June 2014. The fees have been benchmarked in line with companies of a similar scale and complexity and it is proposed that the base fee is increased from £38,000 to £45,000, to apply with effect from 1 June 2017. Additional fees for chairing the Audit Committee, the Remuneration Committee and performing the duties of Senior Independent Director will remain unchanged at £7,000, £7,000 and £6,000 respectively. In addition to the above, the Board (without Debbie Hewitt’s participation) considered the additional hours committed by her in her capacity as Senior Independent Director during the year and specifically from the period from October 2016 to May 2017, when she led the Company’s consultation with key shareholders, chaired the newly created Governance Committee, set up to comprehensively review standards of Corporate Governance across all aspects of the business, chaired the Nominations Committee, chaired the newly created Disclosure Committee, as well as overseeing the initiation of the strategy review. During this period, she also led the recruitment of the new Chairman and an additional Non- Executive Director. The Board decided that in recognition of the significant increase in time and the diligence with which she tackled these considerable tasks that she should be paid an additional one-off fee of £35,000. Such a payment is within the scope of our NED fee policy. In addition, the Board is proposing to move to an annual review of fees for Non-Executive Directors, including the Chairman. This reflects the approach with general staff and prevents Non-Executive Director fees getting significantly out of line with market, which could result in significant irregular adjustments to NED fees and which could be a limitation to the attraction of new appointments. Annualised Fees £000s Chris Stone* Debbie Hewitt Thomas Chambers Chris Batterham Jonathan Brooks 2016/17 2017/18 £350 £350 £86 £43 £38 £38 £58 £52 £45 £45 * Executive Chair fees will reduce to £135k when a new Chief Executive Officer is appointed and Chris Stone becomes Non-Executive Chairman How has the remuneration policy been implemented in the year ended 31 May 2017? This section sets out how the remuneration policy was implemented in 2016/17. The key implementation decisions during the year related to: z Determination of annual bonus outcomes for the 2016/17 performance period. z Determination of the vesting level of LTIP awards which related to the three year performance period ending on 31 May 2017. z Terms of the exiting Directors, including the Chairman, Chief Executive Officer and Chief Finance Officer. z Terms of the new Directors appointed to the Board, including the Chairman and Chief Finance Officer. z The performance targets of the annual bonus scheme, which will apply for the YE 31 May 2018. z The performance targets and value of awards to be granted under the LTIP, which will vest in 2020. Further detail on these decisions, together with other information on payments made to Directors, is set out in the following sections. 96 www.nccgroup.trust Stock Code: NCC NCC AR2017 proof 8- Back.indd 96 25546.04 9 August 2017 4:01 PM Proof Six 09/08/2017 16:01:43 Single Total Figure of Remuneration (Audited) The detailed emoluments received by the Executive and Non-Executive Directors for the year ended 31 May 2017 are below. No payments were made for loss of office, as indicated in the notes. Director £000 Rob Cotton6 Atul Patel8 Brian Tenner10 Paul Mitchell11 Chris Stone12 Debbie Hewitt13 Year ended 31 May 2017 31 May 2016 31 May 2017 31 May 2016 31 May 2017 31 May 2017 31 May 2016 31 May 2017 31 May 2017 31 May 2016 Thomas Chambers 31 May 2017 31 May 2016 Chris Batterham 31 May 2017 Jonathan Brooks14 31 May 2017 31 May 2016 Base Salary / Non-Executive Director Fees Benefits1 Pension Benefits2 Annual Bonus3 Long-term incentive4 Other5 Total £528 £498 £164 £232 £108 £75 £75 £52 £86 £51 £43 £43 £38 £38 £8 £29 £31 £18 £28 £5 – – – – – – – – – – £53 £50 £17 £23 £11 – – – – – – – – – – £0 £3487 £0 £1629 £0 £164 £215 £76 – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – £610 £1,091 £200 £521 £124 £75 £75 £52 £86 £51 £43 £43 £38 £38 £8 1 Taxable benefits include the provision to every Executive Director of a car or car allowance, payment of private fuel, car insurances, private medical insurance, life assurance and permanent health insurance. 2 Pension benefits include employer contributions to the Group pension scheme and payments in lieu of pension contributions. 3 Annual Bonus payments for performance in the relevant financial year. Thirty-five per cent of this bonus is deferred in shares for two years. 4 Long-term incentive awards vesting under the LTIP. Further detail is set out on page 100. 5 The value of the awards vesting under the SAYE. 6 Rob Cotton, Chief Executive Officer, stepped down from the Board on 1 March 2017. Details of his exit terms are described on page 100 of this report. 7 The deferred elements of this bonus and associated dividends will lapse as part of Rob Cotton’s exit terms. 8 Atul Patel, Chief Finance Officer, resigned and stepped down from the Board on 10 August 2016 and left the Company as an employee after working his notice period until 3 February 2017. No payments were made for loss of office. 9 The deferred element of this bonus and the associated dividends will be prorated to complete months of service that Atul Patel will have completed since the date of the award. 10 Brian Tenner was appointed as Chief Finance Officer to the Board on 1 February 2017. He was paid a supplement of £100k from 1 March 2017 to recognise his appointment as Interim Chief Executive Officer. This supplement will cease on appointment of the new Chief Executive Officer. 11 Paul Mitchell stepped down from his role as Chairman on the 6 April 2017 and stepped down from the Board on 31 May 2017. No payments were made for loss of office. 12 Chris Stone was appointed as Chairman of the Board on 6 April 2017. He has been appointed initially as Executive Chairman, paid a total fee of £350k. He will remain as Executive Chairman until a new Chief Executive Officer is appointed, at which point he will become Non-Executive Chairman and his fees will revert to £135k. 13 Debbie Hewitt was paid an additional fee of £35k to recognise the additional hours committed from the period from October 2016 to May 2017, when she chaired a number of additional Committees, led the recruitment of new Executive and Non-Executive Directors and oversaw the initiation of the strategy review. 14 Jonathan Brooks was appointed as Non-Executive Director on 16 March 2017. 15 Atul Patel was entitled to a prorata dividend in respect of the deferred share options granted under the DB Plan in respect of FY14/15 and which vested on 31 May 2017 of an amount equal to the value of dividends that would have be paid on the deferred shares in relation to dividend record dates occurring between the date of grant and the date that the awards vest, amounting to £1,721.59. NCC Group plc Annual Report and Accounts for the year ended 31 May 2017 97 NCC AR2017 proof 8- Back.indd 97 25546.04 9 August 2017 4:01 PM Proof Six 09/08/2017 16:01:44 GOVERNANCE Remuneration committee report ANNUAL REPORT ON REMUNERATION Additional information in respect of the Single Total Figure of Remuneration Annual Bonus Our previous policy was to disclose annual bonus targets retrospectively after two years. Following a review of that policy, the Committee has decided to disclose annual bonus targets in the annual report to which the annual bonus payment relates. As a result, this year is a transition year, in which we are disclosing the targets for three annual bonus awards: the 2016/17 annual bonus, the 2015/16 annual bonus and the 2014/15 annual bonus. These disclosures are set out below: 2016/17 Annual Bonus (Audited) For the year ended 31 May 2017, the maximum potential bonus opportunity for Rob Cotton was 100 per cent of salary (£528,000), for Atul Patel 100 per cent of salary (£246,000) and for Brian Tenner 100 per cent of salary but prorated to reflect that he joined part way through the year (£40,000). No annual bonus was paid to any departing or current Executive Director for the year ended 31 May 2017, recognising the significant underperformance of the business in relation to market expectations. The performance measures and targets are set out below: 31 May 2017 adjusted EBITDA 31 May 2017 Potential Annual Bonus payments Rob Cotton Atul Patel Brian Tenner Performance condition Threshold £41.9m £132,000 £61,500 Target £46.5m £369,600 £172,200 £40,000 Maximum £55.8m £528,000 £246,000 Actual performance/Bonus payments £25.9m £0 £0 £0 2015/16 Annual Bonus (Audited) For the year ended 31 May 2016, the maximum bonus opportunity for Rob Cotton was 100 per cent of salary (£498,000), and for Atul Patel 100 per cent of salary (£232,000). A total bonus of 70 per cent of potential was paid to each Executive Director, 35 per cent of which was deferred in shares for a further two years. The performance measures, targets and payments are set out below: 31 May 2016 adjusted Profit Before Tax 31 May 2016 Potential Annual Bonus payments Rob Cotton Atul Patel Performance condition Threshold £32.7m £124,500 £58,000 Target £36.3m £348,600 £162,400 Maximum £43.6m £498,000 £232,000 Actual performance/Bonus payments £37.0m £348,600 £162,400 In relation to the deferred share option granted to Rob Cotton on 15 July 2016, for 41,357 shares, all outstanding deferred share options under the DB Plan, relating to the 2016 annual bonus awards (totalling 41,357 shares), and the cash equivalent relating to the dividends due to be paid on those shares, will lapse at the cessation of Rob Cotton’s employment on 31 October 2017, as part of his exit arrangements. The cash equivalent on the dividends at 31 May 2017 is £1,923.10. Atul Patel resigned and left the Company on 3 February 2017. In relation to the deferred share option granted to Atul Patel on 15 July 2016, for 19,266 shares, the Committee determined that these awards should vest on a prorata basis to reflect time worked since the date of the grant. This will result in 6,422 shares vesting on 31 May 2018 in relation to the awards granted in July 2016. 98 www.nccgroup.trust Stock Code: NCC NCC AR2017 proof 8- Back.indd 98 25546.04 9 August 2017 4:01 PM Proof Six 09/08/2017 16:01:44 Participants in the DB Plan are also entitled to a cash payment of an amount equal to the value of dividends that would have been paid on the deferred share options in relation to dividend record dates occurring between the date of grant and the date that the awards vest. Accordingly, the Committee determined that Atul Patel will be entitled to a prorata dividend accrual payment when the deferred share options vest, which as at 31 May 2017 amounts to £298.62. The awards and dividends will continue to be subject to the relevant malus and clawback provisions. 2014/15 Annual Bonus (Audited) For the year ended 31 May 2015, the maximum bonus opportunity for Rob Cotton was 100 per cent of salary (£470,000), and for Atul Patel 100 per cent of salary (£209,000). A total bonus of 72.8 per cent of potential was paid to each Executive Director, 35 per cent of which was deferred in shares for a further two years. The performance measures, targets and payments are set out below: Performance condition 31 May 2015 adjusted Profit Before Tax £22.5m £25.0m £30.0m 31 May 2015 Potential Annual Bonus payments Rob Cotton £117,500 Atul Patel £52,250 £329,600 £146,300 £470,000 £209,000 Threshold Target Maximum Actual performance/Bonus payments £25.47m £342.141 £152,144 In relation to the deferred share option granted to Rob Cotton on 28 July 2015, for 52,614 shares, while he was still employed by the Company when the deferred share options were due to vest on 31 May 2017, notwithstanding the rules of the DB Plan and the terms of the option certificate in relation to those deferred shares, he agreed, as part of his exit arrangements, not to exercise his option. These deferred share options and the associated dividend of £4,645.82 lapsed. Atul Patel resigned and left the Company on 3 February 2017. In relation to the deferred share option granted to Atul Patel on 28 July 2015, for 23,396 shares, the Committee determined that these awards should vest on a prorata basis to reflect time worked since the date of the grant. This resulted in 19,497 shares vesting on 31 May 2017 in relation to the awards granted in July 2015. Participants in the DB Plan are also entitled to a cash payment of an amount equal to the value of dividends that would have been paid on the deferred shares in relation to dividend record dates occurring between the date of grant and the date that the awards vest. Accordingly, the Committee determined that Atul Patel was entitled to a prorata dividend accrual payment when the deferred share options vest, which amounted to £1,721.59. The awards and dividends will continue to be subject to the relevant malus and clawback provisions. NCC Group plc Annual Report and Accounts for the year ended 31 May 2017 99 NCC AR2017 proof 8- Back.indd 99 25546.04 9 August 2017 4:01 PM Proof Six 09/08/2017 16:01:44 GOVERNANCE Remuneration committee report ANNUAL REPORT ON REMUNERATION Long-term incentive plan vesting (Audited) LTIP awards vesting based on performance for the period June 2014 up to the end of the year ended 31 May 2017 were based on demanding three-year EPS growth performance conditions. Group EPS performance missed the performance target, which resulted in the LTIPs awarded to Rob Cotton in 2014 lapsing. LTIP awards held by Rob Cotton granted in 2015 and 2016 will lapse on cessation of his employment on 31 October 2017, as part of his exit terms. The LTIP award held by Atul Patel, in respect of the 2014–17 award, along with 2015 and 2016 awards (totalling 288,161 shares under option), lapsed on cessation of his employment on 3 February 2017. Number of LTIP shares awarded 2014 – 2017 228,432 101,579 % of shares vesting Value of shares lapsing 0 0 £303,815 £135,100 Executive Rob Cotton Atul Patel The value shown in the last column is based on the average share price over March, April and May 2017 of £1.33. The detail on the performance condition relating to these awards is set out below: Growth in adjusted EPS over the period 1 June 2014 to 31 May 2017 % of LTIP award which will vest Exit terms for departing Directors (Audited) Chief Executive Officer Rob Cotton, Chief Executive Officer, stepped down from the Board and was put on garden leave from 1 March 2017. Although Rob Cotton’s Service Agreement provides for a 12 month notice period, it was mutually agreed that this would be reduced to a period of eight months’ garden leave, during which he would receive payment by monthly instalments equating to eight months’ salary, pension and car allowance (total of £399,600). It was also agreed that he would continue to receive other benefits as usual during this garden leave period. He will cease being an employee of the Company on 31 October 2017. No payment was made in lieu of annual bonus in respect of the financial year ended 31 May 2017 or during the garden leave period and no further LTIP grant will be made. In relation to the LTIP option granted to Rob Cotton on 6 August 2014 totaling 228,432 shares under option, the performance condition was not achieved and the option lapsed. All outstanding LTIPs in respect of the 2015 and 2016 awards, totalling 400,490 shares under option, will lapse (in the case of the 2016 awards) or will not be exercised as agreed by Rob Cotton (in relation to the 2015 awards) at the cessation of his employment on 31 October 2017. In relation to the deferred shares granted to Rob Cotton on 28 July 2015, which were due to vest on 31 May 2017, totalling 52,614 shares, notwithstanding the rules of the DB Plan and the terms of the option certificate in relation to those deferred shares, he agreed not to exercise his option (the cash equivalent relating to the dividends totalled £4,645.82). Performance condition Less than 9% on average per annum 9% on average per annum At or above 15% on average per annum 0 20 100 All other outstanding deferred shares under the DB Plan, relating to the 2016 annual bonus awards, totalling 41,357 shares and the cash equivalent relating to the dividends due to be paid on those shares, will lapse at the cessation of Rob Cotton’s employment on 31 October 2017. The cash equivalent as at 1 April 2017 is £1,923.10. Between 9% and 15% per annum Between 20% and 100% on a straight-line basis. Any Save As You Earn awards outstanding at cessation of his employment on 31 October 2017 will lapse. Actual performance -8.8% per annum 0 No further payments for loss of office will be made. In addition to the above, Rob Cotton reimbursed the Company with a cash sum of £19,596.70 in relation to expenses claimed. 100 www.nccgroup.trust Stock Code: NCC NCC AR2017 proof 8- Back.indd 100 25546.04 9 August 2017 4:01 PM Proof Six 09/08/2017 16:01:44 Chief Finance Officer Atul Patel, the previous Chief Finance Officer, resigned and stepped down from the Board on 10 August 2016 and left the Company on 3 February 2017, after working his notice. His salary, pension and car allowance was paid in monthly instalments as usual, including other benefits until 3 February 2017. He was not eligible for an annual bonus in respect of the financial year ended 31 May 2017. All Long Term Incentive Share Plan (‘LTIP’) awards held by Atul Patel (in respect of the 2014, 2015 and 2016 awards, totalling 288,161 shares under option) lapsed on cessation of his employment on 3 February 2017. Under the Deferred Bonus Plan (‘DB Plan’), he deferred a total of 42,662 shares relating to the 2015 and 2016 annual bonus awards. The Committee determined that these awards should vest on a prorata basis to reflect time worked since the date of the grant. This resulted in 19,497 shares vesting on 31 May 2017 in relation to the awards granted in July 2015 and 6,422 shares vesting on 31 May 2018 in relation to the awards granted in July 2016. Participants in the DB Plan are also entitled to a cash payment of an amount equal to the value of dividends that would have be paid on the deferred shares in relation to dividend record dates occurring between the date of grant and the date that the awards vest. Accordingly, the Committee determined that he will be entitled to a prorata dividend accrual payment when the deferred shares vest. The awards and dividends will continue to be subject to the relevant malus and clawback provisions. His outstanding Save as Your Earn awards lapsed on the cessation of his employment on 3 February 2017. Chairman Paul Mitchell, Non-Executive Chairman, announced his intention to step down as Chairman on 18 January 2017. He stepped down from his role as Chairman on 6 April 2017 and stepped down from the Board on 31 May 2017. No payments for loss of office were made. Appointment terms for new Directors Chief Finance Officer Brian Tenner, Chief Finance Officer, joined the business on 1 February 2017. The remuneration arrangements provided to him were in accordance with the current approved Policy and are as follows: z Base salary of £250,000. z Maximum annual bonus potential of 100 per cent of salary, with 35 per cent of any payment deferred in shares, for two years. z Annual grant under the LTIP of 100 per cent of salary. z Employer pension contribution of 10 per cent of salary. z Benefits of monthly car allowance of £1,100 per month, private fuel, life assurance of 4 × salary and private medical insurance for self and family. z Notice period of six months. He was appointed to the position of Interim Chief Executive on 1 March 2017 and was awarded a base salary of £350,000, which he retains while holding this position. No other terms and conditions were changed. His base salary will revert to £250,000 when he relinquishes his responsibility as Interim CEO. His salary will be reviewed again on 1 June 2018, in line with the current approved policy. Chairman Chris Stone joined the business on 6 April 2017 as Executive Chairman. His fees for this role are £350k. Once a permanent Chief Executive Officer has been appointed, Chris Stone will become Non-Executive Chairman and his fee will reduce to £135k. He has no entitlement to any benefits or incentives and he has a notice period of three months. Scheme interests awarded during the year (Audited) LTIP awards granted in the year. On 15 July 2016, the Executive Directors were granted awards which were due to vest on 31 May 2019, subject to the performance conditions that were set out in last year’s Report on Remuneration. The awards are set out below. The awards for Rob Cotton will lapse when he leaves the Company on 31 October 2017 and for Atul Patel, they lapsed when he resigned and left the Company on 3 February 2017. NCC Group plc Annual Report and Accounts for the year ended 31 May 2017 101 NCC AR2017 proof 8- Back.indd 101 25546.04 9 August 2017 4:01 PM Proof Six 09/08/2017 16:01:44 GOVERNANCE Remuneration committee report ANNUAL REPORT ON REMUNERATION Executive Rob Cotton Number of LTIP awards1 Basis Face Value2 Performance condition 182,069 100% of base salary £528,000 Vesting was to be determined by growth in adjusted EPS over the performance period. Performance period 1 June 2016 to 31 May 2019 1 June 2016 to 31 May 2019 Atul Patel 84,828 100% of base salary £246,000 1 2 LTIP awards are structured as nominal-cost options (£1 being payable upon each exercise). Based on a share price of £2.90 which was the closing mid-market price of the Company’s shares on the day before the date of grant. The performance condition for these awards is set out below: Average annual growth in adjusted EPS over the period 1 June 2016 to 31 May 2019 % of LTIP award which will vest Performance condition Less than 9% on average per annum 9% on average per annum At or above 15% on average per annum 0 20 100 Between 9% and 15% on average per annum Between 20% and 100% on a straight-line basis. SAYE options granted and exercised in the year. The Group operates an HMRC approved SAYE scheme. All eligible employees, including Executive Directors, may be invited to participate on similar terms for a fixed period of three years. During the year Rob Cotton opted to participate in this scheme but as his participation in the 2016 scheme will lapse upon termination of his employment on 31 October 2017, he elected, as part of his exit terms, to withdraw from the 2016 scheme. On his departure from the Company, Atul Patel’s participation in the 2014 scheme lapsed. On 17 November 2016 Rob Cotton exercised 7,945 options under the 2013 scheme at an exercise price of £1.13. Rob Cotton made an aggregate gain of £6,175.65 on the exercise of these options. These awards have been included in the other column of the single figure table in the 2016/17 annual remuneration report, as they have vested. Executive Date of Grant Number of options Basis Face Value Exercise price Performance condition Vesting Date Rob Cotton 4 Aug 2014 Atul Patel 4 Aug 2014 Rob Cotton 31 Aug 2016 5,933 £250 per month contribution over a 3 year period 11,867 £500 per month contribution over a 3 year period 3,437 £250 per month contribution over 3 year period £12,4591 £1.5167 £24,9211, 2 £1.5167 £8,9983 £2.618 October 2017 October 2017 October 2019 Awards vest subject to continued employment Awards vest subject to continued employment Awards vest subject to continued employment 1 2 3 Calculated on the price of £2.10, which was the average midmarket share price over the three days preceding the date of grant. Awards lapsed on Atul’s departure from the Company. Calculated on the price of £2.62, which was the average midmarket share price over the three days preceding the date of grant. Rob withdrew his participation in the scheme on 30 March 2017. 102 www.nccgroup.trust Stock Code: NCC NCC AR2017 proof 8- Back.indd 102 25546.04 9 August 2017 4:01 PM Proof Six 09/08/2017 16:01:44 Directors’ interests in shares (Audited) The tables below set out details of the Executive Directors’ share awards which vested in 2016–17 and those which lapsed, due to the Executive Directors leaving the Company. LTIP – maximum awards granted Date of awards Maximum number of options granted Rob Cotton 8 July 2013 312,7272 6 Aug 2014 228,432 28 July 2015 218,421 15 July 2016 182,069 Atul Patel 8 July 2013 145,4543 6 Aug 2014 28 July 2015 15 July 2016 101,579 101,754 84,828 Performance period Exercise period Share price on date of grant £ Exercise price £1 Status 3 years 3 years 3 years 3 years 3 years 3 years 3 years 3 years 1 year 1 year 1 year 1 year 1 year 1 year 1 year 1 year 1.375 2.058 2.28 3.02 1.375 2.058 2.28 3.02 £1 Partly vested on 31.5.16 £1 £1 £1 Lapsed on 31.5.17 Will lapse on 31.10.17 Will lapse on 31.10.17 £1 Partly vested on 31.5.16 £1 £1 £1 Lapsed on 3.2.17 Lapsed on 3.2.17 Lapsed on 3.2.17 1 Total exercise price of £1.00 on each occasion. 2 61,295 of these awards vested to Rob Cotton in 2016. The remainder lapsed. 3 28,509 of these awards vested to Atul Patel in 2016. The remainder lapsed. Summary of maximum awards outstanding Total LTIP Options held at 31 May 2016 Granted during the period Exercised during the period Share price on date of exercise Lapsed during the period Total LTIP Options held at 31 May 2017 Rob Cotton Atul Patel 759,580 182,069 348,787 84,828 61,295 28,509 £2.973 £2.974 251,432 688,9221 405,1062 0 1 The Company has agreed with Rob Cotton that these options will lapse when he leaves the Company on 31 October 2017. 2 288,161 of this sum lapsed upon Atul Patel’s departure from the Group on 3 February 2017. 3 Rob Cotton’s aggregate gain on the exercise of the LTIPs was £182,046.15. 4 Atul Patel’s aggregate gain on the exercise of the LTIPs was £84,671.73. All awards granted under the LTIP were subject to continued employment and the satisfaction of the performance conditions as set out below. The awards were all nominal cost options. Performance conditions for the above awards The outstanding awards from the period 1 June 2014 disclosed above were subject to the following performance conditions. If adjusted EPS growth was equal to 15 per cent or more per annum, then 100 per cent of the award will vest. If, however, growth was less than 9 per cent per annum, none of the award governed by the EPS condition will vest. Performance between the two points of measure was to be determined between 20 per cent and 100 per cent on a straight-line basis. The outstanding awards up to the period 31 May 2014 disclosed above were subject to the following performance conditions. If adjusted EPS growth was equal to 25 per cent or more per annum, then 100 per cent of the award would have vested. If, however, growth was less than 10 per cent per annum, none of the award governed by the EPS condition would have vested. Performance between the two points of measure would have been determined on a straight-line basis. NCC Group plc Annual Report and Accounts for the year ended 31 May 2017 103 NCC AR2017 proof 8- Back.indd 103 25546.04 9 August 2017 4:01 PM Proof Six 09/08/2017 16:01:44 GOVERNANCE Remuneration committee report ANNUAL REPORT ON REMUNERATION Share ownership (Audited) The beneficial and non-beneficial interests of the current directors in the share capital of NCC Group at 31 May 2017 are set out below. Beneficial Interests in ordinary shares1 Maximum Share awards subject to performance conditions Share options Total 31 May 2016 31 May 2017 31 May 2016 31 May 2017 31 May 2016 31 May 2017 31 May 2016 31 May 2017 Brian Tenner – – Debbie Hewitt 37,389 37,389 Thomas Chambers 20,900 20,900 Chris Batterham 22,000 22,000 Chris Stone Jonathan Brooks – – – – 1 This information includes holdings of any connected persons. – – – – – – – – – – – – – – – – – – – – – – – – – – 37,389 37,389 20,900 20,900 22,000 22,000 – – – – The beneficial and non-beneficial interests of the Directors who departed from the Group during the year in the share capital of NCC Group at 31 May 2017 are set out below. Beneficial Interests in ordinary shares1 Maximum Share awards subject to performance conditions2 Share options Total 31 May 2016 31 May 2017 Rob Cotton 5,487,033 5,652,406 Atul Patel 105,284 120,367 Paul Mitchell 650,000 700,000 31 May 2016 759,580 348,787 – 31 May 2017 31 May 2016 31 May 2017 31 May 2016 31 May 2017 400,4905 13,8783 5,9333 6,260,491 6,058,829 –6 – 11,8774 19,4977 465,948 139,864 – – 650,000 700,000 1 This information includes holdings of any connected persons. 2 These awards represent the outstanding LTIP interests, which are included in the table on page 97. 3 Represents the SAYE scheme interest, of which 7,945 vested in October 2016 and 5,933 vest in October 2017. 4 Represents the SAYE scheme interest granted in October 2014. All SAYE interests held by Atul Patel lapsed on his departure from the Group on 3 February 2017. 5 Represents LTIP interests awarded in July 2015 and July 2016 which will lapse upon cessation of Rob Cotton’s employment on 31 October 2017. 6 All LTIP interests held by Atul Patel during the year lapsed on 3 February 2017. 7 Represents the pro rata amount of deferred share options granted on 28 July 2015. All SAYE interests held by Atul Patel during the year lapsed on 3 February 2017. 104 www.nccgroup.trust Stock Code: NCC NCC AR2017 proof 8- Back.indd 104 25546.04 9 August 2017 4:01 PM Proof Six 09/08/2017 16:01:44 Shareholding Requirements (Audited) This year, the Remuneration Committee has decided to adopt a new guideline with regard to Executive shareholding. The Executive Directors are expected to build and retain a shareholding in the Group at least equivalent to 200 per cent of base salary. Executives will be required to retain all vested deferred bonus shares and LTIP shares released from the holding period until they have attained the minimum shareholding guideline and even then, only when they have held vested LTIP shares for a minimum period of two years. For the avoidance of doubt, Executive Directors are permitted to sell sufficient shares in order to meet any tax obligation arising from vesting shares. Brian Tenner Shareholding requirements (% of current salary) Current shareholding (% of salary) Requirement met 200 0 No Relative importance of the spend on pay The following table sets out the percentage change in distributions to shareholders and employee remuneration costs. Employee remuneration costs1 Dividends2 31 May 2017 £m 31 May 2016 £m % Change 136.3 12.8 100.1 10.3 36 24 1 2 Based on the figure shown in note 5 to the Financial Statements. Based on the cash returned to shareholders in the year ended 31 May 2017 through dividends as shown in note 9 to the Financial Statements. Percentage increase in the remuneration of the Chief Executive The table below shows the movement in the salary, benefits and annual bonus for the Chief Executive between the current and previous financial year compared to all employees of the Company. Element of remuneration Salary Taxable benefits Annual Bonus * Nil bonus was paid in respect of the year ended 31 May 2017 Chief Executive Employees Chief Executive (% of salary) Employees (% of salary) Chief Executive (% of salary) Employees (% of salary) % increase 6.0 6.0 5.5 11.2 –* 7.7 NCC Group plc Annual Report and Accounts for the year ended 31 May 2017 105 NCC AR2017 proof 8- Back.indd 105 25546.04 9 August 2017 4:01 PM Proof Six 09/08/2017 16:01:45 GOVERNANCE Remuneration committee report ANNUAL REPORT ON REMUNERATION Performance graph and table The following graph shows the total shareholder return, with dividends reinvested, from 31 May 2010 against the corresponding changes in a hypothetical holding in shares in the FTSE All Share Index. The FTSE All Share represents broad equity indices in which the Company is a constituent member and gives a market capitalisation-based perspective. During the year, the Company’s share price varied between £3.68 and £1.07 and ended the year at £1.66. Eight year historical TSR performance growth in the value of a hypothetical £100 holding over eight years FTSE All Share comparison based on spot value. 900% 800% 700% 600% 500% 400% 300% 200% 100% 0% 01 June 09 01 June 10 01 June 11 01 June 12 01 June 13 01 June 14 01 June 15 01 June 16 01 June 17 NCC GROUP PLC FTSE ALL-SHARE INDEX The share price was £2.86 on 1 June 2016 and £1.66 on 31 May 2017 a decrease of 42 per cent in the year. The table below shows the total remuneration for the Chief Executive over the same eight year period including share awards valued at the date they vested. Year Ended 31 May 2017 31 May 2016 31 May 2015 31 May 2014 31 May 2013 31 May 2012 31 May 2011 31 May 2010 Chief Executive Rob Cotton1 Rob Cotton Rob Cotton Rob Cotton Rob Cotton Rob Cotton Rob Cotton Rob Cotton Total Remuneration (£000) Annual Bonus (% of max)2 Long-term incentives (% of max)3 £610 £1,091 £993 £1,089 £1,118 £1,074 £1,222 £836 0 70 73 73 04 85 67 71 0 20 15 50 63 70 54 72 1 Rob Cotton stepped down from the Board and was put on garden leave from 1 March 2017. He will leave the Company on 31 October 2017. 2 Note that this shows the annual bonus payments as a percentage of the maximum opportunity. Shows the number of shares, which vested as a percentage of the maximum number of shares, which could have vested. In 2012/13 Rob Cotton waived his right to a bonus, which would have been equal to 32 per cent of salary. This was equivalent to 50 per cent of the maximum bonus opportunity. 3 4 106 www.nccgroup.trust Stock Code: NCC NCC AR2017 proof 8- Back.indd 106 25546.04 9 August 2017 4:01 PM Proof Six 09/08/2017 16:01:45 Membership and attendance The Remuneration Committee membership consists solely of Non-Executive Directors and comprises Debbie Hewitt as Chairman, Thomas Chambers, Chris Batterham and Jonathan Brooks. The Executive Chairman, Chief Finance Officer and Company Secretary attend the Remuneration Committee by invitation of the Chairman of the Committee from time to time and assist the Committee with its considerations. No Director is involved in setting their personal remuneration plan. The attendance of individual Committee members at Remuneration Committee meetings is shown in the table below: Dilution The LTIP has a dilution limit, for new and treasury shares, of 10 per cent of the issued ordinary share capital of the Company in any ten year period for any share option scheme operated by the Company. As at 31 May 2017 the Company had utilised 17,752,848 (31 May 2016: 19,727,431) ordinary shares through LTIP, SAYE, EMI, CSOP, ISO and ESPP awards counting towards the 10 per cent limit which represents 6.42 per cent (2016: 7.15 per cent) of the issued ordinary share capital of the Company. Statement of shareholder voting At the 2014 AGM, the Directors’ Remuneration policy received the following votes from shareholders. Debbie Hewitt Thomas Chambers Chris Batterham Jonathan Brooks1 Meetings attended For Against Total number of votes % of votes cast 163,136,669 83,317 99.95 0.05 Total votes cast (for and against excluding withheld votes) 163,219,986 100.0 1 Appointed Non-Executive Director and member of the Remuneration Votes withheld1 9,377,487 Committee in March 2017. Advisers to the Committee During the year, the Committee received advice on senior executive remuneration from Aon Hewitt Consultants and was comfortable that the advice was objective and independent. The total fee charged 2016/17 was £700. Aon Hewitt did not provide any other services to the Company during the year. The Committee reviews the performance and independence of its advisers on an annual basis. Service contracts and letters of appointment The service contracts and letters of appointment of the current Directors include the following terms. For1 Against Total votes cast (including withheld votes) 172,597,473 100.0 1 A vote withheld is not a vote in law and is not counted in the calculation of the proportion of votes cast “for” and “against” a resolution. At last year’s AGM, the Directors’ Remuneration Report received the following votes from shareholders. Total number of votes % of votes cast 212,330,807 2,312,857 98.92 1.08 Executive Date of contract Notice period Brian Tenner 1 February 2017 6 months Non-Executive Chris Stone1 6 April 2017 Debbie Hewitt 18 September 2008 Thomas Chambers 20 September 2012 Chris Batterham 9 April 2015 Jonathan Brooks 13 March 2017 3 months 3 months 3 months 3 months 3 months 1 Appointed initially as Executive Chairman and Chris will remain as Executive Chairman until a new Chief Executive Officer is appointed, at which point he will become Non-Executive Chairman. Total votes cast (for and against excluding withheld votes) Votes withheld 214,643,664 18,955 100.0 (excluding withheld votes) Total votes cast (including withheld votes) 214,662,619 100.0 1 Any proxy appointments which give discretion to the Chairman at the meeting have been included in the “for” total. Approved by the Board and signed on its behalf: Debbie Hewitt CHAIRMAN, REMUNERATION COMMITTEE 18 July 2017 NCC Group plc Annual Report and Accounts for the year ended 31 May 2017 107 NCC AR2017 proof 8- Back.indd 107 25546.04 9 August 2017 4:01 PM Proof Six 09/08/2017 16:01:46 Going concern In adopting the going concern basis for preparing the financial statements, the Directors have considered, among other matters, the Group’s principal risks and uncertainties as set out on pages 48 to 53. Based on the Group’s cash flow forecasts and financial projections, the Board is satisfied that the Group will be able to operate within the level of its facilities for the foreseeable future. For this reason and as detailed in note 1 to the Financial Statements (Basis of preparation), the Directors consider it appropriate to continue to adopt the going concern basis in preparing the Annual Report and Financial Statements. Viability statement The Directors have assessed the viability of the Group over a three year period, in accordance with provision C2.2 of the UK Corporate Governance Code 2014, as set out on page 53. Post balance sheet events There have been no balance sheet events that either require adjustment to the Financial Statements or are important in the understanding of the Company’s current position. After the year end the Group decided to dispose of two business units, Software Testing and Web Peformance. This is disclosed in more detail in the Strategic Report. GOVERNANCE Directors’ report The Directors present their report and the Group and Company Financial Statements of NCC Group plc (the ‘Company’) and its subsidiaries (together the ‘Group’) for the financial year ended 31 May 2017. Principal activities The Company is a public limited company incorporated in England, registered number 4627044, with its registered office at Manchester Technology Centre, Oxford Road, Manchester, M1 7EF. In August 2017, the headquarters of the Company will be relocating from Manchester Technology Centre to XYZ Building, 2 Hardman Boulevard, Spinningfields, M3 3AQ. The principal activity of the Group is the provision of independent advice and services to customers through the provision of escrow and cyber assurance services. The principal activity of the Company is that of a holding company. Strategic report Pursuant to sections 414A-D Companies Act 2006, the strategic report can be found on pages 16 to 57. This report sets out the development and performance of the Group’s business during the financial year, the position of the Group at the end of the year and a description of the principal risks and uncertainties facing the Group. UK Corporate Governance Code The Company’s statement on corporate governance can be found in the Corporate Governance Report, the Audit Committee Report, the Nomination Committee Report and the Directors’ Remuneration Report on pages 58 to 111. The Corporate Governance Report, the Audit Committee Report, the Nomination Committee Report and the Directors’ Remuneration Report form part of this Directors’ Report and are incorporated into it by reference. Results and dividends The Group’s and Company’s audited Financial Statements for the financial year ended 31 May 2017 are set out on pages 113 to 169. The Directors propose a final dividend of 3.15p per ordinary share, which together with the interim dividend of 1.5p per ordinary share paid on 24 February 2017 makes a total dividend of 4.65p for the year. The final dividend will, if approved by shareholders at the Annual General Meeting (AGM), be paid on 29 September 2017 to shareholders on the register at the close of business on 1 September 2017. The ex dividend date will be 31 August 2017. An administrative non-compliance issue has been identified with respect to distributable reserves and the payment of previous dividends. The Company expects to remedy the position by means of shareholder resolutions at a general meeting to follow the AGM in September. 108 www.nccgroup.trust Stock Code: NCC NCC AR2017 proof 8- Back.indd 108 25546.04 9 August 2017 4:01 PM Proof Six 09/08/2017 16:01:46 Share capital and control At the Company’s Annual General Meeting held on 22 September 2016, the Directors were granted authority to allot up to 91,987,383 ordinary shares representing approximately a third of the Company’s issued share capital. In addition, the Directors were granted authority to allot a further 91,987,383 ordinary shares, again representing approximately a third of the Company’s issued share capital, solely to be used in connection with a pre-emptive rights issue. As at 31 May 2017, the Company’s issued ordinary share capital comprised 276,510,137 ordinary shares with a nominal value of 1 penny each, of which no ordinary shares were held in treasury. During the year ended 31 May 2017, 570,373 shares in the Company were issued further to the exercise of options pursuant to the Company’s share option schemes. 116,714 shares were transferred out of treasury in order to satisfy options exercised under the Company’s Long Term Incentive Plan for Executive Directors and senior management. The holders of ordinary shares are entitled, among other rights, to receive the Company’s annual reports and accounts, to attend and speak at general meetings of the Company, to appoint proxies and to exercise voting rights. Details of the movements of the called up share capital of the Company are set out in note 23 to the financial statements. All rights and obligations attaching to the Company’s ordinary shares are set out in the Company’s Articles of Association (Articles), copies of which can be obtained from the Companies House website or by writing to the Company Secretary. Unless otherwise provided in the Articles or the terms of issue of any shares, any shareholder may transfer any or all of his shares. The Directors may refuse to register a transfer of shares in certificated form that are not fully paid-up or otherwise in accordance with the Articles. Authority to purchase own shares At the Company’s Annual General Meeting held on 22 September 2016, shareholders authorised the Company to make market purchases of up to 27,596,215 ordinary shares representing approximately 10 per cent of the issued share capital. This authority was not used during the financial year ended 31 May 2017. At the 2017 Annual General Meeting, shareholders will be asked to give a similar authority. The Company currently holds nil ordinary shares in treasury. Directors Details of the Company’s current Directors, together with brief biographical details are set out on pages 62 to 63. In addition, the following were Directors of the Company in the financial year: Atul Patel until 3 February 2017, Rob Cotton until1March 2017 and Paul Mitchell until 31 May 2017. Subject to law and the Company’s Articles of Association, the Directors may exercise all of the powers of the Company and may delegate their power and discretion to committees. The Company’s Articles of Association give the Directors power to appoint and replace Directors. Under the terms of reference of the Nomination Committee, any appointment to the Board of the Company must be recommended by the Nomination Committee for approval by the Board. The Articles of Association also require two Directors to retire by rotation each year end and each Director must offer himself for re- election at least every three years. However, in accordance with previous years and in accordance with best practice all Directors will submit themselves for re-election at the AGM each year. Directors’ remuneration The Remuneration Committee, on behalf of the Board, has adopted a policy that aims to attract and retain the Directors needed to run the Group successfully. Details of the Directors’ remuneration are set out in the Remuneration Report on pages 86 to 107. NCC Group plc Annual Report and Accounts for the year ended 31 May 2017 109 NCC AR2017 proof 8- Back.indd 109 25546.04 9 August 2017 4:01 PM Proof Six 09/08/2017 16:01:46 GOVERNANCE Directors’ report Directors’ interests Directors’ interests in shares and share options in the Company are detailed in the Directors’ Remuneration Report set out on page 104. Directors’ and officers’ insurance and indemnities The Company maintains Directors’ and Officers’ liability insurance, which provides appropriate cover for any legal action brought against its Directors. The Directors of the Company have also entered into individual deeds of indemnity with the Company which constitute as qualifying third party indemnity provisions for the purposes of section 234 of the Companies Act 2006. The deeds were in effect during the course of the financial year ended 31 May 2017 for the benefit of the Directors and, at the date of this report, are in force for the benefit of the Directors in relation to certain losses and liabilities which they may incur (or have incurred) in connection with their duties, powers or office. Corporate social responsibility The Corporate social responsibility report on pages 54 to 57 provides an update on the Group’s policies and activities in respect of its wider stakeholders, employees, clients, suppliers, charities and the community, environmental, ethical and health and safety issues and modern slavery. During the year the Company made no political donations (2016: £Nil). Greenhouse Gas Emissions The Board is committed to maintaining the environment and limiting wherever possible its greenhouse gas emissions, this is covered on page 57 in the Corporate Social Responsibility report. Change of control In the event of a change of control of the Company, the Group and each of its lenders shall enter into negotiation for a period to determine how the Group’s loan facilities may continue and if after negotiation there is no agreement the lender has the right to cancel the commitment. There are no agreements between the Company and its Directors or employees providing for compensation for loss of office or employment (whether through resignation, purported redundancy or otherwise) that occurs because of a takeover bid. Disclosure of information to auditors The Directors who held office at the date of approval of this Directors’ report confirm that so far as they are each aware, there is no relevant audit information of which the Company’s auditors are unaware; and each Director has taken all the steps that they ought to have taken as a Director to make themselves aware of any relevant audit information and to establish that the Company’s auditors are aware of that information. A resolution to reappoint KPMG LLP as auditors will be put to the members at the Annual General Meeting. Annual General Meeting The notice of the Company’s Annual General Meeting to be held on 21 September 2017 at the offices of DLA Piper UK LLP, 1 London Wall, London, EC2Y 5EA, along with details of the business to be proposed and explanatory notes, will be available on the Group’s website together with the annual report. All shareholders will be notified by post or email, at their request, when the documents have been made available. 110 www.nccgroup.trust Stock Code: NCC NCC AR2017 proof 8- Back.indd 110 25546.04 9 August 2017 4:01 PM Proof Six 09/08/2017 16:01:46 Information to be disclosed under LR 9.8.4R: Listing Rule LR 9.8.4 (1) LR 9.8.4 (2) LR 9.8.4 (4) LR 9.8.4 (7) LR 9.8.4 (10) Detail Capitalised interest Publication of unaudited information Long-term incentive schemes Allotment of equity securities for cash Contracts of significance which a Director is interested in LR 9.8.4 (5–6) (8-9) & (11-14) (A)(B) Not applicable Page Ref 111 N/A 87-107 N/A N/A N/A Capitalised interest During the period, £nil (2016: £105,000) of interest was capitalised by the Group the tax benefit on this amount is £nil (2016: 23,000). On behalf of the Board Brian Tenner INTERIM CHIEF EXECUTIVE OFFICER 18 July 2017 NCC Group plc Annual Report and Accounts for the year ended 31 May 2017 111 NCC AR2017 proof 8- Back.indd 111 25546.04 9 August 2017 4:01 PM Proof Six 09/08/2017 16:01:46 GOVERNANCE Directors’ responsibilities statement Responsibility statement of the Directors in respect of the annual financial report We confirm that to the best of our knowledge: z the financial statements, prepared in accordance with the applicable set of accounting standards, give a true and fair view of the assets, liabilities, financial position and profit or loss of the Company and the undertakings included in the consolidation taken as a whole; and z the strategic report/Directors’ report includes a fair review of the development and performance of the business and the position of the issuer and the undertakings included in the consolidation taken as a whole, together with a description of the principal risks and uncertainties that they face. We consider the annual report and accounts, taken as a whole, is fair, balanced and understandable and provides the information necessary for shareholders to assess the Group’s position and performance, business model and strategy. For and on behalf of the Board Brian Tenner INTERIM CHIEF EXECUTIVE OFFICER 18 July 2017 Statement of Directors’ responsibilities in respect of the Annual Report and the financial statements The Directors are responsible for preparing the Annual Report and the Group and Parent Company financial statements in accordance with applicable law and regulations. Company law requires the Directors to prepare Group and Parent Company financial statements for each financial year. Under that law they are required to prepare the Group financial statements in accordance with IFRSs as adopted by the EU and applicable law and have elected to prepare the Parent Company financial statements on the same basis. Under company law the Directors must not approve the financial statements unless they are satisfied that they give a true and fair view of the state of affairs of the Group and Parent Company and of their profit or loss for that period. In preparing each of the Group and Parent Company financial statements, the Directors are required to: z select suitable accounting policies and then apply them consistently; z make judgements and estimates that are reasonable and prudent; z state whether they have been prepared in accordance with IFRSs as adopted by the EU; and z prepare the financial statements on the going concern basis unless it is inappropriate to presume that the Group and the Parent Company will continue in business. The Directors are responsible for keeping adequate accounting records that are sufficient to show and explain the Parent Company’s transactions and disclose with reasonable accuracy at any time the financial position of the Parent Company and enable them to ensure that its financial statements comply with the Companies Act 2006. They have general responsibility for taking such steps as are reasonably open to them to safeguard the assets of the Group and to prevent and detect fraud and other irregularities. Under applicable law and regulations, the Directors are also responsible for preparing a Strategic Report, Directors’ Report, Directors’ Remuneration Report and Corporate Governance Statement that complies with that law and those regulations. 112 www.nccgroup.trust Stock Code: NCC NCC AR2017 proof 8- Back.indd 112 25546.04 9 August 2017 4:01 PM Proof Six 09/08/2017 16:01:47 FINANCIAL STATEMENTS Contents Independent auditor’s report 114 Consolidated income statement 118 Consolidated statement of comprehensive income Consolidated statement of financial position Consolidated statement of cash flows Company statement of cash flows Statements of changes of equity Notes to the accounts Glossary of terms Company information 119 120 122 124 125 127 170 172 NCC Group plc Annual Report and Accounts for the year ended 31 May 2017 113 NCC AR2017 proof 8- Back.indd 113 25546.04 9 August 2017 4:01 PM Proof Six 09/08/2017 16:01:47 FINANCIAL STATEMENTS Independent auditor’s report TO THE MEMBERS OF NCC GROUP PLC ONLY OPINIONS AND CONCLUSIONS ARISING FROM OUR AUDIT 1. Our opinion on the financial statements is unmodified We have audited the financial statements of NCC Group plc for the year ended 31 May 2017 set out on pages 134 to 169. In our opinion: — the financial statements give a true and fair view of the state of the Group’s and of the parent Company’s affairs as at 31 May 2017 and of the Group’s loss for the year then ended; — the Group financial statements have been properly prepared in accordance with International Financial Reporting Standards as adopted by the European Union (IFRSs as adopted by the EU); — the parent Company financial statements have been properly prepared in accordance with IFRSs as adopted by the EU and as applied in accordance with the provisions of the Companies Act 2006; and — the financial statements have been prepared in accordance with the requirements of the Companies Act 2006; and, as regards the Group financial statements, Article 4 of the IAS Regulation. Overview Materiality: Group financial statements as a whole £0.74m (2016: £1.20m) 4.7% (2016: 5.0%) of the Group profit before tax normalised to exclude individually significant items Coverage 96% (2016: 99%) of Group profit before tax Risks of material misstatement vs 2016 Recurring risks Recoverability of goodwill Capitalisation of software and development costs as intangible assets Business combinations accounting The risk in relation to the recoverability of goodwill has reduced following the impairment of £54.3m recognised during the year. 2. Our assessment of risks of material misstatement In arriving at our audit opinion above on the financial statements, the risks of material misstatement that had the greatest effect on our audit, in decreasing order of audit significance, were as follows (unchanged from 2016): The risk Our response Recoverability of goodwill (Goodwill £198.7m, 2016: goodwill £224.3m) Refer to page 76 (Audit Committee Report), page 128 (accounting policy) and page 132 (financial disclosures). Subjective valuation Our procedures included: The trading environment in the year has been challenging for NCC Group plc resulting in a change in Directors and a Group wide- strategic review. The resultant change in operating structure has led to a reassessment of the Group’s cash generating units (CGUs). The assessment of the recoverability of goodwill could vary significantly depending on the determination of CGUs. Forecast-based valuation Due to the inherent uncertainty involved in forecasting and discounting future cash flows which are the basis of the assessment of recoverability, the outcome could vary significantly if different assumptions were applied in the model. Goodwill balances have increased significantly over recent years following a number of acquisitions, some of which involve early start- up businesses. During the year ending 31 May 2017 impairment of £54.3m has been recognised in respect of goodwill. z Testing application: Reviewing the Group’s determination of CGUs against our interpretation of the requirements of the relevant accounting standard, particularly in regards to whether the CGUs are capable of generating independent cash inflows. z Historical comparison: Assessing the Group’s forecasting accuracy by comparing actual results in the period to what was previously forecast for the year. z Our sector experience: Assessing the reasonableness of future cash flow forecasts for each CGU having regard to actual trends and known future orders. z Benchmarking assumptions: With assistance from our own valuation specialists we critically evaluated the risk adjusted discount rates, with regard to market observable data of risk free rates, returns on equity for comparable companies and company size premium. We also evaluated the assumptions for cost inflation and terminal growth rate, having regard to market data. z Comparing valuations: Comparing the sum of the discounted cash flows to the Group’s market capitalisation adjusted for debt to assess the reasonableness of the value in use calculations. z Sensitivity analysis: Performing break-even analysis on the assumptions noted above for CGUs where no impairment had been identified by the Group. z Assessing transparency: Assessing the Group’s disclosures about the sensitivity of the outcome of the impairment assessment to changes in key assumptions reflect the risks inherent in the valuation of goodwill. We also assessed the adequacy of the Group’s disclosures in respect of the changes made in identifying the Group’s CGUs. 114 www.nccgroup.trust Stock Code: NCC NCC AR2017 proof 8- Back.indd 114 25546.04 9 August 2017 4:01 PM Proof Six 09/08/2017 16:01:48 The risk Our response Accounting treatment Our procedures included: z Testing application: Agreeing a sample of costs to supporting documentation to understand the nature of the items and evaluate the appropriateness of their classification as capitalised costs, having regard to the relevant accounting standards. This included assessing whether major projects are technically feasible and commercially viable by reference to existing and future orders. z Personnel interviews: Corroborating the costs capitalised with information from the project teams regarding the nature of work performed in the year for which costs have been capitalised. z Historical comparison: Assessing the Group’s forecasting accuracy by comparing actual results in the period to what was previously forecast for the year for each significant project. Critically evaluating the assumptions for future customer sign up rates, having regard to actual rates in previous years. z Benchmarking assumptions: Critically evaluating the discount rates, revenue and cost inflation having regard for market observable data. z Assessing transparency: Considering the adequacy of the Group’s disclosures in respect of the capitalisation of software and development intangible assets. The Group capitalises internal and external costs in respect of software and development projects. The Group has also capitalised costs in relation to the finance and operational systems upgrades that represent substantial improvements to these assets. The Directors apply judgement in the classification of expenditure as capital in nature rather than ongoing operational expenditure. Forecast-based valuation Revenues have been falling short of business plans, due to a challenging trading environment. As a result, the Group has tested previously capitalised software and development costs for impairment. There remains a degree of uncertainty around whether expected revenues and profits will be realised and be sufficient to ensure the recoverability of the assets recognised on the balance sheet. Certain of the key inputs, specifically timing and amount of capital expenditure, customer sign up rates and related cost of sales, and discount rate applied to future cash flows require significant estimation and judgement. During the year ended 31 May 2017 the Group has impaired capitalised development costs by £7.7m in relation to certain specific projects where the generation of future economic benefits is no longer probable. Accounting treatment Our procedures included: The Group made two acquisitions during the year. Judgement is involved, in relation to the identification of assets and liabilities acquired, particularly separately recognised intangible assets. z Accounting analysis: Assessing the judgements taken around fair value adjustments having regard to relevant accounting standards. Considering the separately identified intangible assets acquired through gaining an understanding of the business acquired and applying our professional experience and judgement. Subjective valuation The most subjective area relates to the fair value valuation of assets and liabilities acquired, especially acquired intangibles such as customer contracts and relationships. z Methodology choice: Comparing the methodology used in the valuation of acquired intangibles using the expertise of our internal valuation specialists. z Benchmarking assumptions: Critically evaluating assumptions such as discount rates, growth rates and customer churn rates applied in the valuation of acquired intangibles, having regard to internal and external data. z Assessing transparency: Considering the adequacy of the Group’s disclosures in respect of the business combinations accounting. Capitalisation of software and development costs as intangible assets (Additions in the year: £7.4m; 2016: £8.8m) (Net book value: £19.2m; 2016: £21.9m) Refer to page 76 (Audit Committee Report), page 128 (accounting policy) and page 77 (financial disclosures). Business combinations accounting (Acquired intangibles £7.7m; 2016: acquired intangibles £25.4m) Refer to page 77 (Audit Committee Report), page 128 (accounting policy) and page 77 (financial disclosures). NCC Group plc Annual Report and Accounts for the year ended 31 May 2017 115 NCC AR2017 proof 8- Back.indd 115 25546.04 9 August 2017 4:01 PM Proof Six 09/08/2017 16:01:48 FINANCIAL STATEMENTS Independent auditor’s report TO THE MEMBERS OF NCC GROUP PLC ONLY 3. Our application of materiality and an overview of the scope of our audit Materiality for the Group financial statements as a whole was set at £0.74m (2016: £1.20m), determined with reference to a benchmark of Group profit before tax of £15.7m (normalised to exclude the individually significant items as disclosed in note 3), of which it represents 4.7 per cent (2016: 5.0 per cent). We reported to the Audit Committee any corrected or uncorrected identified misstatements exceeding £37,000 (2016: £60,000), in addition to other identified misstatements that warranted reporting on qualitative grounds. Of the Group’s 21 (2016: 20) reporting components, we subjected 11 (2016: 10) to audits for Group reporting purposes. We conducted reviews of financial information (including enquiry) at a further five (2016: seven) non- significant components as these components were not individually financially significant enough to require an audit for Group reporting purposes but a review was performed to provide further coverage over the Group’s results. The components within the scope of our work accounted for the following percentages of the Group’s results: 96 per cent of the Group’s profit before tax, 91 per cent of the Group’s profit before tax normalised to exclude individually significant items, 96 per cent of Group revenues and 97 per cent of Group total assets (2016: 99 per cent of the Group’s profit before tax, 96 per cent of the Group’s profit before tax normalised to exclude individually significant items, 97 per cent of Group revenues and 91 per cent of Group total assets). For the remaining five components, we performed analysis at an aggregated Group level to re-examine our assessment that there were no significant risks of material misstatement within these. The Group audit team instructed component auditors as to the significant areas to be covered, including the relevant risks detailed above and the information to be reported back. The Group audit team approved the component materialities, which ranged from £0.15m to £0.45m (2016: £0.25m to £0.50m), having regard to the mix of size and risk profile of Group profit before tax normalised for individually significant items £15.7m (2016: £23.9m) PBT normalised for ... Group materiality Materiality £0.74m (2016: £1.20m) £0.74m Whole financial statements materiality (2016: £1.20m) £0.45m Range of materiality at 11 components (£0.15m-£0.45m) (2016: £0.25m to £0.50m) £37,000 Misstatements reported to the Audit Committee (2016: £60,000) Group profit before tax normalised to exclude individually significant items Group revenue Group profit before tax Group total assets 8 29 96% (2016: 97%) 68 88 11 14 96% (2016: 99%) 16 10 97% (2016: 91%) 85 85 81 81 22 22 91% (2016 96%) 74 69 Full scope for Group audit purposes 2017 A review of financial information 2017 Full scope for Group audit purposes 2016 A review of financial information 2016 Residual components 116 www.nccgroup.trust Stock Code: NCC NCC AR2017 proof 8- Back.indd 116 25546.04 9 August 2017 4:01 PM Proof Six 09/08/2017 16:01:49 the Group across the components. The work on one of the 21 components (2016: none of the 20 components) was performed by component auditors and the rest by the Group audit team. The Group audit team performed procedures on the items excluded from normalised Group profit before tax. The Group audit team visited one (2016: n/a) component location in Delft, Netherlands (2016: n/a), including to assess the audit risk and strategy. Telephone conference meetings were also held with this component auditor. At this visit and in these meetings, the findings reported to the Group audit team were discussed in more detail, and any further work required by the Group audit team was then performed by the component auditor. 4. Our opinion on other matters prescribed by the Companies Act 2006 is unmodified In our opinion: — the part of the Directors’ Remuneration Report to be audited has been properly prepared in accordance with the Companies Act 2006; and — the information given in the Strategic Report and the Directors’ Report for the financial year is consistent with the financial statements. Based solely on the work required to be undertaken in the course of the audit of the financial statements and from reading the Strategic Report and the Directors’ Report: — we have not identified material misstatements in those reports; and — in our opinion, those reports have been prepared in accordance with the Companies Act 2006. 5. We have nothing to report on the disclosures of principal risks Based on the knowledge we acquired during our audit, we have nothing material to add or draw attention to in relation to: — the viability statement on page 53, concerning the principal risks, their management, and, based on that, the Directors’ assessment and expectations of the Group’s continuing in operation over the three years to May 2020; or — the disclosures in note 1 of the financial statements concerning the use of the going concern basis of accounting. 6. We have nothing to report in respect of the matters on which we are required to report by exception Under ISAs (UK and Ireland) we are required to report to you if, based on the knowledge we acquired during our audit, we have identified other information in the annual report that contains a material inconsistency with either that knowledge or the financial statements, a material misstatement of fact, or that is otherwise misleading. In particular, we are required to report to you if: — we have identified material inconsistencies between the knowledge we acquired during our audit and the Directors’ statement that they consider that the annual report and financial statements taken as a whole is fair, balanced and understandable and provides the information necessary for shareholders to assess the Group’s position and performance, business model and strategy; or — the Audit Committee Report does not appropriately address matters communicated by us to the Audit Committee. Under the Companies Act 2006 we are required to report to you if, in our opinion: — adequate accounting records have not been kept by the parent Company, or returns adequate for our audit have not been received from branches not visited by us; or — the parent Company financial statements and the part of the Directors’ Remuneration Report to be audited are not in agreement with the accounting records and returns; or — certain disclosures of Directors’ remuneration specified by law are not made; or — we have not received all the information and explanations we require for our audit. Under the Listing Rules we are required to review: — the Directors’ statements, set out on page 108, in relation to going concern and longer term viability; and — the part of the Corporate Governance Statement on page 60 relating to the Company’s compliance with the 11 provisions of the 2014 UK Corporate Governance Code specified for our review. We have nothing to report in respect of the above responsibilities. Scope and responsibilities As explained more fully in the Directors’ Responsibilities Statement set out on page 112, the Directors are responsible for the preparation of the financial statements and for being satisfied that they give a true and fair view. A description of the scope of an audit of financial statements is provided on the Financial Reporting Council’s website at www.frc.org.uk/auditscopeukprivate. This report is made solely to the Company’s members as a body and is subject to important explanations and disclaimers regarding our responsibilities, published on our website at www.kpmg.com/uk/auditscopeukco2014a, which are incorporated into this report as if set out in full and should be read to provide an understanding of the purpose of this report, the work we have undertaken and the basis of our opinions. Stuart Burdass (Senior Statutory Auditor) for and on behalf of KPMG LLP, Statutory Auditor Chartered Accountants One St Peter’s Square Manchester M2 3AE 18 July 2017 117 NCC Group plc Annual Report and Accounts for the year ended 31 May 2017 NCC AR2017 proof 8- Back.indd 117 25546.04 9 August 2017 4:01 PM Proof Six 09/08/2017 16:01:50 FINANCIAL STATEMENTS Consolidated income statement FOR THE YEAR ENDED 31 MAY 2017 Note 2, 6 Revenue Cost of sales Reclassification of costs 4 Gross profit Administration expenses Administration expenses comprises: General & administrative expenses Profit on sale of subsidiary companies Amortisation of acquired intangible assets Individually significant items Share based payments 6 11 3 22 Operating (loss)/profit 2, 4 Net interest expense Discount on acquisition consideration Net financing costs (Loss)/profit before taxation Taxation 7  8 Attributable to equity holders of the parent Company Earnings per share from continuing operations 10 2017 Total £m 2017 Adjustments (Note 3) £m 2017 Adjusted £m 244.5 (160.2) – 84.3 (137.7) (2.6)  2.3 – (0.3) 81.2 241.9 (157.9) – 84.0 2016 Total £m 209.1 (150.6) 21.2 79.7 (56.5) (68.3) (57.0) 0.5 (56.5) (41.4) 1.2 (1.2) (10.3) (71.0) (0.6) (53.4) (1.4) (0.5) (1.9) (55.3) (1.3) 10.3 71.0 0.6 80.9 – 0.5 0.5 81.4 (6.3) – – – 27.5 (1.4) – (1.4) 26.1 (7.6) – (6.8) (18.9) (1.2) 11.4 (1.4) (0.6) (2.0) 9.4 (3.1) 2016 Adjustments (Note 3) £m (4.9)  3.8 – (1.1) 29.4 2.5 – 6.8 18.9 1.2 28.3  –  0.6 0.6  28.9 (5.2)  2016 Adjusted £m 204.2 (146.8) 21.2 78.6 (38.9) (38.9) – – – – 39.7 (1.4) – (1.4) 38.3 (8.3) (56.6) 75.1 18.5 6.3 23.7  30.0 Basic earnings per share (20.4)p 2.5p 118 www.nccgroup.trust Stock Code: NCC NCC AR2017 proof 8- Back.indd 118 25546.04 9 August 2017 4:01 PM Proof Six 09/08/2017 16:01:50             Consolidated statement of comprehensive income FOR THE YEAR ENDED 31 MAY 2017 (Loss)/profit for the year Items that may be reclassified subsequently to profit or loss (net of tax) Foreign exchange translation differences Total comprehensive (loss)/income for the year, net of tax Attributable to: Equity holders of the parent 2017 £m (56.6) 17.9 (38.7) 2016 £m 6.3 9.7 16.0 (38.7) 16.0 NCC Group plc Annual Report and Accounts for the year ended 31 May 2017 119 NCC AR2017 proof 8- Back.indd 119 25546.04 9 August 2017 4:01 PM Proof Six 09/08/2017 16:01:50       FINANCIAL STATEMENTS Consolidated statement of financial position AT 31 MAY 2017 Notes £m 2017 £m Non-current assets Intangible assets Plant and equipment Investments Deferred tax assets Total non-current assets Current assets Trade and other receivables Inventories Cash and cash equivalents Total current assets Total assets Current liabilities Trade and other payables Provisions Consideration on acquisitions Deferred revenue Current tax payable Total current liabilities Non-current liabilities Deferred tax liability Provisions Consideration on acquisitions Interest bearing loans Total non-current liabilities Net assets Equity Issued capital Share premium Merger reserve Retained earnings Reserve for own shares Currency translation reserve 11 12 13 17 14 15 24 18 18 18 19 17 20 20 21, 22 23 267.6 18.3 0.4 4.2 66.7 1.1 12.3 29.7 1.5 12.9 35.6 3.0 14.2 3.5 2.1 56.0 2.8 148.0 42.3 (7.1) – 26.1 2016 £m £m 297.3 12.7 0.6 5.3 290.5 315.9 80.1 370.6 82.7 75.8 212.1 87.4 403.3 72.6 67.8 262.9 66.4 0.3 20.7 31.6 – 3.5 36.3 1.2 15.5 0.4 18.5 33.4 2.8 147.3 42.3 62.5 (0.2) 8.2 Total equity attributable to equity holders of the parent 212.1 262.9 These financial statements were approved by the Board of Directors on 18 July 2017 and were signed on its behalf by: Brian Tenner INTERIM CHIEF EXECUTIVE NCC Group plc 4627044 120 NCC AR2017 proof 8- Back.indd 120 25546.04 9 August 2017 4:01 PM Proof Six 09/08/2017 16:01:50 www.nccgroup.trust Stock Code: NCC Company statement of financial position AT 31 MAY 2017 Notes £m 2017 £m Non-current assets Goodwill Investments in subsidiaries Total non-current assets Current assets Intercompany receivables Cash and cash equivalents Total current assets Total assets Current liabilities Intercompany payables Total current liabilities Net assets Equity Issued capital Share premium Merger reserve Reserve for own shares Retained earnings Total equity 29 30 14 14.4 60.7 149.5 0.2 2016 £m £m – 87.5 75.1 87.5 130.2 – 149.7 224.8 130.2 217.7 10.6 207.1 18 – 10.6 – 224.8 23 2.8 148.0 42.3 – 31.7 2.8 147.3 42.3 (0.2) 14.9 224.8 207.1 These financial statements were approved by the Board of Directors on 18 July 2017 and were signed on its behalf by: Brian Tenner INTERIM CHIEF EXECUTIVE NCC Group plc 4627044 NCC Group plc Annual Report and Accounts for the year ended 31 May 2017 121 NCC AR2017 proof 8- Back.indd 121 25546.04 9 August 2017 4:01 PM Proof Six 09/08/2017 16:01:50 FINANCIAL STATEMENTS Consolidated statement of cash flows FOR THE YEAR ENDED 31 MAY 2017 Cash inflow for the year before changes in working capital Increase in trade and other receivables Decrease in trade and other payables Cash generated from operating activities before interest and tax Interest paid Income taxes paid Net cash generated from operating activities Cash flows from investing activities Purchase of plant and equipment Capital contribution for property, plant and equipment Proceeds from disposal of property Software and development expenditure Acquisition of businesses Cash acquired with subsidiaries Cash disposed of from sale of subsidiaries Proceeds from sale of subsidiaries Net cash generated in investing activities Cash flows from financing activities Purchase of own shares Proceeds from the issue of ordinary share capital Drawdown/(repayment) of borrowings Equity dividends paid Net cash used in financing activities Net (decrease)/increase in cash and cash equivalents Cash and cash equivalents at beginning of year Effect of foreign currency exchange rate changes Cash and cash equivalents at end of year Notes 24 12 20 11 16 6 6 9 24 2017 £m 33.8 (2.3) 0.2 31.7 (1.9) (1.8) 28.0 2016 £m 37.3 (15.1) 0.9 23.1 (2.0) (7.3) 13.8 (11.0) (4.6) 3.7 0.4 (7.4) (28.4) 1.9 (1.7) 1.7 – – (8.9) (78.5) 1.8 – – (40.8) (90.2) – 0.7 18.9 (12.8) 6.8 (6.0) 20.7 (2.4) 12.3 (0.1) 123.8 (33.5) (10.3) 79.9 3.5 16.4 0.8 20.7 122 www.nccgroup.trust Stock Code: NCC NCC AR2017 proof 8- Back.indd 122 25546.04 9 August 2017 4:01 PM Proof Six 09/08/2017 16:01:50 Consolidated statement of cash flows FOR THE YEAR ENDED 31 MAY 2017 Reconciliation of net change in cash and cash equivalents to movement in net debt (Decrease)/increase in cash and cash equivalents Change in net debt resulting from cashflows Effect of foreign currency on cashflows Foreign currency translation differences on borrowings Change in net debt during the year Net debt at start of year Net debt at end of year Net debt comprises Cash and cash equivalents Total borrowings Change in net debt during the year 2017 £m (6.0) (18.9) (2.4) (3.7) (31.0) (12.7) (43.7) 2017 £m 12.3 (56.0) (43.7) 2016 £m 3.5 33.5 0.9 – 37.9 (50.6) (12.7) 2016 £m 20.7 (33.4) (12.7) NCC Group plc Annual Report and Accounts for the year ended 31 May 2017 123 NCC AR2017 proof 8- Back.indd 123 25546.04 9 August 2017 4:01 PM Proof Six 09/08/2017 16:01:51 FINANCIAL STATEMENTS Company statement of cash flows FOR THE YEAR ENDED 31 MAY 2017 Cash flow from operating activities Profit for the year Adjustments for: Impairment of investments Equity dividends received Cash outflow for the year before changes in working capital (Increase)/decrease in intercompany balances Net cash generated from operating activities Cash flows from investing activities Equity dividends received Net cash used in investing activities Cash flows from financing activities Proceeds from the issue of ordinary share capital Equity dividends paid Net cash used in financing activities Net increase in cash and cash equivalents Cash and cash equivalents at beginning of year Cash and cash equivalents at end of year Notes 25 30 9 2017 £m 2016 £m 29.0 8.8 13.0 (42.0) – 12.3 12.3 – – 0.7 (12.8) (12.1) 0.2 – 0.2 – (8.8) – (122.4) (122.4) 8.8 8.8 123.8 (10.3) 113.5 – 0.1 – 124 www.nccgroup.trust Stock Code: NCC NCC AR2017 proof 8- Back.indd 124 25546.04 9 August 2017 4:01 PM Proof Six 09/08/2017 16:01:51 Statements of changes of equity FOR THE YEAR ENDED 31 MAY 2017 Group Issued share capital £m Share premium £m Merger reserve £m Currency translation reserve £m Reserve for own shares £m Retained earnings £m Balance at 1 June 2015 2.3 24.0 42.3 (1.5) (0.5) Profit for the year Adjustment to currency translation reserve from sale of subsidiary companies Foreign currency translation differences Total comprehensive income for the year Transactions with owners recorded directly in equity Dividends to equity shareholders Share based payment transactions Current and deferred tax on share based payments Shares issued Purchase of own shares Total contributions by and distributions to owners Balance at 31 May 2016 – – – – – – – 0.5 – 0.5 2.8 – – – – – – – 123.3 – 123.3 147.3 – – – – – – – – – – – 0.1 9.6 9.7 – – – – – – 42.3 8.2 Total £m 131.7 6.3 0.1 9.6 65.1 6.3 – – 6.3 16.0 (10.3) (10.3) 1.1 0.6 – 1.1 0.6 123.8 – – – – – – – – 0.3 (0.3) – 0.3 (0.2) (8.9) 115.2 62.5 262.9 Issued share capital £m Share premium £m Merger reserve £m Currency translation reserve £m Reserve for own shares £m Retained earnings £m Total £m Balance at 1 June 2016 (Loss)/profit for the year Foreign currency translation differences Total comprehensive income for the year Transactions with owners recorded directly in equity Dividends to equity shareholders Share based payment transactions Current and deferred tax on share based payments Shares issued Purchase of own shares Total contributions by and distributions to owners 2.8 147.3 42.3 – – – – – – – – – – – – – – – 0.7 – 0.7 – – – – – – – – – 8.2 – 17.9 17.9 – – – – – – Balance at 31 May 2017 2.8 148.0 42.3 26.1 (0.2) 62.5 262.9 – – – – – – – 0.2 0.2 – (56.6) (56.6) – 17.9 (56.6) (38.7) (12.8) (12.8) 0.2 (0.4) – – 0.2 (0.4) 0.7 0.2 (13.0) (12.1) (7.1) 212.1 NCC Group plc Annual Report and Accounts for the year ended 31 May 2017 125 NCC AR2017 proof 8- Back.indd 125 25546.04 9 August 2017 4:01 PM Proof Six 09/08/2017 16:01:51 FINANCIAL STATEMENTS Statements of changes of equity FOR THE YEAR ENDED 31 MAY 2017 Company Balance at 1 June 2015 Profit for the year Foreign currency translation differences Total comprehensive income for the year Transactions with owners recorded directly in equity Dividends to equity shareholders Increase in subsidiary investment for share based charges Shares issued Purchase of own shares Total contributions by and distributions to owners Balance at 31 May 2016 Balance at 1 June 2016 Profit for the year Foreign currency translation differences Total comprehensive income for the year Transactions with owners recorded directly in equity Dividends to equity shareholders Increase in subsidiary investment for share based charges Shares issued Purchase of own shares Total contributions by and distributions to owners Share capital £m Share premium £m Merger reserve £m Reserve for own shares £m Retained earnings £m 2.3 24.0 42.3 (0.5) 15.6 – – – – – 0.5 – 0.5 2.8 – – – – – 123.3 – 123.3 147.3 – – – – – – – – – – – – – – 0.3 0.3 42.3 (0.2) 14.9 Share capital £m Share premium £m Merger reserve £m Reserve for own shares £m Retained earnings £m 2.8 147.3 42.3 (0.2) (10.3) (10.3) Total £m 83.7 8.8 – 8.8 1.1 123.8 – 114.6 207.1 Total £m 207.1 29.0 – 8.8 – 8.8 1.1 – (0.3) (9.5) 14.9 29.0 – – – – – – – – – – – – – – 0.7 – 0.7 – – – – – – – – – – – – – – 0.2 0.2 – 29.0 29.0 (12.8) (12.8) 0.6 – 0.6 0.7 0.2 (12.2) (11.3) 31.7 224.8 Balance at 31 May 2017 2.8 148.0 42.3 126 www.nccgroup.trust Stock Code: NCC NCC AR2017 proof 8- Back.indd 126 25546.04 9 August 2017 4:01 PM Proof Six 09/08/2017 16:01:51 Notes to the accounts FOR THE YEAR ENDED 31 MAY 2017 1 Accounting policies Basis of preparation NCC Group plc (“the Company”) is a company incorporated in the UK. The Group financial statements consolidate those of the Company and its subsidiaries (together referred to as the “Group”). The parent Company financial statements present information about the Company as a separate entity and not about the Group. These financial statements have been approved for issue by the Board of Directors on 18 July 2017. Both the parent Company and the Group financial statements have been prepared in accordance with International Financial Reporting Standards as adopted by the EU (“Adopted IFRS”). On publishing the parent Company financial statements here together with the Group financial statements, the Company is taking advantage of the exemption in s408 of the Companies Act 2006 not to present its individual income statement and related notes that form a part of these approved financial statements. The accounting policies set out below have, unless otherwise stated, been applied consistently to all periods presented in these Group financial statements. Basis of measurement The consolidated financial statements have been prepared on the historical cost basis except for consideration payable on acquisitions that is measured at fair value. Functional and presentation currency The Group and Company financial statements are presented in millions of Pounds Sterling (£m) and all values are rounded to one decimal place except when otherwise indicated. Going concern The Group’s business activities, together with the factors likely to affect its future development, performance and position are set out in the Strategic Report on pages 16 to 57. The financial position of the Group, its cash flows, liquidity position and borrowing facilities are described in the Business and Financial Review on pages 2 to 15. In addition, note 21 to the financial statements includes the Group’s policies and processes for managing its capital, its financial risk management objectives, details of its financial instruments and its exposures to credit risk and liquidity risk. The Group funds its strategic acquisitions and meets its day-to-day working capital requirements via a multi-currency revolving credit facility of £80.0m, a £25.0m multi-currency term loan that amortises by £2.5m every six months and an overdraft of £5m. At 31 May 2017, the amount drawn down under the facilities was £56.0m. This facility was agreed in November 2015 and is due for renewal in November 2020. The Directors have reviewed the trading and cash flow forecasts of the Group as part of their going concern assessment and have taken into account reasonable downside sensitivities which reflect uncertainties in the current operating environment. The possible changes in trading performance show that the Group is able to operate within the level of the banking facilities and as a consequence, the Directors believe that the Group is well placed to manage its business risks successfully. After making enquiries, the Directors have a reasonable expectation that the Company and the Group have adequate resources to continue in operational existence for a period of at least 12 months. Accordingly, they continue to adopt the going concern basis in preparing the annual report and accounts. New standards No new standards have been adopted for the first time that affect the reported results or financial position. New IFRS and amendments to IAS and interpretations At the date of authorisation of these financial statements, the following Standards and Interpretations which have not been applied in these financial statements were in issue but not yet effective (and in some cases had not yet been adopted by the EU). The Group does not intend to early adopt these standards: z IFRS 15 Revenue from Contracts with Customers will be effective from the year ending 31 May 2019 onwards. Management continues to assess the likely impact of this standard. z IFRS 9 Financial Instruments – Recognition and Measurement will be effective from the year ending 31 May 2019 onwards. Management is still considering the impact of this new standard. IFRS 16 Leases will be effective from the year ending 31 May 2020 onwards and the impact on the financial statements will be significant to NCC Group plc. IFRS 16 requires lessees to recognise a lease liability reflecting future lease payments and a right-of-use asset for all lease contracts. Therefore, the substantial majority of the Group’s operating lease commitments (some £56.4m on an undiscounted basis, as shown in note 26) would be brought on to the balance sheet and amortised and depreciated separately. There will be no impact on cash flows although the presentation of the cash flow statement will change significantly. Management is still considering the impact of this new standard and is as yet unable to quantify its likely impact. NCC Group plc Annual Report and Accounts for the year ended 31 May 2017 127 NCC AR2017 proof 8- Back.indd 127 25546.04 9 August 2017 4:01 PM Proof Six 09/08/2017 16:01:51 FINANCIAL STATEMENTS Notes to the accounts FOR THE YEAR ENDED 31 MAY 2017 1 Accounting policies (continued) Business combinations Business combinations are accounted for by applying the acquisition method at the acquisition date, which is the date on which control is transferred to the Group. The Group controls an entity when the Group is exposed to, or has rights to, variable returns from its involvement with the entity and has the ability to affect those returns through its power over the entity. Acquisitions on or after 1 June 2010 For acquisitions on or after 1 June 2010, the Group measures goodwill at the acquisition date as: z the fair value of the consideration transferred; plus z the recognised amount of any non-controlling interests in the acquiree; plus z if the business combination is achieved in stages, the fair value of the existing equity interest in the acquiree; less z the net recognised amount (generally fair value) of the identifiable assets acquired and liabilities assumed. When the excess is negative, a bargain purchase gain is recognised immediately in profit or loss. The consideration transferred does not include amounts related to the settlement of pre-existing relationships. Such amounts generally are recognised in the income statement. Costs related to the acquisition, other than those associated with the issue of debt or equity securities, are expensed as incurred. Any deferred or contingent consideration payable is recognised at fair value at the acquisition date. If the contingent consideration is classified as equity, it is not remeasured and settlement is accounted for within equity. Otherwise, subsequent changes to the fair value of contingent consideration are recognised in the income statement. On a transaction-by-transaction basis, the Group elects to measure non-controlling interests either at its fair value or at its proportionate interest in the recognised amount of the identifiable net assets of the acquiree at the acquisition date. Acquisitions before 1 June 2010 For acquisitions before 1 June 2010, goodwill represents the excess of the cost of the acquisition over the Group’s interest in the recognised amount (generally fair value) of the identifiable assets, liabilities and contingent liabilities of the acquiree. When the excess was negative, a bargain purchase gain was recognised immediately in profit or loss. Transaction costs, other than those associated with the issue of debt or equity securities, that the Group incurred in connection with business combinations were capitalised as part of the cost of the acquisition. Contingent consideration on business combinations was recognised only to the extent that it could be reliably estimated and it was probable that the consideration would be paid. Any subsequent changes to the carrying value of the contingent consideration were recognised as adjustments to goodwill. Subsidiaries Subsidiaries are entities controlled by the Group. The financial statements of subsidiaries are included in the consolidated financial statements from the date that control commences until the date that control ceases. Intangible assets and goodwill Goodwill represents amounts arising on acquisition of subsidiaries. In respect of business acquisitions that have occurred since 1 June 2004, goodwill represents the difference between the cost of the acquisition and the fair value of the net identifiable assets acquired including identifiable intangible assets. Identifiable intangibles are those which can be sold separately or which arise from legal rights regardless of whether those rights are separable. In respect of acquisitions prior to 1 June 2004, goodwill is included at its deemed cost, which represents the amount recorded under UK GAAP at 31 May 2004 which was broadly comparable, save that only separable intangibles were recognised and goodwill was amortised. Goodwill is stated at cost less any accumulated impairment losses. Goodwill is allocated to cash-generating units and is not amortised but is tested annually for impairment. In respect of equity accounted investees, the carrying amount of goodwill is included in the carrying amount of the investment in the investee. Research and development Expenditure on research activities is recognised in the income statement as an expense as incurred. Expenditure on development activities is capitalised as “development costs” if the product or process is technically and commercially feasible and the Group intends, has the technical ability and has sufficient resources to complete development, future economic benefits are probable and if the Group can measure reliably the expenditure attributable to the intangible asset during its development. Development activities involve a plan or design for the production of new or substantially improved products or processes. 128 www.nccgroup.trust Stock Code: NCC NCC AR2017 proof 8- Back.indd 128 25546.04 9 August 2017 4:01 PM Proof Six 09/08/2017 16:01:51 Software costs The Group capitalises “software costs” in accordance with the criteria of IAS 38. Software costs comprise two elements, IT licences for periods of one year or more, and the third party and internal employee time costs for internal system developments. Capitalised costs are initially measured at cost and amortised on a straight-line basis over the licence term or the period for which the developed system is expected to be in use as a business platform. The expenditure capitalised includes the cost of materials, direct labour, overhead costs that are directly attributable to preparing the asset for its intended use and capitalised borrowing costs. Other development expenditure is recognised in the income statement as an expense as incurred. Capitalised development expenditure is stated at cost less accumulated amortisation and less accumulated impairment losses. Other intangible assets Expenditure on internally generated goodwill is recognised in the income statement as an expense as incurred. Other intangible assets that are acquired by the Group are stated at cost less accumulated amortisation and less accumulated impairment losses. Subsequent expenditure Subsequent expenditure is capitalised only when it increases the future economic benefits embodied in the specific asset to which it relates. All other expenditure, including expenditure on internally generated goodwill, is recognised in the income statement as an expense as incurred. Amortisation Amortisation is charged to the income statement on a straight-line basis over the estimated useful economic lives of intangible assets unless such lives are indefinite. Intangible assets with an indefinite useful life and goodwill are systematically tested for impairment at each balance sheet date. Other intangibles are amortised from the date they are available for use. The estimated useful lives are as follows: Acquired customer – between three and ten years contracts and relationships Software – between one and seven years Capitalised development costs – between three and ten years Impairment excluding deferred tax assets Financial assets (including receivables) A financial asset not carried at fair value through profit or loss is assessed at each reporting date to determine whether there is objective evidence that it is impaired. A financial asset is impaired if objective evidence indicates that a loss event has occurred after the initial recognition of the asset, and that the loss event had a negative effect on the estimated future cash flows of that asset that can be estimated reliably. An impairment loss in respect of a financial asset measured at amortised cost is calculated as the difference between its carrying amount and the present value of the estimated future cash flows discounted at the asset’s original effective interest rate. Interest on the impaired asset continues to be recognised through the unwinding of the discount. When a subsequent event causes the amount of impairment loss to decrease, the decrease in impairment loss is reversed through profit or loss. Non-financial assets The carrying amounts of the Group’s non-financial assets, other than deferred tax assets, are reviewed at each reporting date to determine whether there is any indication of impairment. If any such indication exists, then the asset’s recoverable amount is estimated. For goodwill, and intangible assets that have indefinite useful lives or that are not yet available for use, the recoverable amount is estimated each year at the same time. The recoverable amount of an asset or cash-generating unit is the greater of its value in use and its fair value less costs to sell. In assessing value in use, the estimated future cash flows are discounted to their present value using a pre-tax discount rate that reflects current market assessments of the time value of money and the risks specific to the asset. For the purpose of impairment testing, assets that cannot be tested individually are grouped together into the smallest group of assets that generates cash inflows from continuing use that are largely independent of the cash inflows of other assets or groups of assets (the “cash-generating unit”). The goodwill acquired in a business combination, for the purpose of impairment testing, is allocated to cash-generating units, (“CGUs”). Subject to an operating segment ceiling test, for the purposes of goodwill impairment testing, CGUs to which goodwill has been allocated are aggregated so that the level at which impairment is tested reflects the lowest level at which goodwill is monitored for internal reporting purposes. Goodwill acquired in a business combination is allocated to groups of CGUs that are expected to benefit from the synergies of the combination. An impairment loss is recognised if the carrying amount of an asset or its CGU exceeds its estimated recoverable amount. Impairment losses are recognised in the income statement. Impairment losses recognised in respect of CGUs are allocated first to reduce the carrying amount of any goodwill allocated to the units, and then to reduce the carrying amounts of the other assets in the unit (group of units) on a pro rata basis. An impairment loss in respect of goodwill is not reversed. In respect of other assets, impairment losses recognised in prior periods are assessed at each reporting date for any indications that the loss has decreased or no longer exists. An impairment loss is reversed if there has been a change in the estimates used to determine the recoverable amount. An impairment loss is reversed only to the extent that the asset’s NCC Group plc Annual Report and Accounts for the year ended 31 May 2017 129 NCC AR2017 proof 8- Back.indd 129 25546.04 9 August 2017 4:01 PM Proof Six 09/08/2017 16:01:52 FINANCIAL STATEMENTS Notes to the accounts FOR THE YEAR ENDED 31 MAY 2017 1 Accounting policies (continued) carrying amount does not exceed the carrying amount that would have been determined, net of depreciation or amortisation, if no impairment loss had been recognised. Related party transactions Details of related party transactions are set out in note 28 to these financial statements. Plant and equipment Plant and equipment assets are carried at cost less accumulated depreciation and any recognised impairment in value. To the extent that borrowing costs relate to the acquisition, construction or production of a qualifying asset, borrowing costs are capitalised as part of the cost of that asset. Depreciation is charged to the income statement on a straight line basis over the estimated useful economic lives of each part of an item of plant and equipment as follows: Computer equipment Plant and equipment Furniture Fixtures and fittings Motor vehicles – between thee and five years – between thee and five years – between thee and five years – term of the lease – four years Plant and equipment is also tested for impairment whenever there is an indication of potential impairment. Investments Investments in subsidiaries are carried at cost less impairment. Investments in property and unlisted shares are carried at cost less impairment which is based on the fair value at acquisition. Inventory Inventory is held at the lower of cost or net realisable value. Revenue recognition Revenue represents the value of goods and services provided during the period, excluding VAT and similar taxes. The application of this policy in each of the operating segments is as follows: Assurance services The results of partially completed contracts, whether fixed price or on a time and materials basis, are recognised on a percentage completion basis according to the number of days worked in comparison to the total contracted number of days by including the profit or loss earned on work completed to the balance sheet date. Provisions are made for any losses on uncompleted contracts expected to be incurred after the balance sheet date. For certain Assurance services, a higher proportion of the total costs can be incurred in the first month due to set-up costs . Where this is the case, a greater proportion of the associated revenue is also recognised at the same time as the costs, with the remainder deferred over the life of the contract. Escrow and website monitoring Fees are recognised on completion of the services attributable to the initial set-up of a new project, contract and also in respect of verification services. Maintenance and escrow agreement revenue is deferred and released to the income statement on a straight-line basis over the life of the related agreement, on the basis that the performance is deemed to fall evenly over the contract period. Domain services Trademark Clearinghouse (“TMCH”) fees are deferred and released to the income statement on a straight-line basis over the life of the related agreement. Agreements are for durations of one, three or five years. Domain name registry fees are recognised on a straight-line basis over the period specified in the customer agreement. Revenue from the contracted sale of domain names is recognised when the full title and rights to the domain name have transferred to the customer. This revenue recognition policy applies to the Open Registry Group which was disposed of during the financial year. Sale of products Revenue is recognised when the significant risks and rewards of ownership of the products have passed to the buyer, which is considered to be upon delivery under the contractual terms, and when the amount of revenue can be measured reliably. Determination and presentation of operating segments The Group determines and presents operating segments based on the information that is provided to the Board, whom acts as the Group’s chief operating decision-maker (“CODM”) in order to assess performance and to allocate resources. An operating segment is a component of the Group that engages in business activities from which it may earn revenues and incur expenses, including revenues and expenses that relate to transactions with any of the Group’s other components. An operating segment’s results are reviewed regularly by the CODM to make decisions about resources to be allocated to the segment and to assess its performance. The Group reports its business in two key segments: The Escrow division and the Assurance division. Within the Escrow division we manage some aspects of the day-to-day business on a geographical basis and this allows us to disclose revenue and operating profit for those geographies. However, while we can manage and disclose some aspects of those as individual operating segments, they are all managed under the Escrow division’s senior executive team. That team takes the decisions on resource allocation, product development, marketing and areas for focus and investment. For this reason, the Escrow division is regarded as the appropriate reporting segment with additional operating segment disclosures presented to give the user of the accounts a further level of granularity. 130 www.nccgroup.trust Stock Code: NCC NCC AR2017 proof 8- Back.indd 130 25546.04 9 August 2017 4:01 PM Proof Six 09/08/2017 16:01:52 Within the Assurance division, the business has historically differentiated between its core cyber security and consulting activities on the one hand and on the other its Web Performance activity and its Software Testing activity. However, similar to Escrow, the different activities came together under an Assurance management team for strategic and resource allocation decision-making. The new Target Operating Model for the Assurance division going forward confirms that clustering of activities around a central theme or “golden thread” of cyber security. Individually significant items The Group separately identifies items as individually significant if the item is considered unusual by its nature or scale, and is of such significance that separate disclosure is relevant to understanding the Group’s financial performance and therefore requires separate presentation in the financial statements in order to fairly present the financial performance of the Group. Such items are referred to as “individually significant items” and are described in note 3. Foreign currencies Transactions in foreign currencies are recorded using the appropriate monthly exchange rate ruling at the date of the transaction. Monetary assets and liabilities denominated in foreign currencies are retranslated using the exchange rate ruling at the balance sheet date and the gains or losses on translation are included in the income statement. The assets and liabilities of overseas subsidiaries denominated in foreign currencies are retranslated at the exchange rate ruling at the balance sheet date. The income statements of overseas subsidiary undertakings are translated at the weighted average exchange rates for the financial year. Gains and losses arising on the retranslation of opening net assets are taken to the currency translation reserve. They are released to the income statement upon disposal of the subsidiary to which they relate. Operating lease payments Operating lease rentals are charged to the income statement on a straight-line basis over the period of the lease. Lease incentives received are recognised in the income statement as an integral part of the total lease expense, over the term of the lease. Employee benefits – defined contribution plans The Group operates a defined contribution pension scheme. The assets of the scheme are kept separate from those of the Group in an independently administered fund. The amount charged as an expense in the income statement represents the contributions payable to the scheme in respect of the accounting period. Short-term benefits Short-term employee benefit obligations are measured on an undiscounted basis and are expensed as the related service is provided. A liability is recognised for the amount expected to be paid under short-term cash bonus or profit-sharing plans if the Group has a present legal or constructive obligation to pay this amount as a result of past service provided by the employee and the obligation can be estimated reliably. Share based payment transactions Share based payments in which the Group receives goods or services as consideration for its own equity instruments are accounted for as equity-settled share based payment transactions, regardless of how the equity instruments are obtained by the Group. They are treated as an adjusting item in arriving at the non-GAAP “Adjusted” Metrics. The grant date fair value of share based payment awards granted to employees is recognised as an employee expense, with a corresponding increase in equity, over the period that the employees become unconditionally entitled to the awards. The fair value of the options granted is measured using an option valuation model, taking into account the terms and conditions upon which the options were granted. The amount recognised as an expense is adjusted to reflect the actual number of awards for which the related service and non- market vesting conditions are expected to be met, such that the amount ultimately recognised as an expense is based on the number of awards that do meet the related service and non-market performance conditions at the vesting date. For share based payment awards with non-vesting conditions, the grant date fair value of the share based payment is measured to reflect such conditions and there is no true-up for differences between expected and actual outcomes. Share based payment transactions in which the Group receives goods or services by incurring a liability to transfer cash or other assets that is based on the price of the Group’s equity instruments are accounted for as cash-settled share based payments. The fair value of the amount payable to employees is recognised as an expense, with a corresponding increase in liabilities, over the period in which the employees become unconditionally entitled to payment. The liability is remeasured at each balance sheet date and at settlement date. Any changes in the fair value of the liability are recognised as personnel expense in profit or loss. Where the Company grants options over its own shares to the employees of a subsidiary it recognises in its individual financial statements, an increase in the cost of investment in that subsidiary equivalent to the equity-settled share based payment charge is recognised in respect of that subsidiary in its consolidated financial statements with the corresponding credit being recognised directly in equity. NCC Group plc Annual Report and Accounts for the year ended 31 May 2017 131 NCC AR2017 proof 8- Back.indd 131 25546.04 9 August 2017 4:01 PM Proof Six 09/08/2017 16:01:52 FINANCIAL STATEMENTS Notes to the accounts FOR THE YEAR ENDED 31 MAY 2017 1 Accounting policies (continued) Interest bearing borrowings Interest bearing borrowings are recognised initially at fair value less attributable transaction costs. Subsequent to initial recognition, interest bearing borrowings are stated at amortised cost with any difference between cost and redemption value being recognised in the income statement over the period of the borrowings on an effective interest basis. Net financing costs Net financing costs comprise interest payable and interest receivable on funds invested. Interest income and interest payable are recognised in the income statement as they accrue, using the effective interest method. Interest is capitalised when interest charges are incurred in relation to the purchase of capitalised assets. To the extent that borrowing costs relate to the acquisition, construction or production of a qualifying asset, borrowing costs are capitalised as part of the cost of that asset. Dividend income is recognised in the income statement on the date the entity’s right to receive payments is established. Taxation Tax on the profit or loss for the year comprises current and deferred taxation. Tax is recognised in the income statement except to the extent that it relates to items recognised directly in equity, in which case it is recognised in equity. Current taxation Current tax is the expected tax payable or receivable on the taxable income or loss for the year, using tax rates enacted or substantively enacted at the balance sheet date, and any adjustment to tax payable in respect of previous years. Deferred taxation Deferred tax is provided on temporary differences between the carrying amounts of assets and liabilities for financial reporting purposes and the amounts used for taxation purposes. The following temporary differences are not provided for: the initial recognition of goodwill; the initial recognition of assets or liabilities that affect neither accounting nor taxable profit other than in a business combination, and differences relating to investments in subsidiaries to the extent that they will probably not reverse in the foreseeable future. The amount of deferred tax provided is based on the expected manner of realisation or settlement of the carrying amount of assets and liabilities, using tax rates enacted or substantively enacted at the balance sheet date. A deferred tax asset is recognised only to the extent that it is probable that future taxable profits will be available against which the temporary difference can be utilised. Intra-group financial instruments Where the Company enters into financial guarantee contracts to guarantee the indebtedness of other companies within the Group, the Company considers these to be insurance arrangements and accounts for them as such. In this respect the Company treats the guarantee contract as a contingent liability until such time as it becomes probable that the Company will be required to make a payment under the guarantee. Trade and other receivables Trade and other receivables are stated at their nominal amount less impairment losses. Cash and cash equivalents Cash and cash equivalents comprise of cash in hand and deposits repayable on demand. Bank overdrafts that are repayable on demand form part of the Group’s cash management and are included as a component of cash and cash equivalents for the purpose only of the statement of cash flows. Treasury shares NCC Group plc shares held by the Group are deducted from equity as “treasury shares” and are recognised at cost. Consideration received for the sale of such shares is also recognised in equity, with any difference between the proceeds from sale and the original cost being taken to reserves. No gain or loss is recognised in the income statement on the purchase, sale, issue or cancellation of equity shares. Use of estimates and judgements The preparation of financial statements requires management to exercise judgement in applying the Group’s accounting policies. It also requires the use of estimates and assumptions that affect the reported amounts of assets, liabilities, income and expenses. Actual results may differ from these estimates. Estimates and underlying assumptions are reviewed on an ongoing basis, with revisions recognised in the period in which the estimates are revised and in any future periods affected. The areas involving a higher degree of judgement or complexity are set out below and in more detail in the related notes: Impairment of goodwill The Group has significant balances relating to goodwill at 31 May 2017 as a result of acquisitions of businesses. The carrying value of goodwill at 31 May 2017 is £198.7m (2016: £224.3m) following the impairment recorded during the year. Goodwill balances are tested annually for impairment. Tests for impairment are primarily based on the calculation of a value in use for each cash-generating unit. This involves the preparation of discounted cash flow projections, which require an estimate of both future operating cash flows and an appropriate risk adjusted discount rate. Such estimates are inherently subjective and can have a material impact on the 132 www.nccgroup.trust Stock Code: NCC NCC AR2017 proof 8- Back.indd 132 25546.04 9 August 2017 4:01 PM Proof Six 09/08/2017 16:01:52 result of the impairment test. A cash-generating unit (CGU) is the smallest identifiable group of assets that generate cash inflows that are largely independent of the cash inflows from other assets or groups of assets. Identification of a CGU does involve judgement. The Directors have made judgements in determining the cash- generating units (“CGUs”) within the Group and in allocating goodwill to these CGUs. As a result of the strategic review undertaken during the year, management have reconsidered the cash-generating units within the Group, this is discussed further in note 11. Capitalisation of development costs Development activities involve a plan or design for the production of new or substantially improved products or processes. Judgement is required in determining whether the project is technically and commercially feasible; estimation is required in assessing the future economic benefit. Such estimates are inherently subjective and can have a material impact on determining the viability of the project and ultimately whether the costs should be capitalised. For projects where development costs have been capitalised, impairment assessments require an estimate of both future operating cash flows and an appropriate risk adjusted discount rate. Such estimates are inherently subjective and can have a material impact on the result of the impairment test. Business combinations During the current and prior year the Group has made a number of significant acquisitions. The acquisition price in some cases includes an element of contingent consideration; the assessment of the fair value of the contingent consideration requires estimating the fair value based on the expected future cash outflow. Such estimates are inherently subjective and can have a material impact on the reported values. For each acquisition, judgement is required in determining the separately identifiable intangible assets acquired and estimation is used to determine the fair value of the separately identifiable assets. Estimation involves the preparation of discounted cash flow projections, which require an estimate of both future operating cash flows and an appropriate risk adjusted discount rate to arrive at the fair value. Such estimates are inherently subjective and can have a material impact on the reported values. In addition, the Group has sold its interest in the Open Registry Group. An element of the consideration to be received is contingent upon the future performance of the business. The assessment of the fair value of the contingent consideration requires estimating the fair value based on the expected future cash inflow. Such estimates are inherently subjective and can have a material impact on the reported values. 2 Segmental information The Group is organised into the following two (2016: three) reporting segments, Escrow and Assurance, each of which is separately reported. While revenue and profitability are monitored by individual business units within these operational segments, it is only at the operating segment level that resource allocation decisions are made. Performance is measured based on segment profit, which comprises segment operating profit excluding amortisation of intangible assets, share based payment charges and exceptional items. Interest and tax are not allocated to business segments and there are no intra-segment sales. NCC Group plc Annual Report and Accounts for the year ended 31 May 2017 133 NCC AR2017 proof 8- Back.indd 133 25546.04 9 August 2017 4:01 PM Proof Six 09/08/2017 16:01:52 FINANCIAL STATEMENTS Notes to the accounts FOR THE YEAR ENDED 31 MAY 2017 2 Segmental information (continued) Segmental analysis 2017 Revenue Cost of sales Gross profit G&A before adjustments Operating profit Adjustments* Adjusted operating profit Depreciation of PP&E Amortisation of software and capitalised development costs Adjusted EBITDA Escrow £m Assurance £m Domain £m 37.2 (2.0) 35.2 (17.1) 18.1 1.0 19.1 0.2 – 19.3 204.7 (155.9) 48.8 (104.4) (55.6) 72.2 16.6 2.9 1.7 21.2 2.6 (2.3) 0.3 (4.5) (4.2) 4.2 – – – – * Adjustments includes the results of Domain Services, individually significant items and other adjustments (note 3). Segmental analysis 2016 Revenue Cost of sales Gross profit G&A before adjustments Operating profit Adjustments* Adjusted operating profit Depreciation of PP&E Depreciation of software and capitalised development costs Adjusted EBITDA Escrow £m Assurance £m Domain £m 35.3 (1.7) 33.6 (14.4) 19.2 0.9 20.1 0.2 – 20.3 168.9 (123.9) 45.0 (30.7) 14.3 11.5 25.8 2.0 0.7 28.5 4.9 (3.8) 1.1 (17.2) (16.1) 15.6 (0.5) – – (0.5) There are no customer contracts which account for more than 10 per cent of segment revenue. * Adjustments includes the results of Domain Services, individually significant items and other adjustments (note 3). Head Office £m – – – (11.7) (11.7) 3.5 (8.2) 2.1 1.8 (4.3) Head Office £m – – – (6.0) (6.0) 0.3 (5.7) 1.5 0.9 (3.3) Group £m 244.5 (160.2) 84.3 (137.7) (53.4) 80.9 27.5 5.2 3.5 36.2 Group £m 209.1 (129.4) 79.7 (68.3) 11.4 28.3 39.7 3.7 1.6 45.0 134 www.nccgroup.trust Stock Code: NCC NCC AR2017 proof 8- Back.indd 134 25546.04 9 August 2017 4:01 PM Proof Six 09/08/2017 16:01:52 Revenue by geographical destination UK Rest of Europe Rest of the World Total revenue 2017 £m 2016 £m 140.1 37.5 66.9 244.5 122.2 34.1 52.8 209.1 3 Individually significant items Individually significant items and other adjustments have been presented in a separate column in the consolidated income statement to provide users of the accounts with a reconciliation to the Group’s separately reported non-GAAP results. The Group separately identifies items as “individually significant items”. As permitted by IAS 1 Presentation of financial statements, an item is disclosed separately if it is considered unusual by its nature or scale, and is of such significance that separate disclosure is required in the financial statements in order to fairly present the financial performance of the Group. Adjustments Domain Services results (note 6) Profit on sale of subsidiary companies (note 6) Amortisation of acquired intangible assets (note 11) Individually significant items (see below) Share based payments (note 22) Discount on acquisition consideration (note 7) Adjustment to loss before taxation 2017 £m 0.2 (1.2) 10.3 71.0 0.6 0.5 81.4 2016 £m 1.4 – 6.8 18.9 1.2 0.6 28.9 NCC Group plc Annual Report and Accounts for the year ended 31 May 2017 135 NCC AR2017 proof 8- Back.indd 135 25546.04 9 August 2017 4:01 PM Proof Six 09/08/2017 16:01:52 FINANCIAL STATEMENTS Notes to the accounts FOR THE YEAR ENDED 31 MAY 2017 3 Individually significant items (continued) The revenue, cost of sales and general and administrative expenses presented as adjustments in the current and prior year relate to Domain services (note 6). The profit on sale of subsidiary companies relates to the disposal of the Open Registry Group in January 2017 for a net profit £1.2m (note 6). Individually significant items Goodwill impairment: – Fox-IT – Accumuli – Web Performance – Open Registry Intangible asset impairment: – Capitalised development costs – Software costs Impairment of intangible assets Acquisition related costs Adjustments to consideration Restructuring costs Onerous property leases Vacation pay Impairment of fixtures and fittings Other Total – individually significant items 2017 £m 2016 £m (24.3) (24.3) (5.7) – (5.7) (2.0) (62.0) (0.8) (2.9) (1.3) (1.3) (1.8) (0.9) (9.0) (71.0) – – – (11.9) (6.8) – (18.7) (2.3) 4.7 (2.6) – – – (0.2) (18.9) Acquisition related costs of £0.8m (2016: £2.3m) consist of fees incurred in relation to the acquisitions of Payment Software Company Inc. on 28 September 2016 and Virtual Security Research LLC on 11 November 2016 (note 16). In the prior period, the costs relate to fees incurred in relation to the acquisition of Fox-IT Holdings BV. The adjustment to consideration of a £2.9m charge relates to foreign exchange revaluation differences on the carrying value of consideration. In the prior year the £4.7m income relates to the net gains related to the reassessment of the Open Registry contingent consideration and an adjustment to the consideration payable for a previous Accumuli plc acquisition. A goodwill impairment of £54.3m (2016: £11.9m) has been recognised in respect of the CGUs for Fox-IT Holdings BV, Accumuli plc and Web Performance (note 11). The Fox and former Accumuli businesses (the latter now known as MSS) have underperformed in the year compared to our original acquisition forecasts and also encountered integration challenges that have slowed the pace of commercial leverage of the different new service and product lines across the rest of the Group. In respect of Web Performance, revenue generating intangible assets have been slower than originally anticipated to generate revenues and the slower ramp-up in revenue has therefore led to the recognition of the impairment. 136 www.nccgroup.trust Stock Code: NCC NCC AR2017 proof 8- Back.indd 136 25546.04 9 August 2017 4:01 PM Proof Six 09/08/2017 16:01:52 The Directors have assessed the carrying value of intangible assets and concluded that the carrying values of certain capitalised development and software costs are impaired (note 11). Accordingly, a write down of £5.7m (2016: £6.8m) has been recognised in respect of capitalised development costs (£3.2m) and in respect of the .trust domain name (£2.5m). In addition, residual Domain Services software with a book value of £2.0m has been written off in full. In the prior year, the intangible asset write down of £6.8m relates to the impairment of capitalised costs for redundant technology. The Group has incurred restructuring costs of £1.3m (2016: £2.6m) relating to the exit payments to the former Chief Executive (as shown in the Remuneration Report) and other members of senior management, professional fees in relation to the Strategic Review and retention bonuses paid to former employees of Accumuli plc. As previously reported, NCC Group became responsible for paying these bonuses on acquisition of the Accumuli group. In the year to 31 May 2016, restructuring costs included Accumuli plc retention bonuses, severance costs and other costs associated with the wind down of the Domain Services division. The onerous property lease charge of £1.3m (2016: £nil) is in respect of double running costs of empty properties. The £1.8m charge for vacation pay relates to previous financial periods and this is described in more detail in the Audit Committee Report. Of the total charge, £0.5m relates to the prior year with the balance relating to prior years up to 31 May 2015 with no significant charge in any one year. The £0.9m (2016: £nil) impairment of fixtures and fittings relates to items in the current head office which will be obsolete after the relocation later this year. The tax effect in the income statement relating to the individually significant items recognised is: Goodwill impairment Intangible asset impairment (breakdown shown below): – Capitalised development costs – Software costs Impairment of intangible assets Acquisition related costs Adjustments to deferred and contingent consideration Restructuring costs Onerous property leases Vacation pay Impairment of fixtures and fittings Other individually significant items Total 2017 £m – (1.4) – (1.4) (0.3) 0.1 (0.3) (0.2) (0.5) – (1.2) (2.6) 2016 £m – (2.3) – (2.3) (0.2) – (0.6) – – – (0.8) (3.1) NCC Group plc Annual Report and Accounts for the year ended 31 May 2017 137 NCC AR2017 proof 8- Back.indd 137 25546.04 9 August 2017 4:01 PM Proof Six 09/08/2017 16:01:53 FINANCIAL STATEMENTS Notes to the accounts FOR THE YEAR ENDED 31 MAY 2017 4 Expenses and auditors’ remuneration (Loss)/profit before taxation is stated after charging/(crediting): Amounts receivable by auditors and their associates in respect of: Audit of these financial statements Audit of financial statements of subsidiaries pursuant to legislation Total audit Review of interim financial statements Total fees Depreciation of property, plant and equipment (note 12) Impairment of fixtures and fittings* (note 12) Amortisation and other amounts written off intangible fixed assets: Amortisation of development costs (note 11) Amortisation of software costs (note 11) Amortisation of acquired intangibles (note 11) Impairment of goodwill* (note 11) Impairment of capitalised development costs* Impairment of software costs* Operating lease rentals charged: – Hire of property, plant and equipment – Other operating leases Research and development expenditure Profit on sale of subsidiary companies* Profit on disposal of plant and equipment * Included within individually significant items, note 3. 2017 £m 2016 £m – 0.2 0.2 – 0.2 5.2 0.9 1.5 2.0 10.3 54.3 5.7 2.0 3.2 1.6 1.7 1.2 – 0.1 0.1 – 0.1 3.7 – – 1.6 6.8 11.9 6.8 – 3.9 1.4 2.2 – (0.1) (0.1) The reclassification of costs relates to administrative salaries and travel costs that were reported within cost of sales in the prior year but have been reclassified to general and administrative expenses in this year’s consolidated income statement. 138 www.nccgroup.trust Stock Code: NCC NCC AR2017 proof 8- Back.indd 138 25546.04 9 August 2017 4:01 PM Proof Six 09/08/2017 16:01:53 5 Staff numbers and costs Directors’ emoluments are disclosed in the Remuneration Committee report. Total aggregate emoluments of the Directors in respect of 2017 were £1.2m (2016: £1.8m). Employer contributions to pensions for Executive Directors for qualifying periods were £0.1m (2016: £0.1m). The aggregate net value of share awards granted to the Directors in the period was £0.1m (2016: £0.7m). The net value has been calculated by reference to the closing mid-market price of the Company’s shares on the day before the date of grant. During the year, 89,804 share options were exercised by Directors (2016: 72,538) with a market value of £0.3m. Group The average monthly number of persons employed by the Group during the year, including Directors is analysed by category as follows: Operational Administration, sales and marketing The aggregate payroll costs of these persons were as follows: Wages and salaries Share based payments (note 22) Social security costs Other pension costs (note 27) Number of employees 2017 1,042 655 1,697 2017 £m 118.2 0.6 11.7 5.8 2016 837 565 1,402 2016 £m 88.4 1.1 8.1 2.5 136.3 100.1 NCC Group plc Annual Report and Accounts for the year ended 31 May 2017 139 NCC AR2017 proof 8- Back.indd 139 25546.04 9 August 2017 4:01 PM Proof Six 09/08/2017 16:01:53 FINANCIAL STATEMENTS Notes to the accounts FOR THE YEAR ENDED 31 MAY 2017 6 Domain Services In June 2016, the Board took the decision to close down the activities of the Domain Services operating segment. During the prior year, the development activities of Domain Services were severely curtailed and the assets and business activities were either shut down or sold in the current financial year. This included the sale of the Open Registry group of companies comprising Open Registry SA, ClearingHouse for Intellectual Property SA, Nexperteam CVBA and Sensirius CVBA to external buyers for a combined total consideration of €3.75m in January 2017, €2.0m receivable in immediate cash and €1.75m as deferred consideration, receivable in July 2018 at a fixed interest rate of 4 per cent. A profit on disposal of £1.2m is recognised in the consolidated income statement within individually significant items (note 3). The tables below provide an analysis of Domain Services activities for revenue, EBITDA and profit before tax as these are considered to be the most relevant to understanding underlying business performance. Results of Domain services Revenue Expenses EBITDA Individually significant items Depreciation and amortisation Operating profit Gain recognised on sale Profit for the year before tax Effect of the Open Registry Group sale on assets and liabilities Intangible assets Plant & Equipment Trade and receivables Cash and cash equivalents Trade payables Net liabilities Consideration received, satisfied in cash Cash disposed of Net cash inflow 2016 £m 4.9 (6.3) (1.0) (18.7) (0.4) (20.1) – (20.1) 2016 £m 0.1 0.1 2.5 1.3 (4.1) (0.1) 2017 £m 2.6 (2.7) (0.1) – (0.1) (0.2) 1.2 1.0 2017 £m 0.1 0.1 3.2 1.6 (5.2) (0.2) 1.7 (1.7) – 140 www.nccgroup.trust Stock Code: NCC NCC AR2017 proof 8- Back.indd 140 25546.04 9 August 2017 4:01 PM Proof Six 09/08/2017 16:01:53 7 Net financing costs Interest payable on bank loans and overdrafts Unwinding discount on deferred consideration Financial expenses 2017 £m 1.4 0.5 1.9 2016 £m 1.4 0.6 2.0 The unwinding discount on deferred consideration payable relates to the acquisition of a subsidiary undertaking that has been discounted to its present value. 8 Taxation Recognised in the income statement Current tax expense Current year Adjustment to tax expense in respect of prior periods Foreign tax Total current tax Deferred tax (note 17) Tax in income statement Reconciliation of effective tax rate (Loss)/profit before taxation Current tax using the UK corporation tax rate of 19.83% (2016: 20%) Effects of: Items not taxable for tax purposes Adjustment to tax charge in respect of prior periods Differences between overseas tax rates Movements in temporary differences not recognised Effect of rate change Total tax expense 2017 £m 2016 £m 3.1 – 0.9 4.0 (2.7) 1.3 2017 £m (55.3) (11.0) 12.3 (0.4) 0.2 0.6 (0.4) 1.3 4.4 (0.5) 0.8 4.7 (1.6) 3.1 2016 £m 9.4 1.9 2.0 (0.2) (0.5) – (0.1) 3.1 Current and deferred tax recognised directly in equity was a charge of £0.2m (2016: charge of £0.6m). The UK Government enacted Finance Act 2016 in September 2016 included provisions to reduce the main rate of corporation tax to 17% with effect from 1 April 2020. Accordingly, the UK deferred tax balances which were valued at the rate of 19% in the 31 May 2016 accounts have been revalued at the 17% rate in these accounts where relevant. NCC Group plc Annual Report and Accounts for the year ended 31 May 2017 141 NCC AR2017 proof 8- Back.indd 141 25546.04 9 August 2017 4:01 PM Proof Six 09/08/2017 16:01:53 FINANCIAL STATEMENTS Notes to the accounts FOR THE YEAR ENDED 31 MAY 2017 9 Dividends Dividends paid and recognised in the year Dividends proposed but not recognised in the year Dividends per share paid and recognised in the year Dividends per share proposed but not recognised in the year 10 Earnings per share The calculation of adjusted earnings per share is based on the following: (Loss)/profit for the year from continuing operations used for basic and diluted earnings per share Amortisation of acquired intangible assets (note 11) Domain Services – results Individually Significant Items (note 3) Unwinding of discount (note 7) Share based payments (note 22) Tax arising on the above items Adjusted profit from continuing operations used for adjusted earnings per share Basic weighted average number of shares in issue Dilutive effect of share options Diluted weighted average shares in issue 2017 £m 10.3 (1.0) 71.0 0.5 0.6 (6.3) 2017 £m (56.6) 75.1 18.5 Number of shares m 276.3 – 276.3 2017 £m 12.8 8.7 4.65p 3.15p 2016 £m 6.8 1.4 18.9 0.6 1.2 (5.2) 2016 £m 10.3 8.7 4.18p 3.15p 2016 £m 6.3 23.7 30.0 Number of shares m 254.6 3.5 258.1 In the prior year, the average market value of the Company’s shares for purposes of calculating the dilutive effect of share options was based on quoted market prices for the period during which the options were outstanding. The prior year did not treat Domain Services as an adjusting item as the decision to exit the business was taken after the end of the financial year. To be consistent with the current year, the prior year adjusting items have been amended to include the results of Domain Services. The net impact was to increase the prior year Adjusted EPS by 0.4p. 142 www.nccgroup.trust Stock Code: NCC NCC AR2017 proof 8- Back.indd 142 25546.04 9 August 2017 4:01 PM Proof Six 09/08/2017 16:01:53 11 Intangible assets Cost: At 1 June 2015 Acquisitions through business combinations Additions – internally developed Costs write-down Effects of movements in exchange rates At 31 May 2016 Acquisitions through business combinations Reclassification Additions – internally developed Disposal of subsidiaries Effects of movements in exchange rates At 31 May 2017 Accumulated amortisation and impairment losses: At 1 June 2015 Charge for year Impairment charge Effects of movements in exchange rates At 31 May 2016 Reclassification Charge for year Impairment charge Effects of movements in exchange rates At 31 May 2017 Net book value: At 31 May 2017 At 31 May 2016 Software £m Development costs £m Customer contracts and relationships £m Goodwill £m Total £m 18.4 1.7 6.9 – – 27.0 – (11.1) 3.7 – 0.6 20.2 7.7 1.6 – – 9.3 (2.1) 2.0 2.0 – 11.2 9.0 17.7 8.7 – 1.9 (6.8) 0.4 4.2 – 11.1 3.7 (0.1) 0.4 19.3 – – – – – 2.1 1.5 5.7 (0.2) 9.1 10.2 4.2 47.8 25.4 – – 3.0 76.2 7.7 – – (3.4) 6.5 87.0 17.8 6.8 – 0.5 25.1 – 10.3 – 1.9 37.3 49.7 51.1 155.7 72.9 – – 7.6 236.2 12.1 – – – 16.6 264.9 – – 11.9 – 11.9 – – 54.3 – 66.2 198.7 224.3 230.6 100.0 8.8 (6.8) 11.0 343.6 19.8 – 7.4 (3.5) 24.1 391.4 25.5 8.4 11.9 0.5 46.3 – 13.8 62.0 1.7 123.8 267.6 297.3 NCC Group plc Annual Report and Accounts for the year ended 31 May 2017 143 NCC AR2017 proof 8- Back.indd 143 25546.04 9 August 2017 4:01 PM Proof Six 09/08/2017 16:01:53 FINANCIAL STATEMENTS Notes to the accounts FOR THE YEAR ENDED 31 MAY 2017 11 Intangible assets (continued) Cash generating units (CGUs): Goodwill and intangible assets are allocated to CGUs in order to be assessed for potential impairment. CGUs are defined by accounting standards as the lowest level of asset groupings that generate separately identifiable cash inflows that are not dependent on other CGUs. Following the Strategic Review, the Directors have reconsidered the CGUs within the Group. The CGUs and the allocation of goodwill to those CGUs is shown in the table below. The table also includes the discount rate used to assess the NPV of the future cash flows of each CGU: Cash generating units Escrow UK Escrow Europe Escrow USA Total Escrow Assurance USA PSC VSR UK Security Consulting Fox-IT Software Testing Web Performance Accumuli (known internally as MSS) Total Assurance Total Group 2017 Pre-tax Discount rate % 11.4 11.8 14.9 14.6 14.5 14.5 12.6 17.0 12.5 15.2 15.4 2017 £m 22.9 8.3 7.3 38.5 28.1 9.8 2.3 18.5 62.7 8.0 2.2 28.6 160.2 198.7 In the prior year, the goodwill allocation and pre-tax discount rates (WACC) for each CGU (in brackets) were: Escrow UK £21.2m (10.1%), Escrow Europe £6.4m (10.7%), Escrow USA £7.3m (12.9%), Assurance USA £24.6m (15.0%) and European Security Services £164.8m (11.2%). The composition of the MSS business noted above (formerly known as Accumuli) is slightly different from the Accumuli Group at acquisition. One part of the Accumuli business, known as RandomStorm, carried on identical activities to some parts of UK Security Consulting. Those activities and their cash flows were transferred to UK Security Consulting during the year and are no longer separately managed or independent cash flows associated with MSS. Those cash flows and their associated share of goodwill is therefore included in the UK Security Consulting CGU. During the year, the Group acquired Payment Software Company Inc, a global payment and security consulting company, and Virtual Security Research LLC (VSR), an information network and application security consulting company. When assessing impairment, the recoverable amount of each CGU is based on value in use calculations. These calculations require the use of estimates, specifically: pre-tax cash flow projections; long-term growth rates; and a pre-tax market discount rate. Cash flow projections are based on the Group’s detailed annual operating plan for the forthcoming financial year with assumptions applied for expected revenue growth and costs to forecast years two to five which are forecasts which have been approved by the Board. The judgement on these assumptions is based on management’s past experience of growth and knowledge of the industry sectors and markets. The projections beyond five years are forecast using an estimated long-term growth rate of 2.5% (2016: 2.5%) which represents management’s best estimate of a long-term annual growth rate in EBITDA. A different set of assumptions may be more appropriate in future years dependent on changes in the macroeconomic environment. 144 www.nccgroup.trust Stock Code: NCC NCC AR2017 proof 8- Back.indd 144 25546.04 9 August 2017 4:01 PM Proof Six 09/08/2017 16:01:53 The discount rates used are based on management’s calculation of the WACC using the capital asset pricing model to calculate the cost of equity. Specific rates are used for each CGU in the value in use calculation and the rates reflect management’s assessment on the level of relative risk in each respective CGU. The pre-tax discount rates used in the value in use calculations are shown above. The Directors have considered a range of sensitivities. If the discount rates used in each CGU were decreased or increased by 1 per cent, the total Net Present Value of future cash flows would increase by £105m and decrease by £81m respectively. In the specific case of the CGUs where goodwill has been impaired in the current year, or where an impairment would potentially arise, the impairment amounts would increase/(decrease) as follows: Fox-IT MSS Web Performance Total for units with impairments Software Testing Total for units with impairments and Software Testing Discount rate 1% increase 2017 £m Discount rate 1% decrease 2017 £m 9.1 2.6 0.8 12.5 0.2 12.7 (11.2) (3.1) (1.1) (15.4) (1.9) (17.3) NCC Group plc Annual Report and Accounts for the year ended 31 May 2017 145 NCC AR2017 proof 8- Back.indd 145 25546.04 9 August 2017 4:01 PM Proof Six 09/08/2017 16:01:54 FINANCIAL STATEMENTS Notes to the accounts FOR THE YEAR ENDED 31 MAY 2017 12 Plant and equipment Computer equipment £m Plant and equipment £m Fixtures and fittings £m Motor vehicles £m Cost: At 1 June 2015 Additions Acquired as part of business combination Disposals Movement in foreign exchange rates At 31 May 2016 Additions Acquired as part of business combination Disposals Movement in foreign exchange rates At 31 May 2017 Depreciation: At 1 June 2015 Charge for year Disposals Movement in foreign exchange rates At 31 May 2016 Charge for year Impairment Acquired as part of business combination Disposals Movement in foreign exchange rates At 31 May 2017 Net book value: At 31 May 2017 At 31 May 2016 14.6 3.2 0.9 (0.3) 0.2 18.6 4.2 0.5 (0.3) 0.8 23.8 11.3 1.9 (0.2) (0.1) 12.9 3.3 – 0.4 (0.3) 0.6 16.9 6.9 5.6 0.4 – – – – 0.4 0.1 – (0.4) – 0.1 0.4 – – – 0.4 – – – (0.4) – – 0.1 – 9.7 1.3 1.0 – 0.2 12.2 6.6 – (0.2) 1.0 19.6 3.9 1.7 – (0.1) 5.5 1.9 0.9 – (0.2) 0.4 8.5 11.1 6.7 0.4 0.1 – – – 0.5 0.1 – (0.2) – 0.4 0.1 0.1 – – 0.2 – – – (0.1) – 0.1 0.2 0.3 Total £m 25.1 4.6 1.9 (0.3) 0.4 31.7 11.0 0.5 (1.1) 1.8 43.9 15.7 3.7 (0.2) (0.2) 19.0 5.2 0.9 0.4 (1.0) 1.0 25.5 18.3 12.7 The £0.9m impairment of fixtures and fittings in the current head office property which is due for relocation later in the year is recognised as an Individually significant item in the consolidated income statement, note 3. 146 www.nccgroup.trust Stock Code: NCC NCC AR2017 proof 8- Back.indd 146 25546.04 9 August 2017 4:01 PM Proof Six 09/08/2017 16:01:54 13 Investments Property Interest in unlisted shares Group 2017 £m – 0.4 0.4 Group 2016 £m 0.3 0.3 0.6 The investment in unlisted shares relates to a 3.35 per cent ordinary shareholding in an unlisted company acquired as part of the Accumuli acquisition. The investment’s carrying value at acquisition date was considered appropriate as the fair value and the investment continues to be carried at this value. 14 Trade and other receivables Trade receivables Prepayments Other receivables Accrued income Amounts owed by Group undertakings The ageing of trade receivables at the end of the reporting period was: Group Not past due Past due 0–30 days Past due 31–90 days Past due more than 90 days Group 2017 £m Group 2016 £m Company 2017 £m Company 2016 £m 40.9 6.6 1.5 17.7 – 66.7 39.4 7.2 – 19.8 – 66.4 – – – – – – 149.6 149.6 130.2 130.2 Gross 2017 £m Impairment 2017 £m Gross 2016 £m Impairment 2016 £m 19.8 12.1 7.7 2.0 41.6 – – – (0.7) (0.7) 25.0 9.0 4.7 1.4 40.1 – – – (0.7) (0.7) The Company had no trade receivables (2016: £Nil). The Group establishes a provision for impairment that represents its estimate of incurred losses in respect of specific trade receivables. The movement in the provision for impairment was: Balance at 1 June (Utilised)/created Balance at 31 May NCC Group plc Annual Report and Accounts for the year ended 31 May 2017 Group 2017 £m 0.7 – 0.7 Group 2016 £m 0.3 0.4 0.7 147 NCC AR2017 proof 8- Back.indd 147 25546.04 9 August 2017 4:01 PM Proof Six 09/08/2017 16:01:54 FINANCIAL STATEMENTS Notes to the accounts FOR THE YEAR ENDED 31 MAY 2017 15 Inventory IT hardware for resale Group 2017 £m 1.1 1.1 Group 2016 £m 0.3 0.3 16 Acquisitions Payment Software Company Inc NCC Group Inc acquired Payment Software Company Inc (PSC), a company based in California, USA, on 28 September 2016. PSC is a global payment and security consulting company, providing services to organisations that require specialist compliance, forensics and consulting support. The consideration paid was $16.6m initial cash consideration with contingent consideration payments of $1.9m, where the fair values are based on the estimated cash outflows discounted using a risk-adjusted discount rate, due on earn-out periods to 31 December 2017 and 31 December 2018. The two contingent payments are payable in cash on the achievement of specific profit based performance targets which we expect to be achieved based on current business forecasts. Accordingly, the full contingent consideration liability has been recognised at its fair value. Acquiree’s identifiable net assets at the acquisition date: £m Intangible assets – acquired Trade and other receivables Deferred tax liability Cash Creditors & accruals Net identifiable assets Goodwill on acquisition Total consideration Satisfied by: Initial cash consideration Deferred cash consideration Finance discount on deferred consideration Net cash outflow Cash acquired Net cash outflow excluding cash acquired 12.8 3.0 (0.2) 15.6 Fair values £m 5.7 1.5 (2.0)* 1.8 (1.2) 5.8 9.8 15.6 12.8 (1.8) 11.0 * Deferred tax liabilities include deferred tax arising on intangible assets acquired. The goodwill of £9.8m represents the benefits expected to be generated from sales and profit growth from the wider NCC Group customer base in the US market. The goodwill is not expected to be deductible for tax purposes. Acquisition costs relating to professional fees totalling £0.4m were incurred and are recognised as individually significant items in the income statement (note 3). The Group’s consolidated income statement includes eight months’ post acquisition trading, with PSC Inc contributing £5.9m revenue and £1.2m operating profit. 148 www.nccgroup.trust Stock Code: NCC NCC AR2017 proof 8- Back.indd 148 25546.04 9 August 2017 4:01 PM Proof Six 09/08/2017 16:01:54 Virtual Security Research LLC NCC Group Inc acquired Virtual Security Research LLC (VSR), a company based in Boston, Massachusetts, USA, on 11 November 2016. VSR is an information, network and application security consulting company providing services to corporate clients of varying sizes primarily in the US Technology and Financial Services sectors. The consideration paid was $3.7m initial cash consideration with contingent consideration payments of $0.9m, where the fair values are based on the estimated cash outflows discounted using a risk-adjusted discount rate, due on earn-out periods to 31 December 2017 and 31 December 2018. The two contingent payments are payable in cash on the achievement of specific profit based performance targets which we expect to be achieved based on current business forecasts. Accordingly, the full contingent consideration liability has been recognised at its fair value. Acquiree’s identifiable net assets at the acquisition date: Intangible assets – acquired Trade and other receivables Cash Creditors & accruals Net identifiable assets Goodwill on acquisition Total consideration Satisfied by: Initial cash consideration Deferred cash consideration (no impact from discounting) Net cash outflow Cash acquired Net cash outflow excluding cash acquired £m 2.9 1.3 4.2 Fair values £m 2.0 0.5 0.1 (0.7) 1.9 2.3 4.2 2.9 0.1 2.8 The goodwill of £2.3m represents the benefits expected to be generated from sales and profit growth from the wider NCC Group customer base in the US market. The goodwill is expected to be deductible for tax purposes. Acquisition costs relating to professional fees totalling £0.2m were incurred and are recognised as individually significant items in the income statement (note 3). The Group’s consolidated income statement includes six full month’s of post-acquisition trading, with VSR contributing revenue of £1.1m and operating profit of £0.5m. NCC Group plc Annual Report and Accounts for the year ended 31 May 2017 149 NCC AR2017 proof 8- Back.indd 149 25546.04 9 August 2017 4:01 PM Proof Six 09/08/2017 16:01:54 FINANCIAL STATEMENTS Notes to the accounts FOR THE YEAR ENDED 31 MAY 2017 16 Acquisitions (continued) Fox-IT Holdings BV In the prior year, NCC Group (Solutions) Limited acquired Fox-IT Holdings BV, a company based in the Netherlands. Fox-IT has a leading market position in Europe for high-end Cyber Security solutions and is a leading European provider of Advanced Incident Response Services. Fox-IT’s activities of Advanced Threat Protection, Threat Intelligence and Web/Mobile Event Analytics, High Assurance and Secure Infrastructure provide further depth to NCC Group’s cyber and assurance services and growth opportunities from new markets. The consideration for the acquisition of Fox-IT was €108.3m initial cash, with deferred payments due on each of the first and second anniversaries of completion comprising €10.0m cash and €2.5m newly issued NCC Group plc shares each. The first deferred payment was paid in November 2016 and the Directors agreed to make this payment fully in cash consideration. Accordingly, a payment of €12.5m was made to the former owners. The acquisition had the following effect on the Group’s assets and liabilities: Acquiree’s identifiable net assets at the acquisition date: £m Plant and equipment Intangible assets – development Intangible assets – acquired Trade and other receivables Inventory Deferred tax liability Cash Creditors & accruals Deferred revenue Net identifiable assets Goodwill on acquisition Total consideration Satisfied by: Initial cash consideration Deferred cash consideration Deferred issue of equity shares consideration Finance discount on deferred consideration Net cash outflow Cash acquired Net cash outflow excluding cash acquired 76.6 14.4 3.6 (0.8) 93.8 Fair values £m 1.9 1.7 25.4 7.3 0.4 (6.0) 1.8 (7.5) (2.1) 22.9 70.9 93.8 76.6 (1.8) 74.8 The fair value of trade and other receivables represents £7.5m of gross contractual receivables and a provision for doubtful debts of £0.2m. 150 www.nccgroup.trust Stock Code: NCC NCC AR2017 proof 8- Back.indd 150 25546.04 9 August 2017 4:01 PM Proof Six 09/08/2017 16:01:54 The goodwill of £70.9m represents the value to be generated from cross-selling Fox-IT products and services to existing Group customers, sales growth from new customers in wider geographic markets and from future product development using the knowledge and expertise of the Fox-IT technical team. The goodwill is not expected to be deductible for tax purposes. Acquisition costs relating to professional fees totalling £1.9m were incurred and are recognised as individually significant items in the income statement account (note 3). The Group’s prior year consolidated income statement includes six months’ post acquisition trading, with Fox-IT contributing £14.0m revenue and £1.3m operating profit. The combined results of NCC Group and Fox-IT B.V. for the 12 month period ended 31 May 2016 were revenue of £218.2m and operating profit before individually significant items of £30.5m. The balances presented below are valued at the fair value of amounts payable and in respect of contingent consideration on acquisitions. The contingent consideration is stated at the maximum amount payable as it is believed that on current trading performance the full contingent consideration will be due. Contingent consideration FortConsult A/S Payment Software Company Virtual Security Research Armstrong Adams Limited 2017 £m 2016 £m – 2.8 1.3 – 4.1 1.8 – – 1.7 3.5 The amounts outstanding in May 2016 in respect of FortConsult A/S and Armstrong Adams Limited were paid in full during the year. Deferred consideration Fox-IT Holdings B.V. 2017 £m 10.7 10.7 2016 £m 18.5 18.5 NCC Group plc Annual Report and Accounts for the year ended 31 May 2017 151 NCC AR2017 proof 8- Back.indd 151 25546.04 9 August 2017 4:01 PM Proof Six 09/08/2017 16:01:54 FINANCIAL STATEMENTS Notes to the accounts FOR THE YEAR ENDED 31 MAY 2017 17 Deferred tax assets and liabilities Group Recognised deferred tax assets and liabilities are attributable to the following: Plant and equipment Short-term temporary differences Intangible assets Share based payments Tax losses Deferred tax asset/(liability) Movement in deferred tax during the year: Plant and equipment Short-term temporary differences Intangible assets Share based payments Tax losses Plant and equipment Short-term temporary differences Intangible assets Share based payments Tax losses Assets 2017 £m – 1.4 – 0.3 2.5 4.2 2016 £m – 1.8 – 0.8 2.7 5.3 Liabilities Net 2017 £m (1.9) – (12.3) – – 2016 £m (2.2) – (13.3) – – 2017 £m (1.9) 1.4 (12.3) 0.3 2.5 2016 £m (2.2) 1.8 (13.3) 0.8 2.7 (14.2) (15.5) (10.0) (10.2) 1 June 2016 £m Recognised in income £m Exchange differences £m Recognised in equity £m Acquisitions £m 31 May 2017 £m (2.2) 1.8 (13.3) 0.8 2.7 (10.2) 0.3 (0.4) 3.1 (0.1) (0.2) 2.7 – – (0.9) – – (0.9) – – – (0.4) – (0.4) – – (1.2) – – (1.9) 1.4 (12.3) 0.3 2.5 (1.2) (10.0) 1 June 2015 £m Recognised in income £m Exchange differences £m Recognised in equity £m Acquisitions £m 31 May 2016 £m (0.4) 0.5 (9.7) 0.5 3.3 (5.8) (1.8) 0.8 3.3 (0.1) (0.6) 1.6 – 0.1 (0.5) (0.1) – (0.5) – – – 0.5 – 0.5 – 0.4 (6.4) – – (2.2) 1.8 (13.3) 0.8 2.7 (6.0) (10.2) The Group has recognised a deferred tax asset of £2.5m (2016: £2.7m) on tax losses as management consider it probable that future taxable profits will be available against which it can be utilised. The Group has not recognised a deferred tax asset on £6.2m (2016: £5.7m) of tax losses carried forward due to uncertainties over their future recovery. Included in recognised and unrecognised tax losses are losses of £2.9m that will expire in 2034 (2016: £3.5m). Other losses may be carried forward indefinitely. No deferred tax liability is recognised on temporary differences of £nil (2016: £0.2m) relating to the unremitted earnings of overseas subsidiaries as the Group is able to control the timing of the reversal of these temporary differences and it is probable that they will not reverse in the foreseeable future. 152 www.nccgroup.trust Stock Code: NCC NCC AR2017 proof 8- Back.indd 152 25546.04 9 August 2017 4:01 PM Proof Six 09/08/2017 16:01:55 18 Trade and other payables Trade payables Non trade payables Accruals Consideration on acquisitions (note 16) Property provisions (note 20) Intercompany payables 19 Deferred revenue Deferred revenue Group 2017 £m Group 2016 £m Company 2017 £m Company 2016 £m 4.3 6.7 18.7 12.9 1.5 – 44.1 7.9 7.6 16.1 3.5 – – 35.1 – – – – – – – Group 2017 £m 35.6 35.6 – – – – – 10.6 10.6 Group 2016 £m 36.3 36.3 Deferred revenue consists of: Escrow agreements £13.5m (2016: £13.2m), Assurance contracts £19.2m (2016: £17.1m), Website monitoring and load testing agreements of £2.9m (2016: £3.4). There are no Domain Services deferred revenue contracts as the entity was disposed of during FY17 (2016: £2.6m). The revenue has been deferred and is released to the income statement over the contract term in accordance with the Group’s accounting policy. 20 Non-current liabilities Secured and interest bearing bank loan Deferred tax (note 17) Consideration on acquisitions (note 16) Property provisions Total non-current liabilities Group 2017 £m 56.0 14.2 2.1 3.5 75.8 Group 2016 £m 33.4 15.5 18.5 0.4 67.8 For more information about the contractual terms of the Group’s interesting bearing secured bank loan, see note 21. Total Property provisions of £5.0m represents capital contributions of £3.7m towards fit-out costs on the new Manchester Head Office building and a rent free allowance of £1.3m which is being amortised over the period of the lease. The capital contribution provision of £3.7m will be released to the Income Statement over the same period as the assets in question are being depreciated (i.e. 10 years). NCC Group plc Annual Report and Accounts for the year ended 31 May 2017 153 NCC AR2017 proof 8- Back.indd 153 25546.04 9 August 2017 4:01 PM Proof Six 09/08/2017 16:01:55 FINANCIAL STATEMENTS Notes to the accounts FOR THE YEAR ENDED 31 MAY 2017 21 Financial instruments Financial risk management The Group has exposure to the followings risks from its use of financial instruments: z Credit risk z Liquidity risk z Currency risk z Interest rate risk The Board has overall responsibility for establishing appropriate management of exposure to risk. The Audit Committee oversees how management identify and address risks to the Group. Capital management The Board’s policy is to maintain a strong capital base so as to maintain investor, creditor and market confidence and to sustain future development of the business. The Group monitors capital on the basis of the gearing ratio. This ratio is calculated as net debt divided by total capital. Net debt is calculated as total interest bearing loans as shown in the consolidated balance sheet, less cash and cash equivalents. Total capital is calculated as equity, as shown in the consolidated balance sheet, plus net debt. As at 31 May 2017 the Group’s gearing ratio was 17.1 per cent (2016: 5 per cent). 2017 2016 Level 1 £m Level 2 £m Level 3 £m Level 1 £m Level 2 £m Level 3 £m Investments Trade receivables Other receivables Cash and cash equivalents Interest bearing loans Trade and other payables Contingent consideration on acquisitions – – – – – – – 0.4 40.9 1.5 12.3 (56.0) (29.7) – – – – – – – (4.1) – – – – – – – 0.6 39.4 – 20.7 (33.4) (31.6) – – – – – – – (3.5) The contingent consideration on acquisitions reflects the estimated cash outflows and is discounted using a risk-adjusted discount rate. Financial instruments policy All instruments utilised by the Company and Group are for financing purposes. The financial management and treasury activities of the Group are controlled centrally for all operations with local finance teams responsible for day-to-day banking activities. 154 www.nccgroup.trust Stock Code: NCC NCC AR2017 proof 8- Back.indd 154 25546.04 9 August 2017 4:01 PM Proof Six 09/08/2017 16:01:55   Fair value of financial instruments As at 31 May 2017 the Group and Company had no other financial instruments other than those disclosed below. The carrying value of contingent consideration on acquisitions, held at the year end is valued using a level 3 valuation method as defined by IFRS 13 Fair Value measurement. There have been no transfers between levels in the year. The following table presents the Group’s financial assets and liabilities that are measured at fair value by level of fair value hierarchy: z quoted prices (unadjusted) in active markets for identical assets or liabilities (Level 1); z inputs other than quoted prices included within Level 1 that are observable for the asset or liability, either directly (that is, as prices) or indirectly (that is, derived from prices) (Level 2); and z inputs for the asset or liability that are not based on observable market data (unobservable inputs) (Level 3). The loan is held at amortised cost which is considered to equate to fair value. All other assets and liabilities are held at either fair value or their carrying value which approximates to fair value. Credit Risk Credit risk is the risk of financial loss to the Group if a customer or counterparty to a financial instrument fails to meet its contractual obligations and arises principally from the Group’s receivables from customers. The Group’s exposure to credit risk is influenced mainly by the individual characteristics of each customer. Exposure to credit risk The carrying value of financial assets represents the maximum credit exposure. The maximum exposure to credit risk at the reporting date was: Trade receivables Cash and cash equivalents Group 2017 £m 40.9 12.3 53.2 Group 2016 £m 39.4 20.7 60.1 Company 2017 £m Company 2016 £m – – – – – – The maximum exposure to credit risk for trade receivables at the reporting date by geographic region was: Debtors by geographical segment UK USA Rest of Europe Rest of the World Group 2017 £m Group 2016 £m Company 2017 £m Company 2016 £m 21.6 10.9 6.4 2.0 40.9 27.7 – 4.5 7.2 39.4 – – – – – – – – – – NCC Group plc Annual Report and Accounts for the year ended 31 May 2017 155 NCC AR2017 proof 8- Back.indd 155 25546.04 9 August 2017 4:01 PM Proof Six 09/08/2017 16:01:55 FINANCIAL STATEMENTS Notes to the accounts FOR THE YEAR ENDED 31 MAY 2017 21 Financial instruments (continued) The maximum exposure to credit risk at the reporting date by business segment was: Debtors by business segment Group Escrow Assurance Group 2017 £m 8.9 32.0 40.9 Group 2016 £m 7.5 31.9 39.4 Company 2017 £m Company 2016 £m – – – – – – The trade receivables of the Group typically comprise many small amounts due from a large number of customers. The Group’s customer base, whilst concentrated largely in the UK, represents a spread of industry sectors. The largest amount due from a single customer at the reporting date represented of 8.6 per cent of total Group receivables (2016: 6.4 per cent). All of the Group’s cash is held with financial institutions of high credit rating. The provisions in respect of trade receivables are used to record probable impairment losses unless the Group is satisfied that no recovery of the amounts owing is possible. If the amount is considered irrecoverable, it is written off against the financial asset directly and any provision for impairment is released at the same time. The Group has a dedicated credit control team who regularly review customer debt balances to assess the risk of recovery. The allowance is all for debts older than 90 days (2016: older than 90 days). The ageing of Group debt and associated impairment loss is reported to the Board on a monthly basis. Liquidity risk Liquidity risk is the risk that the Group will not be able to meet its financial obligations as they fall due. The Group manages liquidity risks by regular reviews of forecast and actual cash flows in line with contractual maturities of financial liabilities and the Revolving Credit Facility available. Forecast cash flows are reported to the Board on a monthly basis. The following are the contractual maturities of financial liabilities, including interest payments of the Group: At 31 May 2017 Secured bank borrowings Trade and other payables Deferred consideration Contingent consideration At 31 May 2016 Secured bank borrowings Trade and other payables Deferred consideration Contingent consideration Carrying amount £m Contractual Cash flows £m 6 months or less £m 6–12 Months £m 1–2 Years £m (56.0) (29.7) (10.7) (4.1) (33.4) (31.6) (18.5) (3.5) – (29.7) (10.9) (4.3) (33.4) (31.6) (19.2) (3.5) – (29.7) (10.9) – – (31.6) (9.6) (3.5) – – – – – – (2.1) (2.1) – – – – – – (9.6) – 2+ Years £m (56.0) – – – (33.4) – – – The financial liabilities of the Company all have contractual maturities within six months (2016: within six months). 156 www.nccgroup.trust Stock Code: NCC NCC AR2017 proof 8- Back.indd 156 25546.04 9 August 2017 4:01 PM Proof Six 09/08/2017 16:01:55 Currency risk The Group is exposed to currency risk on sales, purchases and borrowings that are denominated in a currency other than the respective functional currencies of the Group entities. The Group’s management review the size and probable timing of settlement of all financial assets and liabilities denominated in foreign currencies. The Group’s exposure to currency risk is as follows: 2017 2016 Sterling £m EUR £m USD £m Other £m Sterling £m EUR £m Receivables Cash and cash equivalents Bank borrowings 25.1 2.1 (12.4) 3.6 3.8 – 9.9 5.3 (43.6) Deferred consideration – (10.7) – 2.2 1.1 – – 27.7 12.5 (6.9) (18.5) 3.9 5.0 – – USD £m 6.6 1.8 (26.5) – Other £m 1.1 1.4 – – Trade and other payables (18.4) (6.3) (3.6) (1.4) (21.0) (7.5) (2.5) (0.7) A change in exchange rate of 10 per cent would have an impact of £9.5m on revenue, £1.4m on operating profit, £8.7m on net assets and £3m on borrowings. Interest rate risk The Group and Company finances its operations through a mixture of retained profits and bank borrowings. The Group borrows and invests surplus cash at floating rates of interest based upon bank base rate. The financial assets of the Group at the end of the financial year were as follows: Sterling denominated financial assets Euro denominated financial assets US dollar denominated financial assets Other denominated financial assets Current trade and other receivables The financial assets of the Company at the end of the financial year were as follows: Sterling denominated financial assets Amounts owed by Group undertakings 2017 £m 2.1 3.8 5.3 1.1 40.9 53.2 £m 0.2 149.6 149.8 2016 £m 12.5 5.0 1.8 1.4 39.4 60.1 £m – 118.5 118.5 NCC Group plc Annual Report and Accounts for the year ended 31 May 2017 157 NCC AR2017 proof 8- Back.indd 157 25546.04 9 August 2017 4:01 PM Proof Six 09/08/2017 16:01:55   FINANCIAL STATEMENTS Notes to the accounts FOR THE YEAR ENDED 31 MAY 2017 21 Financial instruments (continued) A change of 100 basis points in interest rates would result in a difference in annual pre-tax profit of £0.5m (2016: £0.6m). The financial liabilities of the Group and their maturity profile are as follows: Less than one year 1–2 years 2–3 years 3–5 years Current trade and other payables 2017 2016 Sterling £m – – – 12.4 18.4 EUR £m 10.9 – – – 6.3 USD £m Other £m Sterling £m EUR £m USD £m – 2.1 2.1 43.6 3.6 – – – – 1.4 1.7 – – 6.9 21.0 9.3 9.3 – – 7.5 – – – 26.5 2.5 Other £m 1.8 – – – 0.7 As at 31 May 2017 the Group had a funding facility comprising a multi-currency revolving credit facility of £80m (2016: £80m), a £25m multi-currency term loan (2016: £30m) and an overdraft of £5m (2016: £5m). The term loan amortises at a rate of £2.5m every six months. The interest payable on drawn down funds ranges from 0.9% to 2.0% above LIBOR subject to the Group’s net debt and interest to EBITDA ratios. At 31 May 2017 the amount drawn down under the facilities was £56.0m (2016: £33.4m). This facility was agreed in November 2015 and is due for renewal in November 2020. At the end of May 2017, the effective rate was 2.0% (2016: 2.0%). 158 www.nccgroup.trust Stock Code: NCC NCC AR2017 proof 8- Back.indd 158 25546.04 9 August 2017 4:01 PM Proof Six 09/08/2017 16:01:55   22 Share based payments The Company has a number of share option schemes under which options to subscribe for the Company’s shares have been granted to directors and staff, details of which are illustrated in the tables below. Expected term of options represents the period over which the fair value calculations are based. The share based payment charge for the year was £0.6m (2016: £1.1m). Approved EMI scheme Under the Approved EMI Scheme, options granted will be subject to performance criteria. Options will vest if the average EPS growth for the three years following their grant is greater than 3 per cent above RPI per annum. The options are to be settled in equity. Date of grant August 2007 February 2008 Expected term of options Exercisable between Exercise Price 2017 Number Outstanding 6 years July 2010 – July 2017 6 years February 2011 – February 2018 £0.64 £0.65 10,908 2,862 CSOP scheme Under the CSOP Scheme, options granted will be subject to performance criteria. Options will vest if the average EPS growth for the three years following their grant is greater than 10 per cent per annum. The options are to be settled in equity. Date of grant July 2012 July 2013 August 2015 July 2016 Expected term of options Exercisable between Exercise Price 2017 Number Outstanding 6 years 6 years July 2015 – July 2022 July 2016 – July 2023 6 years August 2018 – August 2025 6 years July 2019 – July 2026 £1.36 £1.40 £2.45 £3.28 110,780 14,252 325,401 234,820 LTIP Schemes The vesting condition for the award of the LTIP schemes relates to growth in the Group’s EPS over the performance period. If growth is equal to 25 per cent or more per annum then 100 per cent of the award will vest. If, however, growth is less than 10 per cent per annum, none of the award will vest. Between these two points, vesting is determined on a straight-line basis. The options are to be settled in equity. Date of grant July 2014 July 2015 July 2016 Expected term of options Exercisable between Exercise Price 2017 Number Outstanding 3 years 3 years 3 years June 2017 – July 2018 June 2018 – July 2019 June 2019 – July 2020 Nil* Nil* Nil* 308,625 378,289 377,586 * The option exercise price is nil; however, £1 is payable on each occasion of exercise. NCC Group plc Annual Report and Accounts for the year ended 31 May 2017 159 NCC AR2017 proof 8- Back.indd 159 25546.04 9 August 2017 4:01 PM Proof Six 09/08/2017 16:01:56 FINANCIAL STATEMENTS Notes to the accounts FOR THE YEAR ENDED 31 MAY 2017 22 Share based payments (continued) Sharesave schemes The Company operates Sharesave schemes, which are available to all UK and Netherlands based employees and full time Executive Directors of the Company and its subsidiaries who have worked for a qualifying period. All options are to be settled by equity. Under the schemes the following options have been granted and are outstanding at year end. Date of grant August 2014 August 2015 August 2016 August 2016 March 2017 Deferred Share Scheme Date of grant July 2015 July 2016 Expected term of options Exercisable between Exercise Price 2017 Number Outstanding 3.25 years October 2017 – February 2018 3.25 years October 2018 – February 2019 3.16 years October 2019 – March 2020 3 years August 2019 – August 2023 3 years May 2020 – October 2020 £1.51 £1.87 £2.62 £3.37 £0.92 683,424 614,751 440,094 59,280 1,057,848 Expected term of options Exercisable between Exercise Price 2017 Number Outstanding 1 year 1 year July 2017 – July 2019 July 2018 – July 2020 Nil* Nil* 37,869 27,183 * The option exercise price is nil; however, £1 is payable on each occasion of exercise. Employee Stock Purchase Plan The Company operates a stock purchase plan, which is available to all US based employees who have worked for a qualifying period. All options are to be settled by equity. Under the scheme the following options have been granted and are outstanding at year end. Date of grant February 2017 Expected term of options Exercisable between Exercise Price 2017 Number Outstanding 1 year February 2018 £0.92 592,592 ISO scheme Under the ISO Scheme, options granted will be subject to performance criteria. Options will vest if the average EPS growth for the three years following their grant is greater than 10 per cent per annum. The options are to be settled in equity Date of grant January 2013 January 2014 January 2015 August 2015 January 2016 July 2016 160 Expected term of options Exercisable between Exercise Price 2017 Number Outstanding 3 years January 2016 – January 2023 3 years January 2017 – January 2024 3 years January 2018 – January 2025 3 years August 2018 – August 2025 3 years January 2019 – January 2026 3 years July 2019 – July 2022 £1.48 £2.00 £2.00 £2.46 £3.24 £3.26 20,338 30,074 50,000 129,940 19,476 202,709 www.nccgroup.trust Stock Code: NCC NCC AR2017 proof 8- Back.indd 160 25546.04 9 August 2017 4:01 PM Proof Six 09/08/2017 16:01:56 The following tables illustrate the number of share options for the schemes. Scheme Approved EMI scheme Approved EMI scheme CSOP scheme CSOP scheme CSOP scheme CSOP scheme Sharesave scheme Sharesave scheme Sharesave scheme Sharesave scheme Sharesave scheme Sharesave scheme ESPP scheme ESPP scheme ISO scheme ISO scheme ISO scheme ISO scheme ISO scheme ISO scheme LTIP LTIP LTIP LTIP Deferred shares Deferred shares Number of instruments as at 1 June 2016 Instruments granted during the year Options exercised in the year Forfeitures in the year Number of instruments as at 31 May 2017 34,825 2,862 157,508 28,504 325,401 – – – – – – 234,820 (23,917) – (46,728) (14,252) – – – – – – – – 10,908 2,862 110,780 14,252 325,401 234,820 457,436 1,055,822 1,087,209 – – – (406,024) (51,412) – (14,038) (358,360) 683,424 (13,040) (459,418) 614,751 – – – 59,280 897,390 1,057,848 92,820 – – 592,592 40,676 45,111 50,000 142,121 19,476 – – – – – – 202,709 767,262 638,636 698,464 – – – – 644,483 94,382 – – 81,384 – – – – – (20,338) – – – – – 59,280 (457,296) 440,094 – 1,057,848 (92,820) – – – – 592,592 20,338 30,074 50,000 (12,181) 129,940 – – 19,476 202,709 (12,549) (2,488) (150,385) (616,877) – – – – – – (330,011) 308,625 (320,175) 378,289 (266,897) 377,586 (56,513) (54,201) 37,869 27,183 The options outstanding at 31 May 2017 have an exercise price in the range of £Nil to £3.37 (2016: £Nil to £3.24) and a weighted average contractual life of three years (2016: three years). The weighted average share price at the time the share options were exercised in the year was £3.07 and weighted average share price at the time the share options were forfeited in the year was £2.23. NCC Group plc Annual Report and Accounts for the year ended 31 May 2017 161 NCC AR2017 proof 8- Back.indd 161 25546.04 9 August 2017 4:01 PM Proof Six 09/08/2017 16:01:56 FINANCIAL STATEMENTS Notes to the accounts FOR THE YEAR ENDED 31 MAY 2017 22 Share based payments (continued) Scheme Approved EMI scheme Approved EMI scheme CSOP scheme CSOP scheme CSOP scheme Sharesave scheme Sharesave scheme Sharesave scheme Sharesave scheme ESPP scheme ESPP scheme ISO scheme ISO scheme ISO scheme ISO scheme ISO scheme ISO scheme LTIP LTIP LTIP LTIP Deferred shares Number of instruments as at 1 June 2015 Instruments granted during the year Options exercised in the year Forfeitures in the year Number of instruments as at 31 May 2016 61,939 5,640 327,144 28,504 – – – – – 341,671 417,096 482,542 1,189,141 – – – (13,326) (13,788) 34,825 – (2778) 2,862 (169,636) – – – – 157,508 28,504 (16,270) 325,401 (412,440) (4,656) – (5,517) (19,589) 457,436 (2,142) (131,177) 1,055,822 – 1,201,312 – (114,103) 1,087,209 94,856 – (63,759) (31,097) – 92,820 – 61,014 45,111 14,284 60,000 – – – – – – 150,242 19,476 788,778 767,262 638,636 – – – – – 698,464 94,382 – – – (14,284) – 92,820 40,676 45,111 – (10,000) 50,000 (8,121) 142,121 – 19,476 (20,338) – – – – – (121,472) (667,306) – – – – – – – – – 767,262 638,636 698,464 94,382 162 www.nccgroup.trust Stock Code: NCC NCC AR2017 proof 8- Back.indd 162 25546.04 9 August 2017 4:01 PM Proof Six 09/08/2017 16:01:56 The fair value of services received in return for share options is calculated with reference to the fair value of the award on the date of grant. The fair value is spread over the period during which the employee becomes unconditionally entitled to the award, adjusted to reflect actual and expected levels of vesting. Black-Scholes and Binomial models have been used to calculate the fair values of options on their grant date for all options issued after 7 November 2002, which had not vested by 1 January 2005. The assumptions used in the model are illustrated in the table below: EMI EMI CSOP CSOP CSOP CSOP SAYE SAYE SAYE SAYE SAYE SAYE SAYE ESPP ISO ISO ISO ISO ISO ISO LTIP LTIP LTIP LTIP Deferred shares Deferred shares Grant Date August 07 February 08 August 12 July 13 August 15 July 16 August 12 August 13 August 14 August 15 August 16 August 16 March 17 February 17 January 13 January 14 January 15 August 15 February 16 July 16 July 13 July 14 July 15 July 16 July 15 July 16 Fair value at measurement date Exercise price Expected volatility Option expected term Risk-free interest rate £0.20 £0.21 £0.35 £0.25 £1.45 £0.65 £0.45 £0.32 £0.68 £1.53 £0.66 £0.95 £0.43 £0.00 £0.33 £0.35 £0.43 £1.45 £1.91 £0.64 £1.28 £1.92 £2.14 £2.75 £2.21 £3.14 £0.64 £0.65 £1.36 £1.40 £2.46 £3.28 £1.09 £1.13 £1.51 £1.87 £3.37 £2.62 £0.92 £0.92 £1.48 £2.00 £2.00 £2.46 £3.24 £3.26 £nil* £nil* £nil* £nil* £nil* £nil* 25% 25% 35% 32% 103% 31% 35% 32% 32% 6 years 6 years 6 years 6 years 6 years 3 years 3.25 years 3.25 years 3.25 years 103% 3.25 years 31% 31% 46.6% 46.8% 35% 35% 32% 103% 103% 31% 32% 32% 103% 31% 103% 31% 3 years 3.16 years 3 years 1 year 3 years 3 years 3 years 3 years 3 years 3.16 years 3 years 3 years 3 years 3 years 2 years 3 years 6.00% 6.00% 2.75% 2.75% 2.75% 1.50% 2.75% 2.75% 2.75% 2.75% 1.50% 1.50% 1.50% 1.13% 2.75% 2.75% 2.75% 2.75% 2.75% 1.50% 2.75% 2.75% 2.75% 1.81% 2.75% 1.81% * The option exercise price is nil; however, £1 is payable on each occasion of exercise. NCC Group plc Annual Report and Accounts for the year ended 31 May 2017 163 NCC AR2017 proof 8- Back.indd 163 25546.04 9 August 2017 4:01 PM Proof Six 09/08/2017 16:01:56 FINANCIAL STATEMENTS Notes to the accounts FOR THE YEAR ENDED 31 MAY 2017 22 Share based payments (continued) The expected volatility is based on the historical volatility, adjusted for any expected changes to future volatility due to publicly available information. For the options granted in the year ended 31 May 2016, dividend yield assumed at the time of option grant is 2.1% (2016: 2.1%). A charge of £0.6m (2016: £1.1m) has been made to administrative expenses in the Group income statement in respect of share based payment transactions including the provision for National Insurance contributions. 23 Called up share capital Allotted, called up and fully paid Ordinary shares of 1p each at the beginning of the year Ordinary shares of 1p each issued in the year Ordinary shares of 1p each at the end of the year Number of shares 2017 £m 2016 £m 275,939,764 570,373 276,510,137 2.8 – 2.8 2.3 0.5 2.8 During the year, 570,373 new ordinary shares of 1 pence were issued as a result of exercise of share options. As at 31 May 2017, no shares were held in treasury (2016: 116,714). 24 Cash and cash equivalents Cash flow from operating activities (Loss)/profit for the year Adjustments for: Depreciation Depreciation – individually significant item Share based charges Amortisation of intangible assets Net financing costs Profit on sale of plant and equipment Impairment of intangible assets Impairment of goodwill Individually significant items Profit on disposal of subsidiaries Income tax expense Cash inflow for the year before changes in working capital 164 Notes 12 3 22 11 7 4 3 3 3 6 8 2017 £m (56.6) 5.2 0.9 0.6 13.8 1.9 (0.1) 7.7 54.3 6.0 (1.2) 1.3 33.8 2016 £m 6.3 3.7 1.1 8.4 2.0 (0.1) 6.9 11.9 (6.0) – 3.1 37.3 www.nccgroup.trust Stock Code: NCC NCC AR2017 proof 8- Back.indd 164 25546.04 9 August 2017 4:01 PM Proof Six 09/08/2017 16:01:56 Cash and cash equivalents per balance sheet Cash and cash equivalents per cash flow statement 20.7 20.7 (6.0) (6.0) (2.4) (2.4) 12.3 12.3 At beginning of year £m Cash flow £m Non cash items £m At end of year £m Non-cash items relates to the effects of foreign currency. 25 Profit attributable to members of the Parent Company The profit for the year dealt with in the accounts of the Parent Company was £29.0m (2016: £8.8m). 26 Other financial commitments and contingent liabilities Non-cancellable operating lease rentals are payable as follows: Within one year or less Between one and five years Over five years 2017 Land and Buildings £m 4.5 22.5 27.0 54.0 Other £m 1.3 1.1 – 2.4 2016 Land and Buildings £m 3.5 7.3 0.9 11.7 Other £m 0.6 0.5 – 1.1 There are no contingent liabilities not provided for at the end of the financial year. 27 Pension scheme The Group operates a defined contribution pension scheme that is open to all eligible employees. The pension cost charge for the year represents contributions payable by the Group to the fund and amounted to £5.8m (2016: £2.5m). For the Company, the pension cost charge for the year represents contributions payable by the Company to the fund and amounted to £nil (2016: £nil). 28 Related party transactions The Group’s key management personnel comprise the Directors of the Group. The Group and Company’s transactions with those Directors are disclosed in the Directors’ Remuneration Report. During the year corporate finance fees of £0.3m (2016: £0.8m) and professional fees for services of Paul Mitchell of £nil (2016: £37,500) as Non-Executive Chairman were paid to Rickitt Mitchell & Partners Ltd. Paul Mitchell held the positions of Non- Executive Chairman of NCC Group until 31 May 2017 and is a Non-Executive Chairman of Rickitt Mitchell & Partners Ltd. 29 NCC Group plc company goodwill The goodwill addition of £14.3m (2016: £nil) is a transfer from investments of the value attributable to the continuing business, assets and liabilities of RandomStorm Limited, which hived up to a fellow NCC Group subsidiary company, NCC Group Security Services Limited, in June 2016. NCC Group plc Annual Report and Accounts for the year ended 31 May 2017 165 NCC AR2017 proof 8- Back.indd 165 25546.04 9 August 2017 4:01 PM Proof Six 09/08/2017 16:01:57 FINANCIAL STATEMENTS Notes to the accounts FOR THE YEAR ENDED 31 MAY 2017 30 Investments in subsidiary undertakings Company At 1 June 2015 Increase in subsidiary investment for share based charges At 31 May 2016 At 1 June 2016 Transfer to goodwill Impairment charge Increase in subsidiary investment for share based charges At 31 May 2017 Shares in Group undertakings £m 86.4 1.1 87.5 87.5 (14.4) (13.0) 0.6 60.7 Fixed asset investments are recognised at cost. The transfer of £14.4m relates to the value of the Accumuli plc investment cost which can be attributed to RandomStorm Limited, a subsidiary company of the Accumuli group. The continuing business, assets and liabilities of RandomStorm Limited were hived up to a fellow NCC Group subsidiary company, NCC Group Security Services Limited, in June 2016. The impairment of £13m (2016: £nil) relates to the investment cost of Accumuli plc and has been calculated by comparing the discounted future cash flows of the continuing business with the carrying value of the investment, further details on the method for calculating the discounted cash flows are described in Note 11. 166 www.nccgroup.trust Stock Code: NCC NCC AR2017 proof 8- Back.indd 166 25546.04 9 August 2017 4:01 PM Proof Six 09/08/2017 16:01:57 The undertakings in which the Company has a 100 per cent interest at 31 May 2017 are as follows: Subsidiary undertakings Country of incorporation Principal Activity Registered Office NCC Group (Solutions) Limited England and Wales Holding company Manchester Technology Centre, Oxford Road, Manchester, M1 7EF (“MTC”) NCC Services Limited England and Wales Escrow & Assurance MTC NCC Group Escrow Limited England and Wales Dormant Artemis Internet Limited England and Wales Dormant NCC Group Performance Testing Limited England and Wales Assurance NCC Group Security Services Limited England and Wales Assurance NCC Group Audit Limited England and Wales Assurance NCC Group SDLC Limited England and Wales Assurance NCC Group Pte Limited Singapore Assurance NCC Group FZ-LLC United Arab Emirates Escrow Axzona Limited England and Wales Dormant NCC Group Escrow Europe BV Netherlands Escrow NCC Group Escrow Europe (Switzerland) AG Switzerland Escrow NCC Group GmbH Germany Escrow FortConsult A/S Denmark Assurance FC Holding Lithuania ApS FC Holding Russia ApS FortConsult UAB Denmark Denmark Lithuania Assurance Assurance Assurance FortConsult Rus 000 Russia Assurance NCC Group Security Services, Inc. USA Assurance MTC MTC MTC MTC MTC MTC 112 Robinson Road, #12-01, Robinson 112, Singapore (068902) Office 15, Building 16, Dubai Internet City Dubai, UAE Ground Floor, 37 York Place, Edinburgh, EH1 3HP Van Heuven Goedhartlaan 13 1181 LE Amstelveen The Netherlands Ibelweg 18A CH-6300 Zug Switzerland Leibnizstrasse 1 85521 Ottobrunn Germany 2nd Floor Svanevej 12 DK-2400 København NV, Denmark (“FC HQ”) FC HQ FC HQ Kareiviu˛ g. 19-188 LT - LT – 09133 Vilnius, Lithuania 127204 Moscow, Dmitrovskoye Shosse 165D, Housing 5, Apartment 52 123 Mission Street Suite 900 San Francisco, CA 94105 (“US HQ”)* NCC Group plc Annual Report and Accounts for the year ended 31 May 2017 167 NCC AR2017 proof 8- Back.indd 167 25546.04 9 August 2017 4:01 PM Proof Six 09/08/2017 16:01:57 FINANCIAL STATEMENTS Notes to the accounts FOR THE YEAR ENDED 31 MAY 2017 30 Investments in subsidiary undertakings (continued) Subsidiary undertakings Country of incorporation Principal Activity Registered Office NCC Group Escrow Associates LLC NCC Group Secure Registrar, Inc. NCC Group Domain Services, Inc. NCC Group Inc. USA USA USA USA Escrow US HQ* Domain Services US HQ* Domain Services US HQ* Escrow & Assurance US HQ* NCC Group Pty Limited Australia NCC Group Security Services Corporation Canada Assurance Assurance Level 17, 383 Kent Street, Sydney NSW 2000 51 Breithaupt Atreet, Suite 100, Kitchener, Ontario N2H 5G5, Canada Accumuli Limited England and Wales Holding company Accumuli (Holdings) Limited England and Wales Holding company ArmstrongAdams Limited England and Wales Assurance Randomstorm Limited England and Wales Non-trading Eqalis Limited England and Wales Non-trading Accumuli Security Services Limited England and Wales Non-trading NCC Group Signify Solutions Limited England and Wales Assurance Fujin Technology Limited England and Wales Non-trading Accumuli Security Systems Limited England and Wales Non-trading Accumuli Security Technology Limited England and Wales Non-trading Accumuli Security ASH Limited England and Wales Non-trading NCC Group Accumuli Security Limited England and Wales Assurance MTC MTC MTC MTC MTC MTC MTC MTC MTC MTC MTC MTC Accumuli B.V. Netherlands Holding company Doezastraat 1, 2311GZ, Leiden, The Netherlands Boxing Orange MSS Limited England and Wales Dormant MTC Fox-IT Holding B.V. Netherlands Assurance Olof Palmestraat 6, 2616 LM Delft The Netherlands (“Fox HQ”) Fox-IT Group B.V. Fox-IT B.V. Fox-IT Operations B.V. Fox-IT Crypto B.V. Netherlands Netherlands Netherlands Netherlands Payment Software Company Inc USA Assurance Assurance Assurance Assurance Assurance Payment Software Company Limited England and Wales Assurance Fox HQ Fox HQ Fox HQ Fox HQ 591 West Hamilton Avenue, Suite 200, Campbell, California 95008 Upper Deck Admirals Quarters, Portsmouth Road, Thames Ditton, Surrey Virtual Security Research LCC USA Assurance 76 Sumner St, 4th Floor, Boston, MA 02110 * Principal place of business. 168 www.nccgroup.trust Stock Code: NCC NCC AR2017 proof 8- Back.indd 168 25546.04 9 August 2017 4:01 PM Proof Six 09/08/2017 16:01:57 The following dormant subsidiaries were dissolved during the financial year: Name of company Edgeseven Limited Accumuli Managed Services Limited Accumuli Debenture Limited NCC Group Employees’ Trustees Limited Escrow4Software Limited The following subsidiaries were disposed of during the financial year (on 3 January 2017): Name of company OpenRegistry S.A ClearingHouse for Intellectual Property S.A. Nexperteam CVBA Sensirius CVBA Country of incorporation Date of dissolution England and Wales 21 March 2017 England and Wales 21 March 2017 England and Wales 21 March 2017 England and Wales 21 March 2017 England and Wales 21 March 2017 Country of incorporation Principal activity Luxembourg Domain Services Luxembourg Domain Services Belgium Domain Services Belgium Domain Services The undertakings in which the Company hold less than a 100 per cent interest at the year end are as follows: Undertaking Tracks Inspector B.V. Deposit AB Escrow Europe The C I Group Holdings Limited % interest Country of incorporation Principal activity 35% 25% Netherlands Assurance Sweden Assurance 3.35% England and Wales Insurance 31 Post balance sheet events Subsequent to the balance sheet date, the Board approved a decision to sell the NCC Group Performance Test Limited (“Web Performance”) and NCC Group SDLC Limited (“Software Test”) companies. NCC Group plc Annual Report and Accounts for the year ended 31 May 2017 169 NCC AR2017 proof 8- Back.indd 169 25546.04 9 August 2017 4:01 PM Proof Six 09/08/2017 16:01:57 ADDITIONAL INFORMATION Glossary of terms Term 2014 Code Adjusted AGM Definition and usage Guidance, issued by the Financial Reporting Council in 2014, on how companies should be governed, applicable to UK listed companies including NCC Group. Any result described as adjusted excludes the impact of exceptional items, share based payments, unwinding of discount on deferred or contingent consideration, amortisation of acquired intangible assets and any tax on any of these items. Annual General Meeting of shareholders of the Company held each year to consider ordinary and special business as provided in the Notice of AGM. Average working capital % of sales Calculated as the average of each months’ closing working capital divided by rolling 12 month’s sales in each month. Board CAGR The Board of Directors of the Company (for more information see pages 62 to 63). Compound Annual Growth Rate (usually with a specified period over which it has been calculated). Cash conversion ratio Calculated as net cash from operating activities divided by Adjusted EBITDA as a percentage. CDO CEO CFO CHRO CISO Cyber Defence Operations Chief Executive Officer Chief Financial Officer Chief Human Resources Officer Chief Information Security Officer Company, Group, NCC, we, our or us We use these terms, depending on the context, to refer to either NCC Group plc the individual company or to NCC Group plc and its subsidiaries collectively. CTO Chief Technology Officer Directors/Executive Directors/ Non-Executive Directors The Directors/Executive Directors and Non-Executive Directors of the Company whose names are set out on pages 62-63 of this Report. EBIT Earnings before interest and tax. EBIT Margin% EBIT Margin is calculated as follows: adjusted EBIT divided by revenue. EBITDA EPS FCA Earnings before interest, tax, depreciation and amortisation. Calculated as operating profit before exceptional items and adding back depreciation and amortisation charged. Earnings per share. Profit for the year attributable to equity shareholders of the parent allocated to each ordinary share. Financial Conduct Authority. Financial Year For NCC Group this is an accounting year ending on 31 May. FRC Financial Reporting Council. Free cash flow Net cash from operating activities less capital expenditure. FRS A UK Financial Reporting Standard as issued by the UK Financial Reporting Council (FRC). 170 www.nccgroup.trust Stock Code: NCC NCC AR2017 proof 8- Back.indd 170 25546.04 9 August 2017 4:01 PM Proof Six 09/08/2017 16:01:57 Term Gross Margin Definition and usage Gross Margin is revenue less direct costs of sale. It excludes costs considered to be overheads that are supporting the business as a whole as opposed to a specific revenue item. Gross Margin% Gross Margin% is calculated as follows: Gross Margin divided by revenue. HMRC IAS or IFRS Her Majesty’s Revenue & Customs, the tax collecting authority of the UK. An International Accounting Standard or International Financial Reporting Standard, as issued by the International Accounting Standards Board (IASB). IFRS is also used as the term to describe international generally accepted accounting principles as a whole. Financial statements are prepared in independence with IFRS as adopted by the EU. Individually significant items Items that the Directors consider to be material in nature, scale or frequency of occurrence that need to be excluded when calculating some non-GAAP performance measures in order to allow users of the Financial Statements to gain a full understanding of the underlying businesses performance. KPMG LTIP MD MSS The Company’s external auditors, KPMG LLP. Long Term Incentive Plan established to align the interests of senior and Executive management with those of shareholders. The plan is formally known as the NCC Group Long Term Incentive Plan 2013 (approved by shareholders in 2013). Managing Director Managed Security Services Ordinary shares Voting shares entitling the holder to part ownership of a company. Organic Growth The increase or decrease in current financial year revenue or profit (as specified) compared to the comparative prior year revenue or profit, excluding the results of acquisitions and disposals and expressed in value or percentage terms Reasonable certainty Deferred tax assets are recognised if they can be utilised within three years of the balance sheet date unless there are specific circumstances making it more or less likely that these assets will be utilised. RMG ROCE% Risk, Management and Governance Return on Capital Employed is calculated as follows: adjusted operating profit divided by average operating assets and goodwill. Operating assets include tangible and intangible fixed assets, working capital and other non-current assets. ROS% Return on sales is calculated as follows: adjusted operating profit divided by revenue. Sales working capital The sum of trade debtors and accrued income used in calculating the KPI of sales working capital ratio to rolling 12 month revenue. SAYE Subsidiary TSC TSR UK GAAP Save As You Earn, being a tax efficient scheme to encourage employee share ownership. A company or other entity that is controlled by NCC Group. Technical Security Consulting Total Shareholder Return which is share price growth plus dividends reinvested (where applicable) over a specified period of time, divided by the share price at the start of the period. United Kingdom Generally Accepted Accounting Practice. Generally accepted accounting principles in the UK. These differ from IFRS and from US GAAP. Underlying Restate prior period information at current year exchange rates to give a like for like comparison. NCC Group plc Annual Report and Accounts for the year ended 31 May 2017 171 NCC AR2017 proof 8- Back.indd 171 25546.04 9 August 2017 4:01 PM Proof Six 09/08/2017 16:01:57 ADDITIONAL INFORMATION Company information – Executive Directors Chris Stone Chairman Brian Tenner Executive Debbie Hewitt MBE – Senior – Interim Chief Independent Non-Executive Director Thomas Chambers – Non-Executive Director Chris Batterham Director Jonathan Brooks Director – Non-Executive – Non-Executive Company Secretary Helen Nisbet Registered Office Manchester – Head Office (until 31 July 2017) Manchester Technology Centre Oxford Road Manchester M1 7EF XYZ Building – Head Office (from 1 August 2017) 2 Hardman Boulevard Spinningfields Manchester M3 3AQ Registered Number 4627044 Joint Brokers and Corporate Finance Advisers Jefferies International Limited Vintners Place 68 Upper Thames Street London EC4V 3BJ Peel Hunt LLP Moor House 120 London Wall London EC2Y 5ET Auditors KPMG LLP St Peter’s Square Manchester M2 3AE Solicitors DLA Piper UK LLP 1 St Peter’s Square Manchester M2 3DE Bankers The Royal Bank of Scotland plc 6th Floor, 1 Spinningfields Square Manchester M3 3AP HSBC Bank plc 2nd Floor 4 Hardman Square Spinningfields Manchester M3 3EB Lloyds Bank plc 8th Floor 40 Spring Gardens Manchester M2 1EN Registrars Equiniti Aspect House Spencer Road Lancing West Sussex BN99 6DA 172 www.nccgroup.trust Stock Code: NCC NCC AR2017 proof 8- Back.indd 172 25546.04 9 August 2017 4:01 PM Proof Six 09/08/2017 16:01:57 CONTACT US UK Manchester – Head Office (until 31 July 2017) Manchester Technology Centre Oxford Road Manchester M1 7EF XYZ Building – Head Office (from 1 August 2017) 2 Hardman Boulevard Spinningfields Manchester M3 3AQ Cambridge Endeavour House Chivers Way Vision Park Histon Cambridge CB24 9ZR Cheltenham (until October 2017) Suite 902, Part Ninth Floor Eagle Tower Montpellier Drive Cheltenham GL50 1TA Cheltenham (from November 2017) Part Fourth Floor Jessop House Jessop Avenue Cheltenham GL50 3SH Edinburgh 37 York Place Edinburgh EH1 3HP Leatherhead Kings Court Kingston Road Leatherhead KT22 7SL Leeds 2150 Thorpe Park Leeds LS15 8ZB London Floor 4 Tavistock House North London WC1H 9HR Milton Keynes Suites 526 and 528 Second Floor Elder House Eldergate Milton Keynes MK9 1LR Reading Part 2nd Floor No.3 Forbury Place Reading RG1 3JH Slough 268 Bath Road Slough Berkshire SL1 4DX Europe Denmark 2nd Floor Svanevej 12 DK-2400 København NV Denmark Germany Leibnizstrasse 1 85521 Ottobrunn Germany Lithuania Kareiviu˛ g. 19-188 LT - LT – 09133 Vilnius Lithuania Spain Calle Serrano Galvache, 56 Edificio Abedul 4ª planta 28033 Madrid Spain Sweden Norra Vallgatan 20 Sverige - 211 25 Malmö Sweden Switzerland Ibelweg 18A CH-6300 Zug Switzerland The Netherlands Olof Palmestraat 6 2616 LM Delft The Netherlands Olof Palmestraat 10 2616 LR Delft The Netherlands Wilhelmina van Pruisenweg 104, 2595 AN The Hague The Netherlands Van Heuven Goedhartlaan 13 1181 LE Amstelveen The Netherlands NCC Group plc Annual Report and Accounts for the year ended 31 May 2017 173 NCC AR2017 proof 8- Back.indd 173 25546.04 9 August 2017 4:01 PM Proof Six 09/08/2017 16:01:57 Dubai Dubai Internet City Unit E015 Building 16 DIC Dubai United Arab Emirates Singapore Singapore 20 Collyer Quay 19-07 Singapore 049319 Australia Sydney Suite 1 Level 13 92 Pitt Street Sydney New South Wales 2000 Sydney Level 20 Tower 2 Darling Park 201 Sussex Street Sydney New South Wales 2000 Canada Kitchener, Ontario Office 114 Workplace One Business Centre 51 Breithaupt Street Suite 100 Kitchener Ontario N2H 5G5 Toronto, Ontario Bloor and Yonge Building 2 Bloor Street West Suite 7000 Toronto Ontario M4W 3R1 ADDITIONAL INFORMATION Company information USA Atlanta, GA 11605 Haynes Bridge Road 400 Northwinds, Suite 550 Alpharetta GA 30009 Austin, TX 115 Wild Basin Road Suite 110 Austin TX 78746 Boston, MA 76 Summer Street 4th Floor Boston Suffolk County Massachussetts 02110 Campbell, CA 591 West Hamilton Avenue Suite 200 Campbell Santa Clara California Chicago, IL 11 East Adams Suite 400 Chicago IL 60603 New York, NY 48 W 25th Street 4th Floor New York NY 10010 San Francisco, CA 123 Mission Street Suite 900 San Francisco CA 94105 Seattle, WA 720 3rd Avenue Suite 2101 Seattle WA 98104 Sunnyvale, CA 111 West Evelyn Avenue Suite 101 – 103 Sunnyvale CA 94086 174 www.nccgroup.trust Stock Code: NCC NCC AR2017 proof 8- Back.indd 174 25546.04 9 August 2017 4:01 PM Proof Six 09/08/2017 16:01:58 Shareholder notes NCC Group plc Annual Report and Accounts for the year ended 31 May 2017 175 NCC AR2017 proof 8- Back.indd 175 25546.04 9 August 2017 4:01 PM Proof Six 09/08/2017 16:01:58 ADDITIONAL INFORMATION Shareholder notes 176 www.nccgroup.trust Stock Code: NCC NCC AR2017 proof 8- Back.indd 176 25546.04 9 August 2017 4:01 PM Proof Six 09/08/2017 16:01:58 NCC AR2017 - proof 8-Front.indd 6 8/9/2017 4:41:47 PM 25546.04 9 August 2017 4:40 PM Proof Six N C C G r o u p p l c A n n u a l R e p o r t a n d A c c o u n t s f o r t h e y e a r e n d e d 3 1 M a y 2 0 1 7 Manchester – Head Office (until 31 July 2017) Manchester Technology Centre Oxford Road Manchester M1 7EF XYZ Building – Head Office (from 1 August 2017) 2 Hardman Boulevard Spinningfields Manchester M3 3AQ www.nccgroup.trust NCC AR2017 - proof 8-Front.indd 1 25546.04 9 August 2017 3:58 PM Proof Six 09/08/2017 16:03:36 

Continue reading text version or see original annual report in PDF format above